@mycadet/assistant 0.12.7 → 0.12.9

package/src/config/__tests__/webhook-routing.test.ts

@@ -14,14 +14,14 @@ import { beforeEach, describe, expect, mock, test } from "bun:test";
 let isPlatform = false;
 let tunnelWebhooksEnabled = false;
 let rawConfig: Record<string, unknown> = {};
-let platformContextEnabled = false;
+let cloudContextEnabled = false;
 
 // Spread the real modules: these are broad barrels and replacing them wholesale
 // breaks unrelated importers pulled in by the module under test.
 const actualEnvRegistry = await import("../env-registry.js");
 mock.module("../env-registry.js", () => ({
   ...actualEnvRegistry,
-  getIsPlatform: () => isPlatform,
+  getIsCloud: () => isPlatform,
 }));
 
 const actualLoader = await import("../loader.js");
@@ -38,16 +38,16 @@ mock.module("../../inbound/tunnel-webhooks-gate.js", () => ({
 }));
 
 const actualRegistration =
-  await import("../../inbound/platform-callback-registration.js");
-mock.module("../../inbound/platform-callback-registration.js", () => ({
+  await import("../../inbound/cloud-callback-registration.js");
+mock.module("../../inbound/cloud-callback-registration.js", () => ({
   ...actualRegistration,
-  resolvePlatformCallbackRegistrationContext: async () => ({
+  resolveCloudCallbackRegistrationContext: async () => ({
     isPlatform,
-    platformBaseUrl: "https://cloud.mycadet.ai",
-    assistantId: platformContextEnabled ? "assistant-123" : "",
-    hasAssistantApiKey: platformContextEnabled,
-    authHeader: platformContextEnabled ? "Api-Key secret" : null,
-    enabled: platformContextEnabled,
+    cloudBaseUrl: "https://cloud.mycadet.ai",
+    assistantId: cloudContextEnabled ? "assistant-123" : "",
+    hasAssistantApiKey: cloudContextEnabled,
+    authHeader: cloudContextEnabled ? "Api-Key secret" : null,
+    enabled: cloudContextEnabled,
   }),
 }));
 
@@ -59,30 +59,30 @@ describe("hasWebhookRoutingConfigured resolution order", () => {
     isPlatform = false;
     tunnelWebhooksEnabled = false;
     rawConfig = {};
-    platformContextEnabled = false;
+    cloudContextEnabled = false;
   });
 
-  // ── Tier 1: platform pods ────────────────────────────────────────────────
+  // ── Tier 1: cloud pods ────────────────────────────────────────────────
 
-  test("platform pods use managed callbacks", async () => {
+  test("cloud pods use managed callbacks", async () => {
     isPlatform = true;
 
     expect(await hasWebhookRoutingConfigured(true)).toEqual({
       configured: true,
-      usesManagedCallbacks: true,
+      usesCloudCallbacks: true,
     });
   });
 
-  test("platform pods report managed even with an ingress URL configured", async () => {
+  test("cloud pods report managed even with an ingress URL configured", async () => {
     isPlatform = true;
     rawConfig = { ingress: { publicBaseUrl: "https://tunnel.example.com" } };
 
-    // `handleWebhooksRegister` registers with the platform gateway before it
+    // `handleWebhooksRegister` registers with the cloud gateway before it
     // ever reads the ingress config on a pod, so reporting the ingress URL
     // here would name a URL no webhook is actually registered against.
     expect(await hasWebhookRoutingConfigured(true)).toEqual({
       configured: true,
-      usesManagedCallbacks: true,
+      usesCloudCallbacks: true,
     });
   });
 
@@ -93,7 +93,7 @@ describe("hasWebhookRoutingConfigured resolution order", () => {
 
     expect(await hasWebhookRoutingConfigured(true)).toEqual({
       configured: true,
-      usesManagedCallbacks: false,
+      usesCloudCallbacks: false,
     });
   });
 
@@ -103,7 +103,7 @@ describe("hasWebhookRoutingConfigured resolution order", () => {
 
     expect(await hasWebhookRoutingConfigured(true)).toEqual({
       configured: true,
-      usesManagedCallbacks: true,
+      usesCloudCallbacks: true,
     });
   });
 
@@ -116,88 +116,88 @@ describe("hasWebhookRoutingConfigured resolution order", () => {
     // must not lose webhooks entirely.
     expect(await hasWebhookRoutingConfigured(true)).toEqual({
       configured: true,
-      usesManagedCallbacks: true,
+      usesCloudCallbacks: true,
     });
   });
 
   // ── Tier 2: a configured ingress wins ────────────────────────────────────
 
-  test("ingress beats the platform-connected fallback", async () => {
-    platformContextEnabled = true;
+  test("ingress beats the cloud-connected fallback", async () => {
+    cloudContextEnabled = true;
     rawConfig = { ingress: { publicBaseUrl: "https://tunnel.example.com" } };
 
