@mycadet/assistant 0.12.7 → 0.12.9

package/src/config/sync-gated-profiles.ts

@@ -12,6 +12,7 @@ import {
   AUTO_PROFILE_KEY,
   OS_BETA_PROFILE_KEY,
 } from "./default-profile-names.js";
+import { getIsCloud } from "./env-registry.js";
 import {
   getConfigReadOnly,
   invalidateConfigCache,
@@ -34,8 +35,8 @@ interface GatedProfile {
   place: (profileOrder: string[]) => void;
   /**
    * Whether a BYOK install first materializes the stub disabled. True for a
-   * profile whose managed route exists but is unusable until the user enables
-   * the managed connection; false for a managed-only profile, whose stub has
+   * profile whose cloud route exists but is unusable until the user enables
+   * the cloud connection; false for a cloud-only profile, whose stub has
    * no body on a BYOK column and so is never offered there anyway.
    */
   byokStartsDisabled: boolean;
@@ -67,7 +68,7 @@ const GATED_PROFILES: readonly GatedProfile[] = [
 ];
 
 /**
- * Reconcile flag-gated managed profiles against the current feature-flag state.
+ * Reconcile flag-gated cloud profiles against the current feature-flag state.
  *
  * `seedInferenceProfiles()` runs synchronously at boot before feature flags are
  * available, so the gated profiles (OS Beta, Auto) are materialized here once
@@ -97,9 +98,7 @@ export function reconcileFlagGatedProfiles(): boolean {
     : [];
   llm.profileOrder = profileOrder;
 
-  const isPlatform =
-    process.env.IS_PLATFORM === "true" || process.env.IS_PLATFORM === "1";
-  const isByokMode = !isPlatform;
+  const isCloud = getIsCloud();
 
   let changed = false;
   for (const gated of GATED_PROFILES) {
@@ -123,7 +122,7 @@ export function reconcileFlagGatedProfiles(): boolean {
 
     const order = llm.profileOrder as string[];
     const profileChanged = enabled
-      ? enableProfile(gated, profiles, order, previous, isByokMode)
+      ? enableProfile(gated, profiles, order, previous, !isCloud)
       : disableProfile(gated.key, llm, profiles, order, previous);
     if (profileChanged) {
       changed = true;
@@ -154,7 +153,7 @@ function enableProfile(
   // `topP`).
   const next: Record<string, unknown> = { source: "managed" };
 
-  // BYOK installs create the stub disabled: the managed inference connection
+  // BYOK installs create the stub disabled: the cloud inference connection
   // backing this profile isn't usable until the user enables it, so a fresh
   // entry starts disabled to avoid offering an unusable route. The
   // " (Managed)" label suffix disambiguates it from personal profiles in
@@ -251,7 +250,7 @@ function disableProfile(
     typeof llm.advisorProfile === "string" &&
     removed.has(llm.advisorProfile)
   ) {
-    // Repoint the advisor at the managed Quality profile (the strongest).
+    // Repoint the advisor at the cloud Quality profile (the strongest).
     // `quality-optimized` is an always-available code-catalog default, so it
     // resolves whether or not a workspace stub exists.
     llm.advisorProfile = "quality-optimized";

package/src/config/webhook-routing.ts

@@ -14,10 +14,10 @@ import {
   resolveTwilioPublicBaseUrl,
 } from "@mycadet/service-contracts/twilio-ingress";
 
-import { resolvePlatformCallbackRegistrationContext } from "../inbound/platform-callback-registration.js";
+import { resolveCloudCallbackRegistrationContext } from "../inbound/cloud-callback-registration.js";
 import { isPublicIngressDisabled } from "../inbound/public-ingress-urls.js";
 import { isTunnelWebhooksEnabled } from "../inbound/tunnel-webhooks-gate.js";
-import { getIsPlatform } from "./env-registry.js";
+import { getIsCloud } from "./env-registry.js";
 import { getConfig, loadRawConfig } from "./loader.js";
 
