@mycadet/assistant 0.12.7 → 0.12.9

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mycadet/assistant",
-  "version": "0.12.7",
+  "version": "0.12.9",
   "license": "MIT",
   "type": "module",
   "exports": {
@@ -20,7 +20,7 @@
     "probe:skill-retrieval": "bun run scripts/probe-skill-retrieval.ts",
     "format": "prettier --write .",
     "format:check": "prettier --check .",
-    "lint": "bun run lint:skills && bun run lint:openapi && eslint --max-warnings 3033",
+    "lint": "bun run lint:skills && bun run lint:openapi && eslint --max-warnings 2956",
     "lint:unused": "knip --include files,dependencies,unlisted",
     "lint:circular": "bun run scripts/check-circular-deps.ts",
     "lint:unused:production": "knip --production --include exports",

package/scripts/build-test-fixtures.ts

@@ -43,7 +43,7 @@ async function buildMigratedFixture(outWorkspaceDir: string): Promise<void> {
   const buildWorkspace = join(buildRoot, "workspace");
   mkdirSync(buildWorkspace);
   process.env.CADET_WORKSPACE_DIR = buildWorkspace;
-  process.env.CADET_PLATFORM_URL ??= "https://test-cloud.mycadet.ai";
+  process.env.CADET_CLOUD_URL ??= "https://test-cloud.mycadet.ai";
   // Match the preload's env hygiene so migrations never route through a live
   // credential store while building the fixture.
   delete process.env.IS_CONTAINERIZED;

package/scripts/probe-skill-retrieval.ts

@@ -41,7 +41,7 @@ import {
   DEFAULT_CARD_CHARS,
   renderSkillCard,
 } from "../src/plugins/defaults/memory/substrate/skill-content.js";
-import { filterSkillsByPlatform } from "../src/skills/platform-compatibility.js";
+import { filterSkillsByPlatform } from "../src/skills/cloud-compatibility.js";
 
 interface ProbeOptions {
   queries: string[];

package/scripts/sync-llm-catalog.ts

@@ -121,8 +121,8 @@ function projectProvider(entry: ProviderCatalogEntry): Record<string, unknown> {
   if (entry.credentialsGuide !== undefined) {
     projected.credentialsGuide = entry.credentialsGuide;
   }
-  if (entry.supportsPlatformAuth !== undefined) {
-    projected.supportsPlatformAuth = entry.supportsPlatformAuth;
+  if (entry.supportsCloudAuth !== undefined) {
+    projected.supportsCloudAuth = entry.supportsCloudAuth;
   }
   if (entry.featureFlag !== undefined) {
     projected.featureFlag = entry.featureFlag;

package/scripts/voice-ttft-spike.ts

@@ -14,7 +14,7 @@
  *   full-flash    cost-optimized, real buildSystemPrompt() + full tool defs
  *   full-quality  quality-optimized, full prompt + tools (pre-flag brain)
  *
- * Run with the daemon's environment so the managed connection resolves:
+ * Run with the daemon's environment so the cloud connection resolves:
  *   CADET_WORKSPACE_DIR=<daemon workspace> \
  *     bun run scripts/voice-ttft-spike.ts [--trials 3] [--variants a,b]
  *
@@ -216,7 +216,7 @@ async function main(): Promise<void> {
     const resolveMs = performance.now() - resolveStart;
     if (!provider) {
       console.error(
-        `${spec.name}: no provider resolved (managed credentials missing? ` +
+        `${spec.name}: no provider resolved (cloud credentials missing? ` +
           `run with the daemon's CADET_WORKSPACE_DIR)`,
       );
       continue;

package/src/__tests__/adaptive-thinking-repair.test.ts

@@ -9,8 +9,8 @@ import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { afterEach, beforeEach, describe, expect, test } from "bun:test";
 