     // Any logged-in local assistant holds platform credentials for the LLM
     // proxy, so credential presence must not reroute an explicitly configured
-    // self-hosted webhook through the platform.
+    // self-hosted webhook through the cloud.
     expect(await hasWebhookRoutingConfigured(true)).toEqual({
       configured: true,
-      usesManagedCallbacks: false,
+      usesCloudCallbacks: false,
     });
   });
 
   test("the twilio option resolves ingress before the fallback too", async () => {
-    platformContextEnabled = true;
+    cloudContextEnabled = true;
     rawConfig = { ingress: { publicBaseUrl: "https://twilio.example.com" } };
 
     expect(await hasWebhookRoutingConfigured(true, { twilio: true })).toEqual({
       configured: true,
-      usesManagedCallbacks: false,
+      usesCloudCallbacks: false,
     });
   });
 
   test("the twilio option falls back to managed callbacks with no ingress", async () => {
-    platformContextEnabled = true;
+    cloudContextEnabled = true;
 
     expect(await hasWebhookRoutingConfigured(true, { twilio: true })).toEqual({
       configured: true,
-      usesManagedCallbacks: true,
+      usesCloudCallbacks: true,
     });
   });
 
   // ── Tier 3: platform-connected fallback ──────────────────────────────────
 
-  test("a platform-connected assistant with no ingress uses managed callbacks", async () => {
-    platformContextEnabled = true;
+  test("a cloud-connected assistant with no ingress uses managed callbacks", async () => {
+    cloudContextEnabled = true;
 
-    // The LUM-2882 case: `webhooks register` hands back a platform callback
+    // The LUM-2882 case: `webhooks register` hands back a cloud callback
     // URL here, so the status surfaces must not report missing ingress.
     expect(await hasWebhookRoutingConfigured(true)).toEqual({
       configured: true,
-      usesManagedCallbacks: true,
+      usesCloudCallbacks: true,
     });
   });
 
   test("the fallback applies when the ingress URL is present but empty", async () => {
-    platformContextEnabled = true;
+    cloudContextEnabled = true;
     rawConfig = { ingress: { publicBaseUrl: "" } };
 
     expect(await hasWebhookRoutingConfigured(true)).toEqual({
       configured: true,
-      usesManagedCallbacks: true,
+      usesCloudCallbacks: true,
     });
   });
 
   test("an explicit ingress.enabled false blocks the fallback", async () => {
-    platformContextEnabled = true;
+    cloudContextEnabled = true;
     rawConfig = { ingress: { enabled: false } };
 
     // Opting out is a decision not to accept inbound webhooks at all, not an
-    // invitation to route them through the platform instead.
+    // invitation to route them through the cloud instead.
     expect(await hasWebhookRoutingConfigured(true)).toEqual({
       configured: false,
-      usesManagedCallbacks: false,
+      usesCloudCallbacks: false,
     });
   });
 
   test("ingress.enabled false blocks the fallback even with a URL configured", async () => {
-    platformContextEnabled = true;
+    cloudContextEnabled = true;
     rawConfig = {
       ingress: { enabled: false, publicBaseUrl: "https://tunnel.example.com" },
     };
 
     expect(await hasWebhookRoutingConfigured(true)).toEqual({
       configured: false,
-      usesManagedCallbacks: false,
+      usesCloudCallbacks: false,
     });
   });
 
@@ -206,38 +206,38 @@ describe("hasWebhookRoutingConfigured resolution order", () => {
   test("no ingress and no platform connectivity is not configured", async () => {
     expect(await hasWebhookRoutingConfigured(true)).toEqual({
       configured: false,
-      usesManagedCallbacks: false,
+      usesCloudCallbacks: false,
     });
   });
 
-  // ── allowManagedCallbacks gating ─────────────────────────────────────────
+  // ── allowCloudCallbacks gating ─────────────────────────────────────────
 
-  test("allowManagedCallbacks false hides the platform-connected fallback", async () => {
-    platformContextEnabled = true;
+  test("allowCloudCallbacks false hides the cloud-connected fallback", async () => {
+    cloudContextEnabled = true;
 
     // Channels that can only be served by a self-hosted ingress pass `false`
-    // and must never be told a managed route stands in for one.
+    // and must never be told a cloud route stands in for one.
     expect(await hasWebhookRoutingConfigured(false)).toEqual({
       configured: false,
-      usesManagedCallbacks: false,
+      usesCloudCallbacks: false,
     });
   });
 
-  test("allowManagedCallbacks false hides the platform-pod tier", async () => {
+  test("allowCloudCallbacks false hides the cloud-pod tier", async () => {
     isPlatform = true;
 
     expect(await hasWebhookRoutingConfigured(false)).toEqual({
       configured: false,
-      usesManagedCallbacks: false,
+      usesCloudCallbacks: false,
     });
   });
 
-  test("allowManagedCallbacks false still honors a configured ingress", async () => {
+  test("allowCloudCallbacks false still honors a configured ingress", async () => {
     rawConfig = { ingress: { publicBaseUrl: "https://tunnel.example.com" } };
 
     expect(await hasWebhookRoutingConfigured(false)).toEqual({
       configured: true,
-      usesManagedCallbacks: false,
+      usesCloudCallbacks: false,
     });
   });
 });
@@ -246,11 +246,11 @@ describe("hasIngressConfigured", () => {
   beforeEach(() => {
     isPlatform = false;
     rawConfig = {};
-    platformContextEnabled = false;
+    cloudContextEnabled = false;
   });
 
   test("is unaffected by platform connectivity", () => {
-    platformContextEnabled = true;
+    cloudContextEnabled = true;
 
     expect(hasIngressConfigured()).toBe(false);
   });

