@mycadet/assistant 0.12.7 → 0.12.9

package/src/__tests__/oauth-commands-routes.test.ts

@@ -22,7 +22,7 @@ import { beforeEach, describe, expect, mock, test } from "bun:test";
 interface MockProviderRow {
   provider: string;
   authorizeUrl: string;
-  managedServiceConfigKey: string | null;
+  cloudServiceConfigKey: string | null;
   baseUrl: string | null;
   injectionTemplates: string | null;
   defaultScopes?: string;
@@ -38,7 +38,7 @@ interface MockProviderRow {
 const baseProvider: MockProviderRow = {
   provider: "google",
   authorizeUrl: "https://accounts.google.com/o/oauth2/v2/auth",
-  managedServiceConfigKey: "google-oauth",
+  cloudServiceConfigKey: "google-oauth",
   baseUrl: "https://api.google.com",
   injectionTemplates: null,
   pingUrl: null,
@@ -54,7 +54,7 @@ let mockAllConnections: Record<string, unknown[]> = {};
 let mockApps: Record<string, unknown> = {};
 let mockTokenValue = "tok-fake";
 let platformAvailable = true;
-let platformAssistantId: string | null = "assistant-1";
+let cloudAssistantId: string | null = "assistant-1";
 let mockFetchImpl: (
   path: string,
   init?: RequestInit,
@@ -145,14 +145,14 @@ mock.module("../oauth/manual-token-connection.js", () => ({
   },
 }));
 
-mock.module("../platform/client.js", () => ({
-  CadetPlatformClient: {
+mock.module("../cloud/client.js", () => ({
+  CadetCloudClient: {
     create: async () => {
       if (!platformAvailable) {
         return null;
       }
       return {
-        platformAssistantId,
+        cloudAssistantId,
         fetch: (path: string, init?: RequestInit) => mockFetchImpl(path, init),
       };
     },
@@ -219,7 +219,7 @@ beforeEach(() => {
   mockApps = {};
   mockTokenValue = "tok-fake";
   platformAvailable = true;
-  platformAssistantId = "assistant-1";
+  cloudAssistantId = "assistant-1";
   mockFetchImpl = async () => ({
     ok: true,
     status: 200,
@@ -363,7 +363,7 @@ describe("GET oauth/mode", () => {
     mockProviders.byo = {
       ...baseProvider,
       provider: "byo",
-      managedServiceConfigKey: null,
+      cloudServiceConfigKey: null,
     };
     const result = (await getRoute("GET", "oauth/mode").handler(
       makeArgs({ queryParams: { provider: "byo" } }),
@@ -390,7 +390,7 @@ describe("POST oauth/mode", () => {
     mockProviders.byo = {
       ...baseProvider,
       provider: "byo",
-      managedServiceConfigKey: null,
+      cloudServiceConfigKey: null,
     };
     await expect(
       getRoute("POST", "oauth/mode").handler(
@@ -403,7 +403,7 @@ describe("POST oauth/mode", () => {
     mockProviders.byo = {
       ...baseProvider,
       provider: "byo",
-      managedServiceConfigKey: null,
+      cloudServiceConfigKey: null,
     };
     const rawBefore = JSON.stringify(loadRawConfig());
     const result = (await getRoute("POST", "oauth/mode").handler(
@@ -501,7 +501,7 @@ describe("GET oauth/status", () => {
       ...baseProvider,
       provider: "telegram",
       authorizeUrl: "urn:manual-token",
-      managedServiceConfigKey: null,
+      cloudServiceConfigKey: null,
       baseUrl: "https://api.telegram.org",
     };
     mockAllConnections.telegram = [
@@ -877,7 +877,7 @@ describe("POST oauth/request", () => {
     mockProviders.slack_channel = {
       ...baseProvider,
       provider: "slack_channel",
-      managedServiceConfigKey: null,
+      cloudServiceConfigKey: null,
       baseUrl: "https://slack.com/api",
       injectionTemplates: JSON.stringify([
         {
@@ -906,7 +906,7 @@ describe("POST oauth/request", () => {
     mockProviders.slack_channel = {
       ...baseProvider,
       provider: "slack_channel",
-      managedServiceConfigKey: null,
+      cloudServiceConfigKey: null,
       baseUrl: "https://slack.com/api",
       injectionTemplates: JSON.stringify([
         {
@@ -943,7 +943,7 @@ describe("POST oauth/request", () => {
     return {
       ...baseProvider,
       provider,
-      managedServiceConfigKey: null,
+      cloudServiceConfigKey: null,
       baseUrl: seed.baseUrl ?? null,
       injectionTemplates: JSON.stringify(seed.injectionTemplates),
       responseOkField: seed.responseOkField ?? null,
@@ -1178,8 +1178,8 @@ describe("POST oauth/managed-connect/start", () => {
     expect(result.connect_url).toBe("https://mycadet.ai/connect/abc");
   });
 