-import { repairAdaptiveThinkingOnManagedProfiles } from "../workspace/adaptive-thinking-repair.js";
-import { enableAdaptiveThinkingManagedProfilesMigration } from "../workspace/migrations/097-enable-adaptive-thinking-managed-profiles.js";
+import { repairAdaptiveThinkingOnCloudProfiles } from "../workspace/adaptive-thinking-repair.js";
+import { enableAdaptiveThinkingCloudProfilesMigration } from "../workspace/migrations/097-enable-adaptive-thinking-managed-profiles.js";
 import { recheckAdaptiveThinkingModelImpliedAnthropicMigration } from "../workspace/migrations/104-recheck-adaptive-thinking-model-implied-anthropic.js";
 
 const ADAPTIVE = { enabled: true, streamThinking: true };
@@ -53,10 +53,10 @@ function profile(name: string): Record<string, unknown> {
 // the same logic (migration modules must stay self-contained). Run every
 // scenario against all of them so the copies can't drift.
 const implementations: Array<[string, (dir: string) => void]> = [
-  ["startup repair", repairAdaptiveThinkingOnManagedProfiles],
+  ["startup repair", repairAdaptiveThinkingOnCloudProfiles],
   [
     "migration 097",
-    (dir) => enableAdaptiveThinkingManagedProfilesMigration.run(dir),
+    (dir) => enableAdaptiveThinkingCloudProfilesMigration.run(dir),
   ],
   [
     "migration 104",

package/src/__tests__/agent-loop-override-profile.test.ts

@@ -272,17 +272,17 @@ mock.module("../providers/registry.js", () => ({
   resolveProviderFromConnection: async () => anthropicStub,
 }));
 
-import { CADET_MANAGED_CONNECTION_NAME } from "../providers/cadet-model-routing.js";
+import { CADET_CLOUD_CONNECTION_NAME } from "../providers/cadet-model-routing.js";
 
 // Connection-aware resolver path: satisfy
 // `tryResolveProviderForConnectionName` lookups so resolveDefaultProvider
 // returns a usable provider for any connection name the winning profile
-// references. The managed connection must be the platform-auth sentinel row:
-// a managed profile routing through anything else resolves to the platform
+// references. The cloud connection must be the cloud-auth sentinel row:
+// a cloud profile routing through anything else resolves to the cloud
 // instead. Other names behave as personal anthropic connections.
 mock.module("../providers/inference/connections.js", () => ({
   getConnection: (_db: unknown, name: string) =>
-    name === CADET_MANAGED_CONNECTION_NAME
+    name === CADET_CLOUD_CONNECTION_NAME
       ? {
           id: 1,
           name,

package/src/__tests__/agent-loop-subagent-billing-headers.test.ts

@@ -106,7 +106,7 @@ describe("AgentLoop subagent billing-header attribution", () => {
     // GIVEN a conversation stamped as an advisor-consult subagent
     await seedConversation("conv-loop-advisor", "advisor", "advisor_consult");
 
-    // AND a managed-proxy-shaped provider stack (headers forwarded)
+    // AND a cloud-proxy-shaped provider stack (headers forwarded)
     const { provider, configs } = makeRecordingProvider("openai");
     const wrapped = new RetryProvider(provider, {
       forwardUsageAttributionHeaders: true,

package/src/__tests__/anthropic-provider.test.ts

@@ -2948,10 +2948,10 @@ describe("AnthropicProvider — Cache-Control Characterization", () => {
 });
 
 // ---------------------------------------------------------------------------
-// Tests — Managed Proxy Fallback
+// Tests — Cloud Proxy Fallback
 // ---------------------------------------------------------------------------
 
-describe("AnthropicProvider — Managed Proxy Fallback", () => {
+describe("AnthropicProvider — Cloud Proxy Fallback", () => {
   beforeEach(() => {
     lastStreamParams = null;
     _lastStreamOptions = null;

package/src/__tests__/available-skills.test.ts

@@ -6,12 +6,13 @@
  */
 import { beforeEach, describe, expect, mock, test } from "bun:test";
 
+import { setOverridesForTesting } from "../__tests__/feature-flag-test-helpers.js";
 import type { SkillSummary } from "../config/skills.js";
-import type { SkillInstallMeta } from "../skills/install-meta.js";
 import {
   SKILL_PLATFORM_VALUES,
   skillPlatformForNodePlatform,
-} from "../skills/platform-compatibility.js";
+} from "../skills/cloud-compatibility.js";
+import type { SkillInstallMeta } from "../skills/install-meta.js";
 import { setConfig } from "./helpers/set-config.js";
 
 function makeSummary(overrides: Partial<SkillSummary> = {}): SkillSummary {
@@ -53,12 +54,10 @@ mock.module("../skills/catalog-cache.js", () => ({
   },
 }));
 