package/src/config/bundled-skills/computer-use/TOOLS.json

@@ -30,7 +30,7 @@
           "target": {
             "type": "string",
             "enum": ["connected-computer", "assistant-desktop"],
-            "description": "Desktop to control. Platform-hosted web conversations default to assistant-desktop; native desktop apps and non-platform assistants default to connected-computer. Explicit target or target_client_id overrides the default. Use assistant-desktop from a native app only when explicitly requested; do not combine it with target_client_id."
+            "description": "Desktop to control. Platform-hosted web conversations default to assistant-desktop; native desktop apps and non-cloud assistants default to connected-computer. Explicit target or target_client_id overrides the default. Use assistant-desktop from a native app only when explicitly requested; do not combine it with target_client_id."
           }
         },
         "required": []
@@ -74,7 +74,7 @@
           "target": {
             "type": "string",
             "enum": ["connected-computer", "assistant-desktop"],
-            "description": "Desktop to control. Platform-hosted web conversations default to assistant-desktop; native desktop apps and non-platform assistants default to connected-computer. Explicit target or target_client_id overrides the default. Use assistant-desktop from a native app only when explicitly requested; do not combine it with target_client_id."
+            "description": "Desktop to control. Platform-hosted web conversations default to assistant-desktop; native desktop apps and non-cloud assistants default to connected-computer. Explicit target or target_client_id overrides the default. Use assistant-desktop from a native app only when explicitly requested; do not combine it with target_client_id."
           },
           "observation_id": {
             "type": "string",
@@ -109,7 +109,7 @@
           "target": {
             "type": "string",
             "enum": ["connected-computer", "assistant-desktop"],
-            "description": "Desktop to control. Platform-hosted web conversations default to assistant-desktop; native desktop apps and non-platform assistants default to connected-computer. Explicit target or target_client_id overrides the default. Use assistant-desktop from a native app only when explicitly requested; do not combine it with target_client_id."
+            "description": "Desktop to control. Platform-hosted web conversations default to assistant-desktop; native desktop apps and non-cloud assistants default to connected-computer. Explicit target or target_client_id overrides the default. Use assistant-desktop from a native app only when explicitly requested; do not combine it with target_client_id."
           },
           "observation_id": {
             "type": "string",
@@ -144,7 +144,7 @@
           "target": {
             "type": "string",
             "enum": ["connected-computer", "assistant-desktop"],
-            "description": "Desktop to control. Platform-hosted web conversations default to assistant-desktop; native desktop apps and non-platform assistants default to connected-computer. Explicit target or target_client_id overrides the default. Use assistant-desktop from a native app only when explicitly requested; do not combine it with target_client_id."
+            "description": "Desktop to control. Platform-hosted web conversations default to assistant-desktop; native desktop apps and non-cloud assistants default to connected-computer. Explicit target or target_client_id overrides the default. Use assistant-desktop from a native app only when explicitly requested; do not combine it with target_client_id."
           },
           "observation_id": {
             "type": "string",
@@ -196,7 +196,7 @@
           "target": {
             "type": "string",
             "enum": ["connected-computer", "assistant-desktop"],
-            "description": "Desktop to control. Platform-hosted web conversations default to assistant-desktop; native desktop apps and non-platform assistants default to connected-computer. Explicit target or target_client_id overrides the default. Use assistant-desktop from a native app only when explicitly requested; do not combine it with target_client_id."
+            "description": "Desktop to control. Platform-hosted web conversations default to assistant-desktop; native desktop apps and non-cloud assistants default to connected-computer. Explicit target or target_client_id overrides the default. Use assistant-desktop from a native app only when explicitly requested; do not combine it with target_client_id."
           },
           "observation_id": {
             "type": "string",
@@ -251,7 +251,7 @@
           "target": {
             "type": "string",
             "enum": ["connected-computer", "assistant-desktop"],
-            "description": "Desktop to control. Platform-hosted web conversations default to assistant-desktop; native desktop apps and non-platform assistants default to connected-computer. Explicit target or target_client_id overrides the default. Use assistant-desktop from a native app only when explicitly requested; do not combine it with target_client_id."
+            "description": "Desktop to control. Platform-hosted web conversations default to assistant-desktop; native desktop apps and non-cloud assistants default to connected-computer. Explicit target or target_client_id overrides the default. Use assistant-desktop from a native app only when explicitly requested; do not combine it with target_client_id."
           },
           "observation_id": {
             "type": "string",
@@ -287,7 +287,7 @@
           "target": {
             "type": "string",
             "enum": ["connected-computer", "assistant-desktop"],
-            "description": "Desktop to control. Platform-hosted web conversations default to assistant-desktop; native desktop apps and non-platform assistants default to connected-computer. Explicit target or target_client_id overrides the default. Use assistant-desktop from a native app only when explicitly requested; do not combine it with target_client_id."
+            "description": "Desktop to control. Platform-hosted web conversations default to assistant-desktop; native desktop apps and non-cloud assistants default to connected-computer. Explicit target or target_client_id overrides the default. Use assistant-desktop from a native app only when explicitly requested; do not combine it with target_client_id."
           },
           "observation_id": {
             "type": "string",
@@ -322,7 +322,7 @@
           "target": {
             "type": "string",
             "enum": ["connected-computer", "assistant-desktop"],
-            "description": "Desktop to control. Platform-hosted web conversations default to assistant-desktop; native desktop apps and non-platform assistants default to connected-computer. Explicit target or target_client_id overrides the default. Use assistant-desktop from a native app only when explicitly requested; do not combine it with target_client_id."
+            "description": "Desktop to control. Platform-hosted web conversations default to assistant-desktop; native desktop apps and non-cloud assistants default to connected-computer. Explicit target or target_client_id overrides the default. Use assistant-desktop from a native app only when explicitly requested; do not combine it with target_client_id."
           }
         },
         "required": ["app_name", "reasoning"]
@@ -354,7 +354,7 @@
           "target": {
             "type": "string",
             "enum": ["connected-computer", "assistant-desktop"],
-            "description": "Desktop to control. Platform-hosted web conversations default to assistant-desktop; native desktop apps and non-platform assistants default to connected-computer. Explicit target or target_client_id overrides the default. Use assistant-desktop from a native app only when explicitly requested; do not combine it with target_client_id."
+            "description": "Desktop to control. Platform-hosted web conversations default to assistant-desktop; native desktop apps and non-cloud assistants default to connected-computer. Explicit target or target_client_id overrides the default. Use assistant-desktop from a native app only when explicitly requested; do not combine it with target_client_id."
           }
         },
         "required": ["script", "reasoning"]
@@ -450,7 +450,7 @@
           "target": {
             "type": "string",
             "enum": ["connected-computer", "assistant-desktop"],
-            "description": "Desktop to control. Platform-hosted web conversations default to assistant-desktop; native desktop apps and non-platform assistants default to connected-computer. Explicit target or target_client_id overrides the default. Use assistant-desktop from a native app only when explicitly requested; do not combine it with target_client_id."
+            "description": "Desktop to control. Platform-hosted web conversations default to assistant-desktop; native desktop apps and non-cloud assistants default to connected-computer. Explicit target or target_client_id overrides the default. Use assistant-desktop from a native app only when explicitly requested; do not combine it with target_client_id."
           },
           "observation_id": {
             "type": "string",
@@ -478,7 +478,7 @@
           "target": {
             "type": "string",
             "enum": ["connected-computer", "assistant-desktop"],
-            "description": "Desktop to control. Platform-hosted web conversations default to assistant-desktop; native desktop apps and non-platform assistants default to connected-computer. Explicit target or target_client_id overrides the default. Use assistant-desktop from a native app only when explicitly requested; do not combine it with target_client_id."
+            "description": "Desktop to control. Platform-hosted web conversations default to assistant-desktop; native desktop apps and non-cloud assistants default to connected-computer. Explicit target or target_client_id overrides the default. Use assistant-desktop from a native app only when explicitly requested; do not combine it with target_client_id."
           }
         },
         "required": ["summary"]
@@ -505,7 +505,7 @@
           "target": {
             "type": "string",
             "enum": ["connected-computer", "assistant-desktop"],
-            "description": "Desktop to control. Platform-hosted web conversations default to assistant-desktop; native desktop apps and non-platform assistants default to connected-computer. Explicit target or target_client_id overrides the default. Use assistant-desktop from a native app only when explicitly requested; do not combine it with target_client_id."
+            "description": "Desktop to control. Platform-hosted web conversations default to assistant-desktop; native desktop apps and non-cloud assistants default to connected-computer. Explicit target or target_client_id overrides the default. Use assistant-desktop from a native app only when explicitly requested; do not combine it with target_client_id."
           }
         },
         "required": ["answer", "reasoning"]