-  test("forwards tenant_host to the platform only when one is supplied", async () => {
-    // Shopify's endpoints live on the merchant's host, which the platform
+  test("forwards tenant_host to the cloud only when one is supplied", async () => {
+    // Shopify's endpoints live on the merchant's host, which the cloud
     // substitutes into its templates; other providers must not see the key.
     const bodies: Array<Record<string, unknown>> = [];
     mockFetchImpl = async (_path, init) => {

package/src/__tests__/oauth-connect-orchestrator.test.ts

@@ -88,7 +88,7 @@ type ProviderRow = {
   pingBody: string | null;
   revokeUrl: string | null;
   revokeBodyTemplate: string | null;
-  managedServiceConfigKey: string | null;
+  cloudServiceConfigKey: string | null;
   displayLabel: string | null;
   description: string | null;
   dashboardUrl: string | null;
@@ -168,7 +168,7 @@ function makeProviderRow(
     pingBody: null,
     revokeUrl: null,
     revokeBodyTemplate: null,
-    managedServiceConfigKey: null,
+    cloudServiceConfigKey: null,
     displayLabel: null,
     description: null,
     dashboardUrl: null,

package/src/__tests__/oauth-provider-serializer.test.ts

@@ -28,7 +28,7 @@ function makeRow(overrides: Partial<OAuthProviderRow> = {}): OAuthProviderRow {
     pingBody: null,
     revokeUrl: null,
     revokeBodyTemplate: null,
-    managedServiceConfigKey: null,
+    cloudServiceConfigKey: null,
     managedServiceIsPaid: false,
     displayLabel: null,
     description: null,
@@ -114,14 +114,14 @@ describe("serializeProvider", () => {
     expect(result.identityResponsePaths).toBeNull();
   });
 
-  test("supportsManagedMode is true when managedServiceConfigKey is non-null", () => {
-    const row = makeRow({ managedServiceConfigKey: "google-managed" });
+  test("supportsManagedMode is true when cloudServiceConfigKey is non-null", () => {
+    const row = makeRow({ cloudServiceConfigKey: "google-managed" });
     const result = serializeProvider(row)!;
     expect(result.supportsManagedMode).toBe(true);
   });
 
-  test("supportsManagedMode is false when managedServiceConfigKey is null", () => {
-    const row = makeRow({ managedServiceConfigKey: null });
+  test("supportsManagedMode is false when cloudServiceConfigKey is null", () => {
+    const row = makeRow({ cloudServiceConfigKey: null });
     const result = serializeProvider(row)!;
     expect(result.supportsManagedMode).toBe(false);
   });
@@ -276,7 +276,7 @@ describe("serializeProviderSummary", () => {
       dashboardUrl: "https://console.cloud.google.com",
       clientIdPlaceholder: "your-client-id.apps.googleusercontent.com",
       requiresClientSecret: 1,
-      managedServiceConfigKey: "google-managed",
+      cloudServiceConfigKey: "google-managed",
     });
 
     const result = serializeProviderSummary(row)!;
@@ -289,7 +289,7 @@ describe("serializeProviderSummary", () => {
       client_id_placeholder: "your-client-id.apps.googleusercontent.com",
       requires_client_secret: true,
       logo_url: null,
-      supports_managed_mode: true,
+      supports_cloud_mode: true,
       managed_service_is_paid: false,
       feature_flag: null,
       category: "productivity",
@@ -311,7 +311,7 @@ describe("serializeProviderSummary", () => {
 