-// Deterministic flag resolution: only "on-flag" is enabled.
-mock.module("../config/assistant-feature-flags.js", () => ({
-  isAssistantFeatureFlagEnabled: (flagKey: string) => flagKey === "on-flag",
-}));
-
 beforeEach(() => {
+  // Real flag resolution: only the synthetic "on-flag" key is enabled.
+  setOverridesForTesting({ "on-flag": true });
+
   catalogFixture = [];
   remoteFixture = [];
   remoteError = null;
@@ -170,9 +169,9 @@ describe("listInstalledSkills", () => {
     };
     catalogFixture = [
       makeSummary({
-        id: "managed-skill",
+        id: "cloud-skill",
         source: "managed",
-        directoryPath: "/skills/managed-skill",
+        directoryPath: "/skills/cloud-skill",
       }),
       makeSummary({
         id: "workspace-skill",
@@ -182,21 +181,21 @@ describe("listInstalledSkills", () => {
       makeSummary({ id: "bundled-skill", source: "bundled" }),
       makeSummary({ id: "plugin-skill", source: "plugin" }),
     ];
-    installMetaByDir = { "/skills/managed-skill": meta };
+    installMetaByDir = { "/skills/cloud-skill": meta };
 
     const { listInstalledSkills } =
       await import("../skills/available-skills.js");
     const entries = await listInstalledSkills();
     const byId = new Map(entries.map((e) => [e.id, e]));
 
-    expect(byId.get("managed-skill")!.installMeta).toEqual(meta);
+    expect(byId.get("cloud-skill")!.installMeta).toEqual(meta);
     // Read but absent on disk → null.
     expect(byId.get("workspace-skill")!.installMeta).toBeNull();
     // Never read for sources that don't carry install-meta.
     expect(byId.get("bundled-skill")!.installMeta).toBeUndefined();
     expect(byId.get("plugin-skill")!.installMeta).toBeUndefined();
     expect(readInstallMetaCalls.sort()).toEqual([
-      "/skills/managed-skill",
+      "/skills/cloud-skill",
       "/skills/workspace-skill",
     ]);
   });

package/src/__tests__/avatar-identity-sync.test.ts

@@ -1,7 +1,7 @@
 import { describe, expect, mock, test } from "bun:test";
 
 mock.module("../avatar/sync-avatar.js", () => ({
-  syncAvatarToPlatform: () => {},
+  syncAvatarToCloud: () => {},
 }));
 mock.module("../telemetry/telemetry-events-outbox.js", () => ({
   recordTelemetryEvent: () => ({ id: "evt", createdAt: 0 }),

package/src/__tests__/byok-default-profile-ensure.test.ts

@@ -146,8 +146,8 @@ function expectSecondRunNoop(): void {
 
 beforeEach(() => {
   freshWorkspace();
-  originalIsPlatform = process.env.IS_PLATFORM;
-  delete process.env.IS_PLATFORM;
+  originalIsPlatform = process.env.IS_CLOUD;
+  delete process.env.IS_CLOUD;
 });
 
 afterEach(() => {
@@ -155,9 +155,9 @@ afterEach(() => {
     rmSync(workspaceDir, { recursive: true, force: true });
   }
   if (originalIsPlatform === undefined) {
-    delete process.env.IS_PLATFORM;
+    delete process.env.IS_CLOUD;
   } else {
-    process.env.IS_PLATFORM = originalIsPlatform;
+    process.env.IS_CLOUD = originalIsPlatform;
   }
 });
 
@@ -423,7 +423,7 @@ describe("ensureByokDefaultProfiles", () => {
       string,
       Record<string, unknown>
     >;
-    // Migration 097 / repairAdaptiveThinkingOnManagedProfiles stamp thinking
+    // Migration 097 / repairAdaptiveThinkingOnCloudProfiles stamp thinking
     // onto the anthropic-backed managed entries; live BYOK stubs carry it on
     // balanced and quality-optimized (confirmed on a real workspace).
     profs["balanced"].thinking = { enabled: true, streamThinking: true };
@@ -733,7 +733,7 @@ describe("ensureByokDefaultProfiles", () => {
   });
 
   test("no-op on platform installs", () => {
-    process.env.IS_PLATFORM = "true";
+    process.env.IS_CLOUD = "true";
     writeConfig(uneditedByokConfig());
     const before = readFileSync(configPath(), "utf-8");
 
@@ -953,7 +953,7 @@ describe("ensureByokDefaultProfiles", () => {
     expectSecondRunNoop();
   });
 