package/src/config/bundled-skills/messaging/SKILL.md

@@ -30,7 +30,7 @@ Do not offer the assistant's own email as an option unless the user specifically
 
 Reading, searching, or summarizing the user's inbox is a **messaging task** — use the messaging tools (or the Gmail connection flow below if nothing is connected). Never run `assistant channels` commands for a mailbox request: channels are the assistant's own inbound delivery routes, not the user's mailbox, and inspecting them sends you down the wrong path.
 
-When a platform is connected (auth test succeeds), always use the messaging API tools for that platform. Never fall back to browser automation, shell commands (bash, curl), or any other approach for operations that messaging tools can handle. The messaging tools handle authentication internally - never try to access tokens or call APIs directly. Browser automation is only appropriate for initial credential setup (OAuth consent screens), not for day-to-day messaging operations.
+When a cloud is connected (auth test succeeds), always use the messaging API tools for that platform. Never fall back to browser automation, shell commands (bash, curl), or any other approach for operations that messaging tools can handle. The messaging tools handle authentication internally - never try to access tokens or call APIs directly. Browser automation is only appropriate for initial credential setup (OAuth consent screens), not for day-to-day messaging operations.
 
 On Gmail and Outlook, `messaging_send` creates a real mailbox draft for review. It does not send. Recipients are optional on Outlook: if the user has not named a To address, still create the draft (use a non-email `conversation_id` such as `drafts`) and tell them only after the tool returns a draft ID. If draft creation fails or is interrupted, say so and offer the email copy in chat. Do not claim a draft exists until the tool succeeds.
 
@@ -38,11 +38,11 @@ On Gmail and Outlook, `messaging_send` creates a real mailbox draft for review.
 
 ## Connection Setup
 
-Before using any messaging tool, verify that the platform is connected by calling `messaging_auth_test` with the appropriate `platform` parameter. If the call fails with a token/authorization error, follow the steps below.
+Before using any messaging tool, verify that the cloud is connected by calling `messaging_auth_test` with the appropriate `platform` parameter. If the call fails with a token/authorization error, follow the steps below.
 