 /**
@@ -68,7 +68,7 @@ function isIngressExplicitlyDisabled(): boolean {
  * reports "no ingress" while `webhooks register` hands back a working callback
  * URL hides a broken registration instead of surfacing it.
  *
- *   1. **Platform pods** (`IS_PLATFORM`) with the `tunnel-webhooks` flag off
+ *   1. **Cloud pods** (`IS_CLOUD`) with the `tunnel-webhooks` flag off
  *      always use managed callbacks. With the flag on, a configured ingress
  *      (the Tunnel-published URL) wins, and managed callbacks remain the
  *      fallback — including when ingress is explicitly disabled, matching
@@ -76,17 +76,17 @@ function isIngressExplicitlyDisabled(): boolean {
  *   2. **A configured public ingress wins** for everyone else.
  *   3. **Platform-connected assistants with no ingress** fall back to managed
  *      callbacks. Connectivity is decided by credentials (platform base URL +
- *      assistant ID + assistant API key), not by `IS_PLATFORM`, which is only
- *      ever true on a platform pod.
+ *      assistant ID + assistant API key), not by `IS_CLOUD`, which is only
+ *      ever true on a cloud pod.
  *   4. Otherwise nothing is configured.
  *
- * Ingress deliberately precedes the platform fallback: any logged-in local
+ * Ingress deliberately precedes the cloud fallback: any logged-in local
  * assistant holds cloud credentials for the LLM proxy, so treating
  * credential presence as "managed" would misreport an explicitly configured
  * self-hosted webhook as platform-routed. An explicit `ingress.enabled: false`
  * is a decision not to accept inbound webhooks at all and blocks the fallback.
  *
- * `allowManagedCallbacks` gates both platform tiers: channels that can only be
+ * `allowCloudCallbacks` gates both platform tiers: channels that can only be
  * served by a self-hosted ingress pass `false` and never see them.
  *
  * The gateway's Telegram webhook reconciler implements this same resolution
@@ -98,29 +98,29 @@ function isIngressExplicitlyDisabled(): boolean {
  * registered. Change the tiers in both places or not at all.
  */
 export async function hasWebhookRoutingConfigured(
-  allowManagedCallbacks = false,
+  allowCloudCallbacks = false,
   options: { twilio?: boolean } = {},
 ): Promise<{
   configured: boolean;
-  usesManagedCallbacks: boolean;
+  usesCloudCallbacks: boolean;
 }> {
-  const platformManaged = allowManagedCallbacks && getIsPlatform();
-  if (platformManaged && !isTunnelWebhooksEnabled()) {
-    return { configured: true, usesManagedCallbacks: true };
+  const cloudManaged = allowCloudCallbacks && getIsCloud();
+  if (cloudManaged && !isTunnelWebhooksEnabled()) {
+    return { configured: true, usesCloudCallbacks: true };
   }
 
   if (hasIngressConfigured(options)) {
-    return { configured: true, usesManagedCallbacks: false };
+    return { configured: true, usesCloudCallbacks: false };
   }
 
-  if (platformManaged) {
-    return { configured: true, usesManagedCallbacks: true };
+  if (cloudManaged) {
+    return { configured: true, usesCloudCallbacks: true };
   }
 
-  if (!allowManagedCallbacks || isIngressExplicitlyDisabled()) {
-    return { configured: false, usesManagedCallbacks: false };
+  if (!allowCloudCallbacks || isIngressExplicitlyDisabled()) {
+    return { configured: false, usesCloudCallbacks: false };
   }
 
-  const { enabled } = await resolvePlatformCallbackRegistrationContext();
-  return { configured: enabled, usesManagedCallbacks: enabled };
+  const { enabled } = await resolveCloudCallbackRegistrationContext();
+  return { configured: enabled, usesCloudCallbacks: enabled };
 }

package/src/contacts/contacts-write.ts

@@ -40,7 +40,7 @@ export function upsertContactChannel(params: {
   userFileOnCreate?: string | null;
   /** Refresh the contact display name from the supplied identity even when a
    *  contactId is given. Used by the inbound identity-seed mirror, whose intent
-   *  is to keep the mirror name in sync with the platform profile. Defaults to
+   *  is to keep the mirror name in sync with the cloud profile. Defaults to
    *  false: the invite-binding path preserves the guardian-curated name. */
   refreshDisplayName?: boolean;
   /** Reparent a conflicting existing channel (same (type,address) owned by a

package/src/credential-execution/ces-runtime.ts

@@ -1,6 +1,6 @@
-import { getPlatformAssistantId } from "../config/env.js";
+import { getCloudAssistantId } from "../config/env.js";
 import type { AssistantConfig } from "../config/schema.js";
-import { resolveManagedProxyContext } from "../providers/platform-proxy/context.js";
+import { resolveCloudProxyContext } from "../providers/cloud-proxy/context.js";
 import {
   attemptCesReconnection,
   getCesClient as getSecureKeysCesClient,
@@ -60,7 +60,7 @@ function startCesProcess(config: AssistantConfig): CesStartupResult {
   let currentClient: CesClient | undefined;
   let handshake: CesClientHandshakeOptions = {};
 