   test("exposes the tenant host a per-tenant provider needs at connect", () => {
     // Shopify's OAuth endpoints live on the merchant's own host, so a client
-    // has to collect it before the managed flow can start. The summary is the
+    // has to collect it before the cloud flow can start. The summary is the
     // only provider metadata the web client reads, so it carries the ask.
     const shopify = serializeProviderSummary(makeRow({ provider: "shopify" }))!;
     expect(shopify.tenant_host).toEqual({
@@ -368,10 +368,10 @@ describe("serializeProviderSummary", () => {
     expect(result.requires_client_secret).toBe(false);
   });
 
-  test("supports_managed_mode is false when managedServiceConfigKey is null", () => {
-    const row = makeRow({ managedServiceConfigKey: null });
+  test("supports_cloud_mode is false when cloudServiceConfigKey is null", () => {
+    const row = makeRow({ cloudServiceConfigKey: null });
     const result = serializeProviderSummary(row)!;
-    expect(result.supports_managed_mode).toBe(false);
+    expect(result.supports_cloud_mode).toBe(false);
   });
 
   test("returns null for null input", () => {

package/src/__tests__/oauth-providers-routes.test.ts

@@ -9,7 +9,7 @@ const mockListProviders = mock(() => [
     clientIdPlaceholder: null,
     logoUrl: "https://cdn.simpleicons.org/google",
     requiresClientSecret: 1,
-    managedServiceConfigKey: "google-oauth",
+    cloudServiceConfigKey: "google-oauth",
     authorizeUrl: "https://accounts.google.com/o/oauth2/v2/auth",
     tokenExchangeUrl: "https://oauth2.googleapis.com/token",
     refreshUrl: null,
@@ -52,7 +52,7 @@ const mockListProviders = mock(() => [
     clientIdPlaceholder: null,
     logoUrl: null,
     requiresClientSecret: 1,
-    managedServiceConfigKey: null,
+    cloudServiceConfigKey: null,
     authorizeUrl: "https://github.com/login/oauth/authorize",
     tokenExchangeUrl: "https://github.com/login/oauth/access_token",
     refreshUrl: null,
@@ -151,7 +151,7 @@ describe("GET /v1/oauth/providers", () => {
         dashboard_url: string | null;
         client_id_placeholder: string | null;
         requires_client_secret: boolean;
-        supports_managed_mode: boolean;
+        supports_cloud_mode: boolean;
       }>;
     };
 
@@ -177,7 +177,7 @@ describe("GET /v1/oauth/providers", () => {
       "client_id_placeholder",
       "requires_client_secret",
       "logo_url",
-      "supports_managed_mode",
+      "supports_cloud_mode",
       "managed_service_is_paid",
       "feature_flag",
       "category",
@@ -208,42 +208,42 @@ describe("GET /v1/oauth/providers", () => {
     expect(providers[1]!.logo_url).toBeNull();
   });
 
-  test("supports_managed_mode=true returns only managed providers", async () => {
+  test("supports_cloud_mode=true returns only cloud providers", async () => {
     const { status, body } = await callRoute(
       getRoute("GET", "oauth/providers"),
-      { queryParams: { supports_managed_mode: "true" } },
+      { queryParams: { supports_cloud_mode: "true" } },
     );
 
     expect(status).toBe(200);
     const { providers } = body as {
       providers: Array<{
         provider_key: string;
-        supports_managed_mode: boolean;
+        supports_cloud_mode: boolean;
       }>;
     };
 
     expect(providers).toHaveLength(1);
     expect(providers[0]!.provider_key).toBe("google");
-    expect(providers[0]!.supports_managed_mode).toBe(true);
+    expect(providers[0]!.supports_cloud_mode).toBe(true);
   });
 