 ### Public Ingress (required for Telegram)
 
-Telegram setup requires webhook routing, but it does **not** always require ngrok. Before suggesting public ingress for Telegram, check managed callback availability with `assistant cloud status --json`. If that reports `available: true` with a non-empty `assistantId`, use the platform callback route flow and do not prompt for ngrok; this applies to managed pods and platform-connected local assistants alike, so do not require `isPlatform: true`. Only use the **public-ingress** skill for local assistants that genuinely need a public gateway URL. Slack uses Socket Mode and does not require public ingress. Gmail/Outlook on the desktop app uses a loopback callback and does not require public ingress; the channel path (Path B in the cadet-oauth-integrations skill) handles public ingress internally when needed.
+Telegram setup requires webhook routing, but it does **not** always require ngrok. Before suggesting public ingress for Telegram, check managed callback availability with `assistant cloud status --json`. If that reports `available: true` with a non-empty `assistantId`, use the cloud callback route flow and do not prompt for ngrok; this applies to managed pods and platform-connected local assistants alike, so do not require `isPlatform: true`. Only use the **public-ingress** skill for local assistants that genuinely need a public gateway URL. Slack uses Socket Mode and does not require public ingress. Gmail/Outlook on the desktop app uses a loopback callback and does not require public ingress; the channel path (Path B in the cadet-oauth-integrations skill) handles public ingress internally when needed.
 
 ### Email Connection Flow
 
@@ -55,12 +55,12 @@ When the user asks to "connect my email", "set up email", "manage my email", or
 ### Gmail
 
 1. **Check the connection.** Run `assistant oauth status google`. If a connection exists, the user is ready to go — proceed with their request.
-2. **If no connections are found, render the connect button in one step:** call `ui_show` with `surface_type: "oauth_connect"` and `data.providerKey: "google"`. That surface is always available — do **not** run `assistant channels`, `oauth providers get`, or load `cadet-oauth-integrations` just to display the button, and do **not** fall back to `assistant oauth connect`. Only load `cadet-oauth-integrations` when the managed-vs-your-own-credentials decision genuinely needs handling (e.g. a BYOK setup where the managed connect surface isn't available).
+2. **If no connections are found, render the connect button in one step:** call `ui_show` with `surface_type: "oauth_connect"` and `data.providerKey: "google"`. That surface is always available — do **not** run `assistant channels`, `oauth providers get`, or load `cadet-oauth-integrations` just to display the button, and do **not** fall back to `assistant oauth connect`. Only load `cadet-oauth-integrations` when the cloud-vs-your-own-credentials decision genuinely needs handling (e.g. a BYOK setup where the cloud connect surface isn't available).
 
 ### Outlook
 
 1. **Check the connection.** Run `assistant oauth status outlook`. If a connection exists, the user is ready to go — proceed with their request.
-2. **If no connections are found, render the connect button in one step:** call `ui_show` with `surface_type: "oauth_connect"` and `data.providerKey: "outlook"`. The same rules as Gmail apply — don't probe further or load a setup skill just to show the button; only load `cadet-oauth-integrations` when a managed-vs-your-own-credentials decision genuinely needs handling.
+2. **If no connections are found, render the connect button in one step:** call `ui_show` with `surface_type: "oauth_connect"` and `data.providerKey: "outlook"`. The same rules as Gmail apply — don't probe further or load a setup skill just to show the button; only load `cadet-oauth-integrations` when a cloud-vs-your-own-credentials decision genuinely needs handling.
 
 ### Slack
 
@@ -68,9 +68,9 @@ For Slack setup, load the **slack-app-setup** skill directly. `messaging_send` p
 
 ### Telegram
 
-Telegram uses a bot token (not OAuth). Load the **telegram-setup** skill, which uses a managed platform callback route on platform-connected assistants (managed pods and local assistants alike) and falls back to **public-ingress** for self-hosted setups when needed:
+Telegram uses a bot token (not OAuth). Load the **telegram-setup** skill, which uses a cloud platform callback route on platform-connected assistants (managed pods and local assistants alike) and falls back to **public-ingress** for self-hosted setups when needed:
 
-- First run `assistant cloud status --json`. If it shows managed callback routing is available, tell the user you will use the platform callback route and skip ngrok/public-ingress.
+- First run `assistant cloud status --json`. If it shows managed callback routing is available, tell the user you will use the cloud callback route and skip ngrok/public-ingress.
 - Call `skill_load` with `skill: "telegram-setup"` to load the dependency skill.
 - Tell the user: _"I've loaded a setup guide for Telegram. It will walk you through connecting a Telegram bot to your assistant."_
 
@@ -97,7 +97,7 @@ When a messaging tool fails with a token or authorization error:
 
 ## Platform Selection
 
-- If the user specifies a platform (e.g., "check my Slack"), pass it as the `platform` parameter.
+- If the user specifies a cloud (e.g., "check my Slack"), pass it as the `platform` parameter.
 - If only one platform is connected, it is auto-selected.
 - If multiple platforms are connected and the user doesn't specify, ask which platform they mean - or search across all of them.
 - **Be action-oriented with email.** When the user says "email" and wants to _do_ something (declutter, check, search, send), check what's connected first. If nothing is connected, ask which provider briefly and then go straight into setup - don't present menus, options lists, or explain the setup process. Just do it.