-  // Own this process's CES session before resolveManagedProxyContext()
+  // Own this process's CES session before resolveCloudProxyContext()
   // reads the API key. That read must not take the child open path.
   setCesReconnect(async () => {
     const client = await reconnectCesRpcSession(pm, handshake);
@@ -78,11 +78,11 @@ function startCesProcess(config: AssistantConfig): CesStartupResult {
       // the env var, so we pass it via the handshake. Reconnect ownership
       // is already claimed, so this read uses HTTP or the encrypted store,
       // not a second RPC session.
-      const proxyCtx = await resolveManagedProxyContext();
+      const proxyCtx = await resolveCloudProxyContext();
       if (abortController.signal.aborted) {
         return undefined;
       }
-      const assistantId = getPlatformAssistantId();
+      const assistantId = getCloudAssistantId();
       handshake = {
         ...(proxyCtx.assistantApiKey
           ? { assistantApiKey: proxyCtx.assistantApiKey }
@@ -194,7 +194,7 @@ export async function startCes(config: AssistantConfig): Promise<void> {
 
   // Reconnect ownership is claimed inside startCesProcess before the
   // identity read. Snapshotting the API key there (not here) avoids a
-  // second resolveManagedProxyContext() after setCesClient, which would
+  // second resolveCloudProxyContext() after setCesClient, which would
   // read the key through CES while reconnecting.
   if (cesResult.processManager) {
     const pm = cesResult.processManager;

package/src/credential-execution/{managed-catalog.ts → cloud-catalog.ts}

@@ -1,7 +1,7 @@
 /**
  * Managed CES credential catalog.
  *
- * Discovers platform-managed OAuth connections by calling the platform's CES
+ * Discovers cloud OAuth connections by calling the cloud's CES
  * catalog endpoint. Returns displayable descriptors with exact
  * `platform_oauth:<connection_id>` handles suitable for CES tools.
  *
@@ -11,29 +11,29 @@
 
 import { platformOAuthHandle } from "@mycadet/service-contracts/credential-rpc";
 
-import { CadetPlatformClient } from "../platform/client.js";
+import { CadetCloudClient } from "../cloud/client.js";
 import { getLogger } from "../util/logger.js";
 
-const log = getLogger("managed-catalog");
+const log = getLogger("cloud-catalog");
 
 // ---------------------------------------------------------------------------
 // Public types
 // ---------------------------------------------------------------------------
 
-export interface ManagedCredentialDescriptor {
+export interface CloudCredentialDescriptor {
   /** CES handle string (e.g. `platform_oauth:conn_abc123`). */
   handle: string;
   /** Source of the credential — always `"platform"` for managed entries. */
   source: "platform";
-  /** Provider key on the platform (e.g. `google`, `slack`). */
+  /** Provider key on the cloud (e.g. `google`, `slack`). */
   provider: string;
   /** Platform-assigned connection identifier. */
   connectionId: string;
   /** Human-readable account info (e.g. email), if available. */
   accountInfo: string | null;
-  /** Granted OAuth scopes, if reported by the platform. */
+  /** Granted OAuth scopes, if reported by the cloud. */
   grantedScopes: string[];
-  /** Connection status as reported by the platform (e.g. `active`, `expired`). */
+  /** Connection status as reported by the cloud (e.g. `active`, `expired`). */
   status: string;
 }
 
@@ -42,10 +42,10 @@ export interface ManagedCredentialDescriptor {
 // ---------------------------------------------------------------------------
 
 /**
- * Shape of a single connection entry in the platform catalog response.
+ * Shape of a single connection entry in the cloud catalog response.
  * Only non-secret fields are parsed; token values are never included.
  *
- * Field names match the platform's ManagedConnectionCatalogEntrySerializer:
+ * Field names match the cloud's ManagedConnectionCatalogEntrySerializer:
  *   handle, connection_id, provider, account_label, scopes_granted, status
  */
 interface PlatformCatalogEntry {
@@ -61,14 +61,14 @@ interface PlatformCatalogEntry {
 // Public API
 // ---------------------------------------------------------------------------
 
-export interface FetchManagedCatalogResult {
+export interface FetchCloudCatalogResult {
   ok: boolean;
-  descriptors: ManagedCredentialDescriptor[];
+  descriptors: CloudCredentialDescriptor[];
   error?: string;
 }
 
 // ---------------------------------------------------------------------------
-// Managed connection cache — provides a synchronous view of platform-managed
+// Cloud connection cache — provides a synchronous view of cloud-managed
 // connections for use in the system prompt (which is built synchronously).
 // Refresh is triggered at daemon startup and periodically via setInterval.
 // ---------------------------------------------------------------------------
@@ -81,7 +81,7 @@ export interface CachedManagedConnection {
 let cachedConnections: CachedManagedConnection[] = [];
 