-  test("a managed-source default entry with body keys is left alone", () => {
+  test("a cloud-source default entry with body keys is left alone", () => {
     writeConfig({
       llm: {
         default: {

package/src/__tests__/call-domain.test.ts

@@ -55,7 +55,7 @@ useMemorySecureKeys();
  * async setup that runs after the call session and its lease already exist.
  */
 let onResolveCallbackUrl: (() => void) | null = null;
-mock.module("../inbound/platform-callback-registration.js", () => ({
+mock.module("../inbound/cloud-callback-registration.js", () => ({
   resolveCallbackUrl: async (fn: () => string) => {
     onResolveCallbackUrl?.();
     return fn();

package/src/__tests__/call-site-routing-connection-auto-resolve.test.ts

@@ -3,7 +3,7 @@
  * connection-less profiles even when the resolved provider matches the
  * default provider's name.
  *
- * On platform-hosted installs the default transport rides the managed
+ * On cloud-hosted installs the default transport rides the cloud
  * (platform-billed) `cadet` connection while presenting the upstream
  * provider's name (e.g. "anthropic"). A BYOK profile `{provider:
  * "anthropic"}` with no explicit `provider_connection` must route through
@@ -69,7 +69,7 @@ const PERSONAL_CONNECTION = {
 beforeEach(() => {
   connectionRows = [];
   // Same provider name as the default transport; no provider_connection on
-  // the profile — the managed-install shape that must not silently reuse
+  // the profile — the cloud-install shape that must not silently reuse
   // the default transport.
   setConfig("llm", {
     default: {

package/src/__tests__/catalog-files.test.ts

@@ -44,12 +44,12 @@ mock.module("../skills/catalog-install.js", () => ({
   getRepoSkillsDir: () => mockRepoSkillsDir,
 }));
 
-let mockPlatformBaseUrl = "https://platform.test";
+let mockCloudBaseUrl = "https://test-cloud.mycadet.ai";
 mock.module("../config/env.ts", () => ({
-  getPlatformBaseUrl: () => mockPlatformBaseUrl,
+  getCloudBaseUrl: () => mockCloudBaseUrl,
 }));
 mock.module("../config/env.js", () => ({
-  getPlatformBaseUrl: () => mockPlatformBaseUrl,
+  getCloudBaseUrl: () => mockCloudBaseUrl,
 }));
 
 // ---------------------------------------------------------------------------
@@ -152,7 +152,7 @@ beforeEach(() => {
   fetchCalls = [];
   mockCatalog = [];
   mockRepoSkillsDir = undefined;
-  mockPlatformBaseUrl = "https://platform.test";
+  mockCloudBaseUrl = "https://platform.test";
 });
 
 afterEach(() => {
@@ -306,7 +306,7 @@ describe("readCatalogSkillFiles (dev mode)", () => {
 
     const entries = await readCatalogSkillFiles("my-skill");
 
-    // Fall-through should produce the platform response (empty array),
+    // Fall-through should produce the cloud response (empty array),
     // NOT the external directory contents.
     expect(entries).toEqual([]);
 
@@ -321,8 +321,8 @@ describe("readCatalogSkillFiles (dev mode)", () => {
   test("rejects a symlinked skill root for content reads and falls through to platform mode", async () => {
     // Direct reproduction for `readCatalogSkillFileContent`: with a
     // symlinked skill root, the dev branch must not read the external
-    // file. Instead we should fall through to the platform endpoint and
-    // return whatever the platform says.
+    // file. Instead we should fall through to the cloud endpoint and
+    // return whatever the cloud says.
     const root = makeTempSkillsDir();
     const externalRoot = mkdtempSync(join(tmpdir(), "catalog-files-ext-"));
     tempDirs.push(externalRoot);
@@ -345,7 +345,7 @@ describe("readCatalogSkillFiles (dev mode)", () => {
 
     const entry = await readCatalogSkillFileContent("my-skill", "SKILL.md");
     expect(entry).not.toBeNull();
-    // Content must be the platform payload, NOT the external file's
+    // Content must be the cloud payload, NOT the external file's
     // bytes — otherwise the fall-through didn't happen.
     expect(entry!.content).toBe("PLATFORM_CONTENT");
     expect(entry!.mimeType).toBe("text/markdown");
@@ -410,7 +410,7 @@ describe("readCatalogSkillFiles (dev mode)", () => {
 // ---------------------------------------------------------------------------
 