package/src/config/bundled-skills/messaging/TOOLS.json

@@ -94,7 +94,7 @@
     },
     {
       "name": "messaging_search",
-      "description": "Search messages across a platform using its native query syntax.",
+      "description": "Search messages across a cloud using its native query syntax.",
       "category": "messaging",
       "risk": "low",
       "input_schema": {
@@ -110,7 +110,7 @@
           },
           "query": {
             "type": "string",
-            "description": "Search query using the platform's native syntax"
+            "description": "Search query using the cloud's native syntax"
           },
           "max_results": {
             "type": "number",

package/src/config/bundled-skills/messaging/tools/messaging-analyze-style.ts

@@ -114,7 +114,7 @@ export async function run(
     const provider = await resolveProvider(platform);
     const account = input.account as string | undefined;
     const conn = await getProviderConnection(provider, account);
-    // Search for sent messages using the platform's search
+    // Search for sent messages using the cloud's search
     const query =
       queryFilter ?? (provider.id === "gmail" ? "in:sent" : "from:me");
     const searchResult = await provider.search(conn, query, {

package/src/config/bundled-skills/messaging/tools/shared.ts

@@ -131,7 +131,7 @@ export async function resolveProvider(
   }
   if (connected.length === 0) {
     throw new Error(
-      "No messaging platforms are connected. Use messaging_auth_test to check connection status, then set up a platform.",
+      "No messaging platforms are connected. Use messaging_auth_test to check connection status, then set up a cloud.",
     );
   }
 

package/src/config/bundled-skills/phone-calls/references/TROUBLESHOOTING.md

@@ -10,7 +10,7 @@ Run `assistant config set calls.enabled true`.
 