-  test("supports_managed_mode=false returns only non-managed providers", async () => {
+  test("supports_cloud_mode=false returns only non-cloud providers", async () => {
     const { status, body } = await callRoute(
       getRoute("GET", "oauth/providers"),
-      { queryParams: { supports_managed_mode: "false" } },
+      { queryParams: { supports_cloud_mode: "false" } },
     );
 
     expect(status).toBe(200);
     const { providers } = body as {
       providers: Array<{
         provider_key: string;
-        supports_managed_mode: boolean;
+        supports_cloud_mode: boolean;
       }>;
     };
 
     expect(providers).toHaveLength(1);
     expect(providers[0]!.provider_key).toBe("github");
-    expect(providers[0]!.supports_managed_mode).toBe(false);
+    expect(providers[0]!.supports_cloud_mode).toBe(false);
   });
 });
 

package/src/__tests__/oauth-store.test.ts

@@ -2391,7 +2391,7 @@ describe("disconnectOAuthProvider", () => {
   test("replaces all occurrences of {access_token} in body template values (matching Python str.replace)", async () => {
     // Python's str.replace(old, new) replaces ALL occurrences by default,
     // whereas JavaScript's String.prototype.replace with a string pattern
-    // only replaces the FIRST occurrence. The platform's try_revoke_token
+    // only replaces the FIRST occurrence. The cloud's try_revoke_token
     // is implemented in Python, so any template value containing repeated
     // placeholders must have ALL of them substituted to preserve parity.
     // This test guards against a regression to .replace(), which would

package/src/__tests__/oauth2-gateway-transport.test.ts

@@ -60,13 +60,13 @@ mock.module("../inbound/public-ingress-urls.js", () => ({
 }));
 
 mock.module("../config/env-registry.js", () => ({
-  getIsPlatform: () => false,
+  getIsCloud: () => false,
 }));
 
-// Mock platform-callback-registration to avoid cold-start latency from its
+// Mock cloud-callback-registration to avoid cold-start latency from its
 // transitive dependencies (config/env.js) which can cause the 10ms timer in
 // the auto-detection test to fire before openUrl is called.
-mock.module("../inbound/platform-callback-registration.js", () => ({
+mock.module("../inbound/cloud-callback-registration.js", () => ({
   registerCallbackRoute: () => Promise.reject(new Error("not containerized")),
   resolveCallbackUrl: (directUrl: () => string) => Promise.resolve(directUrl()),
 }));

package/src/__tests__/onboarding-persona-write.test.ts

@@ -1,7 +1,7 @@
 /**
  * Tests for `writeOnboardingSection` in persona-resolver.
  *
- * The function writes a managed `## Onboarding Context` section to the
+ * The function writes a cloud `## Onboarding Context` section to the
  * guardian persona file (with a fallback chain). These tests stub
  * `util/platform.js` and `contacts/contact-store.js` to control the
  * write target and verify idempotency, fallback, and field omission.
@@ -257,7 +257,7 @@ describe("writeOnboardingSection", () => {
     expect(content).not.toContain("GitHub");
   });
 
-  test("preserves content outside the managed section", () => {
+  test("preserves content outside the cloud section", () => {
     mockGuardianDeliveries = [];
     mockContactsByAddress = {};
     writeFileSync(

package/src/__tests__/openai-image-service.test.ts

@@ -252,12 +252,12 @@ describe("generateImageOpenAI", () => {
     ).toBeUndefined();
   });
 
-  test("managed-proxy credentials set baseURL on the OpenAI client", async () => {
+  test("cloud-proxy credentials set baseURL on the OpenAI client", async () => {
     fakeResponse = imageResponse({ b64_json: "x" });
 
     await generateImageOpenAI(
       {
-        type: "managed-proxy",
+        type: "cloud-proxy",
         assistantApiKey: "proxy-key",
         baseUrl: "https://proxy.example.com/v1",
       },

package/src/__tests__/openai-responses-cutover-guard.test.ts

@@ -31,9 +31,9 @@ import { describe, expect, test } from "bun:test";
  *   # LLM context normalization (transport-agnostic message handling)
  *   bun test src/__tests__/llm-context-normalization.test.ts
  *
- *   # Provider registry and managed proxy integration
+ *   # Provider registry and cloud proxy integration
  *   bun test src/__tests__/registry.test.ts
- *   bun test src/__tests__/provider-managed-proxy-integration.test.ts
+ *   bun test src/__tests__/provider-cloud-proxy-integration.test.ts
  *
  *   # Web search guard (allowlist includes both provider files)
  *   bun test src/__tests__/conversation-history-web-search.test.ts