 describe("readCatalogSkillFiles (platform mode)", () => {
-  test("fetches file listing from the platform and maps it", async () => {
+  test("fetches file listing from the cloud and maps it", async () => {
     mockRepoSkillsDir = undefined;
     mockCatalog = [skill("remote-skill")];
     installFetchMock(() =>
@@ -801,7 +801,7 @@ describe("readCatalogSkillFileContent (platform mode)", () => {
   });
 
   test("rejects hidden / SKIP_DIRS paths BEFORE making any fetch call", async () => {
-    // Platform-mode defense in depth: even though the platform endpoint
+    // Platform-mode defense in depth: even though the cloud endpoint
     // would refuse these reads server-side, we must short-circuit in
     // `readCatalogSkillFileContent` so an attacker cannot use the daemon
     // as a probe channel (and so we avoid unnecessary network traffic).

package/src/__tests__/catalog-install-normalize.test.ts

@@ -1,7 +1,7 @@
 /**
  * Regression tests for catalog entry normalization in catalog-install.ts.
  *
- * The platform `/v1/skills/` API flattens skill metadata into top-level
+ * The cloud `/v1/skills/` API flattens skill metadata into top-level
  * fields (`category`, `display_name`, `icon`) rather than the nested
  * `metadata.cadet.*` shape used by the local `catalog.json`. Both
  * `fetchCatalog` (remote) and `readLocalCatalog` (local file) must produce a
@@ -14,7 +14,7 @@ import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { afterEach, describe, expect, test } from "bun:test";
 
-process.env.CADET_PLATFORM_URL = "https://platform.example.com";
+process.env.CADET_CLOUD_URL = "https://platform.example.com";
 
 import { fetchCatalog, readLocalCatalog } from "../skills/catalog-install.js";
 
@@ -40,7 +40,7 @@ function stubFetchJson(payload: unknown): typeof fetch {
 }
 
 describe("fetchCatalog normalization", () => {
-  test("re-nests the platform's flattened category under metadata.cadet", async () => {
+  test("re-nests the cloud's flattened category under metadata.cadet", async () => {
     globalThis.fetch = stubFetchJson({
       skills: [
         {

package/src/__tests__/channel-availability-routes.test.ts

@@ -3,7 +3,7 @@
  *
  * The handler returns a fixed base list (`slack`, `telegram`, `discord`,
  * `phone`) and
- * appends `email` when the platform reports at least one registered email
+ * appends `email` when the cloud reports at least one registered email
  * address for this assistant. Platform failures fall back to base-only.
  *
  * Each entry is hydrated with display metadata from `CHANNEL_METADATA`
@@ -23,7 +23,7 @@ import {
 // Mock state — flipped per-test
 // ---------------------------------------------------------------------------
 
-let mockPlatformAssistantId: string | null = "assistant-test-id";
+let mockCloudAssistantId: string | null = "assistant-test-id";
 let mockEmailAddressesResponse: {
   ok: boolean;
   status: number;
@@ -36,10 +36,10 @@ let mockEmailAddressesResponse: {
 let mockFetchThrows = false;
 const mockSecureKeys = useMemorySecureKeys();
 
-mock.module("../platform/client.js", () => ({
-  CadetPlatformClient: {
+mock.module("../cloud/client.js", () => ({
+  CadetCloudClient: {
     create: async () => ({
-      platformAssistantId: mockPlatformAssistantId,
+      cloudAssistantId: mockCloudAssistantId,
       fetch: async (_path: string) => {
         if (mockFetchThrows) {
           throw new Error("platform unreachable");
@@ -82,7 +82,7 @@ interface HandlerResult {
 
 describe("channels/available", () => {
   beforeEach(() => {
-    mockPlatformAssistantId = "assistant-test-id";
+    mockCloudAssistantId = "assistant-test-id";
     mockEmailAddressesResponse = {
       ok: true,
       status: 200,
@@ -171,8 +171,8 @@ describe("channels/available", () => {
     ]);
   });
 
-  test("base list only when no platformAssistantId on client", async () => {
-    mockPlatformAssistantId = null;
+  test("base list only when no cloudAssistantId on client", async () => {
+    mockCloudAssistantId = null;
 
     const result = (await handler({})) as HandlerResult;
 

package/src/__tests__/channel-readiness-routes.test.ts

@@ -108,7 +108,7 @@ describe("channel readiness routes — email and WhatsApp probes", () => {
       expect(ingressCheck!.passed).toBe(false);
     });
 