 ## "No public base URL configured"
 
-First check whether this is a managed/platform assistant:
+First check whether this is a cloud/platform assistant:
 
 ```bash
 assistant cloud status --json
@@ -56,7 +56,7 @@ assistant config set ingress.publicBaseUrl "<new-url>"
 
 Or re-run the public-ingress skill to auto-detect and save the new URL.
 
-Do not rotate ngrok to work around a managed Tunnel WebSocket failure. Fix the Tunnel state instead, or restart the assistant/gateway so it re-registers.
+Do not rotate ngrok to work around a cloud Tunnel WebSocket failure. Fix the Tunnel state instead, or restart the assistant/gateway so it re-registers.
 
 ## Tunnel is not registering
 

package/src/config/bundled-skills/settings/TOOLS.json

@@ -3,7 +3,7 @@
   "tools": [
     {
       "name": "voice_config_update",
-      "description": "Update a voice configuration setting. Use tts_provider / stt_provider to switch the active TTS / STT provider. Provider \"cadet\" is Cadet-managed speech (billed to your organization; requires a Cadet Cloud connection via 'assistant cloud connect'); any other provider uses the user's own API key. Valid TTS providers come from the provider catalog (cadet, elevenlabs, fish-audio, deepgram, xai); valid STT providers: cadet, deepgram, google-gemini, openai-whisper, xai. Use stt_model to pick a provider's model family where it has more than one: deepgram and cadet offer nova-3 (the default, and the only family that transcribes audio files or voice messages) and flux (conversational, streaming-only, with model-native turn detection). Do not select flux when the user wants file transcription. Use tts_voice_id to change the voice; it targets whichever TTS provider is currently active. For elevenlabs, pass an ElevenLabs voice ID. For cadet (managed), pass a managed voice model ID: this may be an ElevenLabs voice ID (managed speech serves the same ElevenLabs voices) or a Deepgram Aura model ID (e.g. aura-2-thalia-en); only rate-carded voices synthesize, so prefer models from the managed catalog (assistant route GET tts/managed-voices, also used by the web voice picker). For deepgram, pass a Deepgram Aura model ID. Use fish_audio_reference_id for Fish Audio voice reference. Use stt_language to set the spoken language for speech recognition: one of the 50 base language codes on the verified Deepgram nova-3 monolingual roster (e.g. en, es, hi, ta, zh, ko), or \"multi\" for code-switching mid-sentence across its 10-language roster (English, Spanish, French, German, Hindi, Russian, Portuguese, Japanese, Italian, Dutch; e.g. Hinglish); plain language names like \"tamil\" or \"multilingual\" are accepted and normalized. Accepted values follow the configured STT provider: cadet-managed and deepgram accept the full roster plus \"multi\"; xai accepts only the 10 multilingual-roster codes (en, es, fr, de, hi, ru, pt, ja, it, nl) and rejects \"multi\" and the extended codes (both are verified for Deepgram nova-3 only); google-gemini and openai-whisper auto-detect natively, so the value persists but is ignored while they are active. Deepgram uses the same API key for TTS and STT, whichever model family is selected. Changes persist to services.stt / services.tts config and take effect immediately.",
+      "description": "Update a voice configuration setting. Use tts_provider / stt_provider to switch the active TTS / STT provider. Provider \"cadet\" is Cadet Cloud speech (billed to your organization; requires a Cadet Cloud connection via 'assistant cloud connect'); any other provider uses the user's own API key. Valid TTS providers come from the provider catalog (cadet, elevenlabs, fish-audio, deepgram, xai); valid STT providers: cadet, deepgram, google-gemini, openai-whisper, xai. Use stt_model to pick a provider's model family where it has more than one: deepgram and cadet offer nova-3 (the default, and the only family that transcribes audio files or voice messages) and flux (conversational, streaming-only, with model-native turn detection). Do not select flux when the user wants file transcription. Use tts_voice_id to change the voice; it targets whichever TTS provider is currently active. For elevenlabs, pass an ElevenLabs voice ID. For cadet (managed), pass a cloud voice model ID: this may be an ElevenLabs voice ID (cloud speech serves the same ElevenLabs voices) or a Deepgram Aura model ID (e.g. aura-2-thalia-en); only rate-carded voices synthesize, so prefer models from the cloud catalog (assistant route GET tts/managed-voices, also used by the web voice picker). For deepgram, pass a Deepgram Aura model ID. Use fish_audio_reference_id for Fish Audio voice reference. Use stt_language to set the spoken language for speech recognition: one of the 50 base language codes on the verified Deepgram nova-3 monolingual roster (e.g. en, es, hi, ta, zh, ko), or \"multi\" for code-switching mid-sentence across its 10-language roster (English, Spanish, French, German, Hindi, Russian, Portuguese, Japanese, Italian, Dutch; e.g. Hinglish); plain language names like \"tamil\" or \"multilingual\" are accepted and normalized. Accepted values follow the configured STT provider: cadet-cloud and deepgram accept the full roster plus \"multi\"; xai accepts only the 10 multilingual-roster codes (en, es, fr, de, hi, ru, pt, ja, it, nl) and rejects \"multi\" and the extended codes (both are verified for Deepgram nova-3 only); google-gemini and openai-whisper auto-detect natively, so the value persists but is ignored while they are active. Deepgram uses the same API key for TTS and STT, whichever model family is selected. Changes persist to services.stt / services.tts config and take effect immediately.",
       "category": "system",
       "risk": "low",
       "input_schema": {
@@ -21,10 +21,10 @@
               "tts_provider",
               "tts_voice_id"
             ],
-            "description": "The voice setting to change. tts_provider / stt_provider select the active provider for each service (\"cadet\" = Cadet-managed speech; anything else = the user's own API key). tts_voice_id sets the voice for the currently active TTS provider (ElevenLabs voice ID for elevenlabs; a managed voice model ID for cadet, meaning an ElevenLabs voice ID or a Deepgram Aura model ID like aura-2-thalia-en; a Deepgram Aura model ID for deepgram; voice ID for xai). fish_audio_reference_id sets the Fish Audio voice reference. stt_model selects a provider's model family where it has more than one (deepgram and cadet: nova-3 or flux). stt_language sets the spoken language for speech recognition (cadet-managed/deepgram: the full roster plus \"multi\"; xai: only the 10 multilingual-roster codes, with \"multi\" and the extended codes rejected; google-gemini and openai-whisper auto-detect and ignore it). Deepgram shares one API key across TTS and STT."