 /**
- * Return the last successfully fetched managed connections.
+ * Return the last successfully fetched cloud connections.
  * Returns an empty array before the first successful refresh.
  */
 export function getCachedManagedConnections(): CachedManagedConnection[] {
@@ -89,11 +89,11 @@ export function getCachedManagedConnections(): CachedManagedConnection[] {
 }
 
 /**
- * Fetch managed connections from the platform and update the in-memory cache.
+ * Fetch cloud connections from the cloud and update the in-memory cache.
  * Best-effort: errors are logged and the cache retains its previous value.
  */
 export async function refreshManagedConnectionCache(): Promise<void> {
-  const result = await fetchManagedCatalog();
+  const result = await fetchCloudCatalog();
   if (result.ok) {
     cachedConnections = result.descriptors
       .filter((d) => d.status === "active" || d.status === "ACTIVE")
@@ -105,23 +105,23 @@ export async function refreshManagedConnectionCache(): Promise<void> {
 }
 
 /**
- * Fetch the managed credential catalog from the platform.
+ * Fetch the cloud credential catalog from the cloud.
  *
- * Requires managed proxy prerequisites (platform base URL + assistant API key).
+ * Requires cloud proxy prerequisites (platform base URL + assistant API key).
  * Returns an empty list with `ok: true` when prerequisites are missing —
  * callers should not treat a missing platform as an error.
  *
- * Errors from the platform are captured and returned as `ok: false` with an
+ * Errors from the cloud are captured and returned as `ok: false` with an
  * error message that never contains secret material.
  */
-export async function fetchManagedCatalog(): Promise<FetchManagedCatalogResult> {
-  const client = await CadetPlatformClient.create();
+export async function fetchCloudCatalog(): Promise<FetchCloudCatalogResult> {
+  const client = await CadetCloudClient.create();
 
-  if (!client || !client.platformAssistantId) {
+  if (!client || !client.cloudAssistantId) {
     return { ok: true, descriptors: [] };
   }
 
-  const path = `/v1/assistants/${encodeURIComponent(client.platformAssistantId)}/oauth/managed/catalog/`;
+  const path = `/v1/assistants/${encodeURIComponent(client.cloudAssistantId)}/oauth/managed/catalog/`;
 
   try {
     const response = await client.fetch(path, {
@@ -143,7 +143,7 @@ export async function fetchManagedCatalog(): Promise<FetchManagedCatalogResult>
       };
     }
 
-    // The platform returns a flat JSON array of catalog entries
+    // The cloud returns a flat JSON array of catalog entries
     // (serialized with many=True), not a wrapper object.
     const body = (await response.json()) as PlatformCatalogEntry[];
 
@@ -155,7 +155,7 @@ export async function fetchManagedCatalog(): Promise<FetchManagedCatalogResult>
       };
     }
 
-    const descriptors: ManagedCredentialDescriptor[] = body.map((entry) => ({
+    const descriptors: CloudCredentialDescriptor[] = body.map((entry) => ({
       handle: platformOAuthHandle(entry.connection_id),
       source: "platform" as const,
       provider: entry.provider,

package/src/credential-execution/prompted-credential.ts

@@ -18,10 +18,7 @@ import {
   assertAcpCredentialFormat,
 } from "../acp/acp-credentials.js";
 import { getConfig } from "../config/loader.js";
-import {
-  isNonSecretPlatformField,
-  scrubStoredCredentialFromTranscripts,
-} from "../daemon/credential-transcript-scrub.js";
+import { scrubStoredCredentialFromTranscripts } from "../daemon/credential-transcript-scrub.js";
 import {
   setSlackChannelConfig,
   type SlackChannelConfigResult,
@@ -204,25 +201,7 @@ export async function persistPromptedCredential(args: {
     }
   }
 
-  // The prompt UI never puts the value in the transcript, but the flow is
-  // routinely used to RE-collect a secret the user already pasted into chat
-  // (the 06-credential-security rail promises that pasted message is
-  // scrubbed after storage). Run the scrub right after the store succeeds,
-  // best-effort and invisible to the caller, mirroring credentials_set.
-  if (!isNonSecretPlatformField(service, field)) {
-    try {
-      const scrubbed = await scrubStoredCredentialFromTranscripts(value);
-      log.info(
-        { service, field, ...scrubbed },
-        "Prompted credential stored; scrubbed value from recent transcripts",
-      );
-    } catch (err) {
-      log.warn(
-        { service, field, err },
-        "Prompted credential stored, but transcript scrub failed",
-      );
-    }
-  }
+  await scrubStoredCredentialFromTranscripts(value, { service, field });
 
   try {
     upsertCredentialMetadata(service, field, {