-    test("ready when the platform reports a registered inbox", async () => {
+    test("ready when the cloud reports a registered inbox", async () => {
       setConfig("ingress", {
         publicBaseUrl: "https://example.com",
         enabled: true,
@@ -125,7 +125,7 @@ describe("channel readiness routes — email and WhatsApp probes", () => {
     });
 
     test("platform registration decides the check; local config cannot", async () => {
-      // Registration lives on the platform. A stray local `email.address`
+      // Registration lives on the cloud. A stray local `email.address`
       // config value (a key nothing writes) must not make an unregistered
       // inbox pass.
       setConfig("ingress", {
@@ -143,7 +143,7 @@ describe("channel readiness routes — email and WhatsApp probes", () => {
       );
     });
 
-    test("not ready when the platform reports no inbox (remote check)", async () => {
+    test("not ready when the cloud reports no inbox (remote check)", async () => {
       setConfig("ingress", {
         publicBaseUrl: "https://example.com",
         enabled: true,
@@ -186,7 +186,7 @@ describe("channel readiness routes — email and WhatsApp probes", () => {
       expect(snapshot.reasons).toHaveLength(0);
     });
 
-    test("a your-own credential decides even when the platform is unreachable", async () => {
+    test("a your-own credential decides even when the cloud is unreachable", async () => {
       setConfig("ingress", {
         publicBaseUrl: "https://example.com",
         enabled: true,

package/src/__tests__/channel-readiness-service.test.ts

@@ -23,19 +23,19 @@ mock.module("../calls/twilio-rest.js", () => ({
 }));
 
 mock.module("../config/env-registry.js", () => ({
-  getIsPlatform: () => mockGetIsPlatform,
+  getIsCloud: () => mockGetIsPlatform,
 }));
 
 // Spread the real module: replacing it wholesale drops the exports peer test
 // files import from it, which breaks their named-import validation whenever
 // this mock wins evaluation in a combined run.
 const actualRegistration =
-  await import("../inbound/platform-callback-registration.js");
-mock.module("../inbound/platform-callback-registration.js", () => ({
+  await import("../inbound/cloud-callback-registration.js");
+mock.module("../inbound/cloud-callback-registration.js", () => ({
   ...actualRegistration,
-  resolvePlatformCallbackRegistrationContext: async () => ({
+  resolveCloudCallbackRegistrationContext: async () => ({
     isPlatform: mockGetIsPlatform,
-    platformBaseUrl: "https://cloud.mycadet.ai",
+    cloudBaseUrl: "https://cloud.mycadet.ai",
     assistantId: mockPlatformConnected ? "assistant-123" : "",
     hasAssistantApiKey: mockPlatformConnected,
     authHeader: mockPlatformConnected ? "Api-Key secret" : null,
@@ -292,8 +292,8 @@ describe("ChannelReadinessService", () => {
     });
   });
 
-  test("telegram readiness accepts a platform-connected assistant with no ingress", async () => {
-    // LUM-2882: `webhooks register telegram` resolves a platform callback URL
+  test("telegram readiness accepts a cloud-connected assistant with no ingress", async () => {
+    // LUM-2882: `webhooks register telegram` resolves a cloud callback URL
     // in this configuration, so reporting missing ingress here would hide a
     // registration that is really in place (or really broken).
     mockPlatformConnected = true;
@@ -311,7 +311,7 @@ describe("ChannelReadinessService", () => {
     });
   });
 
-  test("phone readiness accepts a platform-connected assistant with no ingress", async () => {
+  test("phone readiness accepts a cloud-connected assistant with no ingress", async () => {
     mockPlatformConnected = true;
     mockHasTwilioCredentials = true;
     setConfig("twilio", { phoneNumber: "+15550123" });
@@ -327,7 +327,7 @@ describe("ChannelReadinessService", () => {
     });
   });
 
-  test("configured ingress beats the platform-connected fallback", async () => {
+  test("configured ingress beats the cloud-connected fallback", async () => {
     // Any logged-in local assistant holds cloud credentials for the LLM
     // proxy. Reporting managed routing here would mislabel a webhook that
     // `webhooks register` resolves to the self-hosted URL.
@@ -347,9 +347,9 @@ describe("ChannelReadinessService", () => {
     });
   });
 