package/src/__tests__/openai-responses-provider.test.ts

@@ -259,7 +259,7 @@ describe("OpenAIResponsesProvider", () => {
     new OpenAIResponsesProvider("sk-custom", "gpt-5.4", {
       baseURL: "https://proxy.example.com/v1",
       providerName: "openai-managed",
-      providerLabel: "Managed OpenAI",
+      providerLabel: "Cloud OpenAI",
     });
 
     expectOpenAIConstructorOptions({

package/src/__tests__/path-policy.test.ts

@@ -13,7 +13,7 @@ import { afterEach, describe, expect, test } from "bun:test";
 import { getBundledSkillsDir } from "../config/skills.js";
 import {
   getBundledSkillsRoot,
-  getManagedSkillsRoot,
+  getCloudSkillsRoot,
   getSkillRoots,
   isSkillSourcePath,
   normalizeDirPath,
@@ -594,9 +594,9 @@ describe("normalizeFilePath", () => {
   });
 });
 
-describe("getManagedSkillsRoot / getBundledSkillsRoot", () => {
+describe("getCloudSkillsRoot / getBundledSkillsRoot", () => {
   test("returns managed skills dir with trailing separator", () => {
-    const root = getManagedSkillsRoot();
+    const root = getCloudSkillsRoot();
     expect(root.endsWith(sep)).toBe(true);
     expect(root).toContain("skills");
   });
@@ -695,7 +695,7 @@ describe("isSkillSourcePath", () => {
     testDirs.push(linkPath);
 
     // A file inside the symlinked skill should NOT match because realpath
-    // resolves it to realDir which is outside the managed skills dir
+    // resolves it to realDir which is outside the cloud skills dir
     const filePath = join(linkPath, "executor.ts");
     // The symlink target (realDir) is outside MOCK_MANAGED_DIR, so this
     // should be false (symlink-safe detection)

package/src/__tests__/personal-memory-auth-bypass.test.ts

@@ -4,7 +4,7 @@
  *
  * `isPersonalMemoryAllowed` derives trust from `resolveTrustClass`, which only
  * elevates an *unresolved* actor to guardian under DISABLE_HTTP_AUTH (the
- * standing config in platform-managed deployments). A resolved non-guardian
+ * standing config in cloud-managed deployments). A resolved non-guardian
  * channel actor must therefore be denied personal memory even with auth
  * disabled — otherwise the guardian's memory leaks to Slack/phone contacts in
  * the cloud. See LUM-2669. These cases fail on the pre-fix behavior.

package/src/__tests__/platform-bash-auto-approve.test.ts

@@ -1,8 +1,8 @@
 /**
- * Tests for platform-hosted bash auto-approval.
+ * Tests for cloud-hosted bash auto-approval.
  *
  * Verifies that bash and host_bash tools are auto-approved without prompting
- * when running in platform-hosted mode (IS_PLATFORM=true) for guardian actors.
+ * when running in cloud-hosted mode (IS_CLOUD=true) for guardian actors.
  * Also verifies that deny rules, non-guardian actors, requireFreshApproval,
  * and non-bash tools are unaffected by this auto-approval path.
  */
@@ -126,7 +126,7 @@ afterAll(() => {
 // Platform-hosted bash auto-approval
 // ---------------------------------------------------------------------------
 
-describe("platform-hosted bash auto-approval", () => {
+describe("cloud-hosted bash auto-approval", () => {
   beforeEach(() => {
     fakeToolResult = { content: "ok", isError: false };
     checkResultOverride = undefined;
@@ -136,7 +136,7 @@ describe("platform-hosted bash auto-approval", () => {
 
   afterEach(() => {});
 
-  test("bash auto-approved in platform-hosted mode", async () => {
+  test("bash auto-approved in cloud-hosted mode", async () => {
     checkResultOverride = { decision: "prompt", reason: "Needs approval" };
 
     let promptCalled = false;
@@ -154,14 +154,14 @@ describe("platform-hosted bash auto-approval", () => {
     const result = await executor.execute(
       "bash",
       { command: "echo hello" },
-      makeContext({ isPlatformHosted: true, trustClass: "guardian" }),
+      makeContext({ isCloudHosted: true, trustClass: "guardian" }),
     );
 
     expect(promptCalled).toBe(false);
     expect(result.isError).toBe(false);
   });
 