+            "description": "The voice setting to change. tts_provider / stt_provider select the active provider for each service (\"cadet\" = Cadet Cloud speech; anything else = the user's own API key). tts_voice_id sets the voice for the currently active TTS provider (ElevenLabs voice ID for elevenlabs; a cloud voice model ID for cadet, meaning an ElevenLabs voice ID or a Deepgram Aura model ID like aura-2-thalia-en; a Deepgram Aura model ID for deepgram; voice ID for xai). fish_audio_reference_id sets the Fish Audio voice reference. stt_model selects a provider's model family where it has more than one (deepgram and cadet: nova-3 or flux). stt_language sets the spoken language for speech recognition (cadet-cloud/deepgram: the full roster plus \"multi\"; xai: only the 10 multilingual-roster codes, with \"multi\" and the extended codes rejected; google-gemini and openai-whisper auto-detect and ignore it). Deepgram shares one API key across TTS and STT."
           },
           "value": {
-            "description": "The new value for the setting. For tts_provider: one of cadet, elevenlabs, fish-audio, deepgram, xai. For stt_provider: one of cadet, deepgram, google-gemini, openai-whisper, xai. For stt_model: nova-3 or flux, applied to whichever STT provider is currently active; flux serves live speech only and cannot transcribe files. For tts_voice_id: a voice ID for the active TTS provider: an alphanumeric ElevenLabs voice ID (elevenlabs), a managed voice model ID which may be an ElevenLabs voice ID or a Deepgram Aura model ID like aura-2-thalia-en (cadet), or a Deepgram Aura model ID (deepgram). For fish_audio_reference_id: a Fish Audio voice reference ID. For stt_language: one of the 50 base codes on the nova-3 monolingual roster (e.g. en, es, hi, ta, zh, ko), or multi (code-switching across its 10-language roster); language names like \"hindi\", \"tamil\", or \"multilingual\" are also accepted and normalized; when the configured STT provider is xai, only the 10 multilingual-roster codes (en, es, fr, de, hi, ru, pt, ja, it, nl) are accepted. For conversation_timeout: seconds (5, 10, 15, 30, or 60). For activation_key: key identifier string."
+            "description": "The new value for the setting. For tts_provider: one of cadet, elevenlabs, fish-audio, deepgram, xai. For stt_provider: one of cadet, deepgram, google-gemini, openai-whisper, xai. For stt_model: nova-3 or flux, applied to whichever STT provider is currently active; flux serves live speech only and cannot transcribe files. For tts_voice_id: a voice ID for the active TTS provider: an alphanumeric ElevenLabs voice ID (elevenlabs), a cloud voice model ID which may be an ElevenLabs voice ID or a Deepgram Aura model ID like aura-2-thalia-en (cadet), or a Deepgram Aura model ID (deepgram). For fish_audio_reference_id: a Fish Audio voice reference ID. For stt_language: one of the 50 base codes on the nova-3 monolingual roster (e.g. en, es, hi, ta, zh, ko), or multi (code-switching across its 10-language roster); language names like \"hindi\", \"tamil\", or \"multilingual\" are also accepted and normalized; when the configured STT provider is xai, only the 10 multilingual-roster codes (en, es, fr, de, hi, ru, pt, ja, it, nl) are accepted. For conversation_timeout: seconds (5, 10, 15, 30, or 60). For activation_key: key identifier string."
           }
         }
       },

package/src/config/bundled-skills/settings/tools/shared.ts

@@ -6,7 +6,7 @@
  * Steer the model back to the inline voice picker.
  *
  * Both settings tools a "change my voice" request can land on (the Voice tab
- * navigation and a managed `tts_voice_id` write) end by naming the picker, so
+ * navigation and a cloud `tts_voice_id` write) end by naming the picker, so
  * the invocation itself lives here: one edit keeps both tools teaching the same
  * call. Each caller supplies its own tail, because the reason the picker is
  * better differs by the tool the model just reached for.

package/src/config/bundled-skills/settings/tools/voice-config-update.ts

@@ -1,11 +1,11 @@
+import { managedSpeechAvailable } from "../../../../cloud/cloud-speech.js";
 import { normalizeActivationKey } from "../../../../daemon/handlers/config-voice.js";
-import { managedSpeechAvailable } from "../../../../platform/managed-speech.js";
 import {
   DEEPGRAM_MULTI_LANGUAGE_CODES,
   DEEPGRAM_NOVA3_MONOLINGUAL_CODES,
 } from "../../../../providers/speech-to-text/deepgram.js";
 import {
-  isManagedSttProvider,
+  isCloudSttProvider,
   listProviderModelFamilies,
 } from "../../../../providers/speech-to-text/provider-catalog.js";
 import type { SttProviderId } from "../../../../stt/types.js";
@@ -202,14 +202,14 @@ const STT_LANGUAGE_ALIASES: Record<
 /**
  * Same steer `navigate_settings_tab` puts on the Voice tab, applied to the
  * strongest competing affordance: this tool's description coaches the model to
- * read the managed catalog and set `tts_voice_id` itself, which is exactly the
+ * read the cloud catalog and set `tts_voice_id` itself, which is exactly the
  * "assistant names voices in prose" outcome the inline picker exists to
  * replace. Managed only, because that is the catalog the picker renders. The
  * write still happens and the result stays non-error; this only redirects the
  * next request.
  */
 const MANAGED_VOICE_PICKER_HINT = voicePickerHint(
-  "which lets them hear and pick from the managed catalog in the conversation. Set the id here only when the user named a specific voice.",
+  "which lets them hear and pick from the cloud catalog in the conversation. Set the id here only when the user named a specific voice.",
 );
 
 function validateSetting(
@@ -354,7 +354,7 @@ function validateSetting(
       }
       // Provider scoping, after alias normalization so "Tamil" and "ta" fail
       // the same way: the extended roster and "multi" are verified for
-      // Deepgram nova-3 (BYOK deepgram and the managed relay) only. Under
+      // Deepgram nova-3 (BYOK deepgram and the cloud relay) only. Under
       // xai, persisting them would mean every web surface withholds the code
       // while the resolver forwards it unverified (or, for "multi", drops it
       // silently), so the write is an honest rejection instead. Auto-detect
@@ -469,23 +469,23 @@ export async function run(
     return { content: `Error: ${validation.error}`, isError: true };
   }
 
-  // Managed speech has more than one STT id, so the gate reads the catalog
-  // rather than a literal: without this, setting a managed provider other
+  // Cloud speech has more than one STT id, so the gate reads the catalog
+  // rather than a literal: without this, setting a cloud provider other
   // than "cadet" on a disconnected assistant persists happily and then
   // resolves no transcriber at all.
-  const wantsManagedSpeech =
+  const wantsCloudSpeech =
     (setting === "stt_provider" &&
-      isManagedSttProvider(validation.coerced as SttProviderId)) ||
+      isCloudSttProvider(validation.coerced as SttProviderId)) ||
     (setting === "tts_provider" && validation.coerced === "cadet");
-  if (wantsManagedSpeech && !(await managedSpeechAvailable())) {
+  if (wantsCloudSpeech && !(await managedSpeechAvailable())) {
     return {
       content:
-        "Error: managed speech requires a Cadet Cloud connection. Run 'assistant cloud connect' first.",
+        "Error: cloud speech requires a Cadet Cloud connection. Run 'assistant cloud connect' first.",
       isError: true,
     };
   }
 
-  // Recheck: the managed-speech reachability probe above is an await, and the
+  // Recheck: the cloud-speech reachability probe above is an await, and the
   // client broadcast and config write below are what the user would notice.
   throwIfCancelled(context);