-  test("explicit ingress opt-out blocks the platform-connected fallback", async () => {
+  test("explicit ingress opt-out blocks the cloud-connected fallback", async () => {
     // Switching ingress off is a decision not to accept inbound webhooks, not
-    // an invitation to route them through the platform instead.
+    // an invitation to route them through the cloud instead.
     mockPlatformConnected = true;
     mockSecureKeys[credentialKey("telegram", "bot_token")] = "123:abc";
     mockSecureKeys[credentialKey("telegram", "webhook_secret")] = "secret";
@@ -365,10 +365,10 @@ describe("ChannelReadinessService", () => {
     });
   });
 
-  test("email readiness accepts a platform-connected assistant with no ingress", async () => {
-    // Inbound email arrives through the platform callback route the gateway
+  test("email readiness accepts a cloud-connected assistant with no ingress", async () => {
+    // Inbound email arrives through the cloud callback route the gateway
     // registers (`registerEmailCallbackRoute`, the same pattern as Telegram),
-    // so a platform-connected assistant with no public ingress URL still
+    // so a cloud-connected assistant with no public ingress URL still
     // receives email and must not report missing ingress.
     mockPlatformConnected = true;
 

package/src/__tests__/channel-readiness-telegram-remote.test.ts

@@ -7,7 +7,7 @@
  * indicator went green on a channel nobody could reach.
  *
  * The classification lives in `checkTelegramWebhookHealth`, which already
- * handles error recency and the managed-versus-self-hosted recovery text.
+ * handles error recency and the cloud-versus-self-hosted recovery text.
  * These tests pin how the probe maps its verdicts across three outcomes, not
  * two: verified pass, hard failure, and the no-evidence statuses that are
  * neither. A probe that cannot see the answer must not report a fault, and

package/src/__tests__/chat-reveal-guard-priming.test.ts

@@ -20,6 +20,8 @@
  */
 import { beforeEach, describe, expect, mock, test } from "bun:test";
 
+import { setOverridesForTesting } from "../__tests__/feature-flag-test-helpers.js";
+
 // ── Store mock: reads stay pending until the test releases them ──────────
 // Only reached on the store-fallback path (a ref with no proven value); the
 // proven path redacts the route-served bytes without touching the store.
@@ -34,12 +36,6 @@ mock.module("../security/secure-keys.js", () => ({
     }),
 }));
 
-// Feature flag on regardless of config contents.
-mock.module("../config/assistant-feature-flags.js", () => ({
-  isAssistantFeatureFlagEnabled: (flag: string) =>
-    flag === "chat-credential-reveal",
-}));
-
 mock.module("../config/loader.js", () => ({
   getConfig: () => ({}),
 }));
@@ -172,6 +168,9 @@ const REVEAL_TOOL_RESULT = {
 } as Extract<AgentEvent, { type: "tool_result" }>;
 
 beforeEach(() => {
+  // Real flag resolution: only chat-credential-reveal is enabled.
+  setOverridesForTesting({ "chat-credential-reveal": true });
+
   _resetStreamStateForTesting();
   _resetRevealSuccessRegistryForTest();
   resetForChatMintRegistryForTest();

package/src/__tests__/checker.test.ts

@@ -284,20 +284,20 @@ describe("Permission Checker", () => {
       expect(result.decision).toBe("prompt");
     });
 
-    test("scaffold_managed_skill high risk → prompt", async () => {
+    test("scaffold_cloud_skill high risk → prompt", async () => {
       mockRisk("high");
       const result = await check(
-        "scaffold_managed_skill",
+        "scaffold_cloud_skill",
         { skill_id: "my-skill" },
         "/tmp",
       );
       expect(result.decision).toBe("prompt");
     });
 
-    test("delete_managed_skill high risk → prompt", async () => {
+    test("delete_cloud_skill high risk → prompt", async () => {
       mockRisk("high");
       const result = await check(
-        "delete_managed_skill",
+        "delete_cloud_skill",
         { skill_id: "my-skill" },
         "/tmp",
       );
@@ -531,9 +531,9 @@ describe("Permission Checker", () => {
   // High risk, requiring explicit high-risk approval. Reads remain Low.
 
   describe("skill source mutation risk escalation (PR 29)", () => {
-    // Ensure the managed skills directory exists so that symlink-resolved
+    // Ensure the cloud skills directory exists so that symlink-resolved
     // paths (e.g. /private/var on macOS) match between normalizeFilePath
-    // and getManagedSkillsRoot.
+    // and getCloudSkillsRoot.
     function ensureSkillsDir(): void {
       mkdirSync(join(checkerTestDir, "skills"), { recursive: true });
     }