-  test("host_bash NOT auto-approved in platform-hosted mode", async () => {
+  test("host_bash NOT auto-approved in cloud-hosted mode", async () => {
     checkResultOverride = { decision: "prompt", reason: "Needs approval" };
 
     let promptCalled = false;
@@ -179,13 +179,13 @@ describe("platform-hosted bash auto-approval", () => {
     await executor.execute(
       "host_bash",
       { command: "echo hello" },
-      makeContext({ isPlatformHosted: true, trustClass: "guardian" }),
+      makeContext({ isCloudHosted: true, trustClass: "guardian" }),
     );
 
     expect(promptCalled).toBe(true);
   });
 
-  test("bash NOT auto-approved when not platform-hosted", async () => {
+  test("bash NOT auto-approved when not cloud-hosted", async () => {
     checkResultOverride = { decision: "prompt", reason: "Needs approval" };
 
     let promptCalled = false;
@@ -204,7 +204,7 @@ describe("platform-hosted bash auto-approval", () => {
       "bash",
       { command: "echo hello" },
       makeContext({
-        isPlatformHosted: false,
+        isCloudHosted: false,
         trustClass: "guardian",
         requireFreshApproval: true,
       }),
@@ -213,7 +213,7 @@ describe("platform-hosted bash auto-approval", () => {
     expect(promptCalled).toBe(true);
   });
 
-  test("bash NOT auto-approved for non-guardian actors via platform path (trusted_contact requires grant)", async () => {
+  test("bash NOT auto-approved for non-guardian actors via cloud path (trusted_contact requires grant)", async () => {
     checkResultOverride = { decision: "prompt", reason: "Needs approval" };
 
     const trackingPrompter = {
@@ -230,7 +230,7 @@ describe("platform-hosted bash auto-approval", () => {
       "bash",
       { command: "echo hello" },
       makeContext({
-        isPlatformHosted: true,
+        isCloudHosted: true,
         trustClass: "trusted_contact",
         requireFreshApproval: true,
       }),
@@ -261,7 +261,7 @@ describe("platform-hosted bash auto-approval", () => {
       "bash",
       { command: "echo hello" },
       makeContext({
-        isPlatformHosted: true,
+        isCloudHosted: true,
         trustClass: "guardian",
         requireFreshApproval: true,
       }),
@@ -270,7 +270,7 @@ describe("platform-hosted bash auto-approval", () => {
     expect(promptCalled).toBe(true);
   });
 
-  test("deny rules still respected in platform-hosted mode", async () => {
+  test("deny rules still respected in cloud-hosted mode", async () => {
     checkResultOverride = { decision: "deny", reason: "Explicitly denied" };
 
     const executor = new ToolExecutor(makePrompter());
@@ -278,7 +278,7 @@ describe("platform-hosted bash auto-approval", () => {
       "bash",
       { command: "rm -rf /" },
       makeContext({
-        isPlatformHosted: true,
+        isCloudHosted: true,
         trustClass: "guardian",
         requireFreshApproval: true,
       }),
@@ -288,7 +288,7 @@ describe("platform-hosted bash auto-approval", () => {
     expect(result.content).toContain("Explicitly denied");
   });
 
-  test("high-risk bash auto-approved in platform-hosted mode", async () => {
+  test("high-risk bash auto-approved in cloud-hosted mode", async () => {
     riskOverride = "high";
     checkResultOverride = { decision: "prompt", reason: "High risk command" };
 
@@ -307,14 +307,14 @@ describe("platform-hosted bash auto-approval", () => {
     const result = await executor.execute(
       "bash",
       { command: "rm -rf /tmp/stuff" },
-      makeContext({ isPlatformHosted: true, trustClass: "guardian" }),
+      makeContext({ isCloudHosted: true, trustClass: "guardian" }),
     );
 
     expect(promptCalled).toBe(false);
     expect(result.isError).toBe(false);
   });
 
-  test("non-bash tools NOT auto-approved in platform-hosted mode", async () => {
+  test("non-bash tools NOT auto-approved in cloud-hosted mode", async () => {
     checkResultOverride = { decision: "prompt", reason: "Needs approval" };
 
     let promptCalled = false;
@@ -333,7 +333,7 @@ describe("platform-hosted bash auto-approval", () => {
       "file_write",
       { path: "/tmp/test.txt", content: "hello" },
       makeContext({
-        isPlatformHosted: true,
+        isCloudHosted: true,
         trustClass: "guardian",
         requireFreshApproval: true,
       }),

package/src/__tests__/plugin-api-model-profiles.test.ts

@@ -40,7 +40,7 @@ describe("getModelProfiles", () => {
     writeFixtureConfig({});
   });
 
-  test("omits the managed Jev profile, whose model returns verdicts rather than text", () => {
+  test("omits the cloud Jev profile, whose model returns verdicts rather than text", () => {
     writeFixtureConfig({});
     const keys = getModelProfiles().map((p) => p.key);
     expect(keys).toContain("balanced");

package/src/__tests__/plugin-api-provider.test.ts

@@ -1,7 +1,7 @@
 /**
  * `getConfiguredProvider` is part of the public `@mycadet/plugin-api` runtime
  * surface, so a user-installable plugin can run inference through the
- * workspace's configured profiles/credentials (managed-proxy or BYOK) without
+ * workspace's configured profiles/credentials (cloud-proxy or BYOK) without
  * supplying its own API key.
  */
 import { describe, expect, test } from "bun:test";

package/src/__tests__/plugin-api-store-credential.test.ts

@@ -198,7 +198,10 @@ describe("storeCredential", () => {
 
   test("scrubs the stored value from recent transcripts", async () => {
     await asPlugin(() => storeCredential("acme/api_key", "sk-secret"));
-    expect(scrubSpy).toHaveBeenCalledWith("sk-secret");
+    expect(scrubSpy).toHaveBeenCalledWith("sk-secret", {
+      service: "acme",
+      field: "api_key",
+    });
   });
 
   test("skips the transcript scrub when asked", async () => {

package/src/__tests__/plugin-api-webhook-url.test.ts

@@ -11,15 +11,14 @@
 import { afterEach, describe, expect, spyOn, test } from "bun:test";
 
 const loader = await import("../config/loader.js");
-const registration =
-  await import("../inbound/platform-callback-registration.js");
+const registration = await import("../inbound/cloud-callback-registration.js");
 const { resolveWebhookUrl } = await import("../plugin-api/webhook-url.js");
 const { runInPluginContext } =
   await import("../plugins/plugin-execution-context.js");
 
 describe("resolveWebhookUrl", () => {
   afterEach(() => {
-    delete process.env.IS_PLATFORM;
+    delete process.env.IS_CLOUD;
   });
   test("composes the plugin's namespaced path and delegates the tier choice", async () => {
     const spy = spyOn(registration, "resolveCallbackUrl").mockResolvedValue(
@@ -79,7 +78,7 @@ describe("resolveWebhookUrl", () => {
   });
 
   test("gives routes that share a slug distinct registration types", async () => {
-    // The platform keys a callback route by type, so a collision has the
+    // The cloud keys a callback route by type, so a collision has the
     // second registration replace the first. `events-v1` and `events_v1`
     // slugify identically.
     const spy = spyOn(registration, "resolveCallbackUrl").mockResolvedValue(
@@ -153,7 +152,7 @@ describe("resolveWebhookUrl", () => {
     // The Tunnel forwards the request path verbatim and the gateway
     // admits it only when it matches a claimed path byte for byte. A trailing
     // slash on this URL would be rejected before the gateway ever saw it.
-    process.env.IS_PLATFORM = "true";
+    process.env.IS_CLOUD = "true";
     const configSpy = spyOn(loader, "getConfig").mockReturnValue({
       ingress: { publicBaseUrl: "https://tunnel.mycadet.ai/assistant-abc" },
     } as ReturnType<typeof loader.getConfig>);