@mycadet/assistant 0.12.7 → 0.12.9

package/src/daemon/conversation-error.ts

@@ -7,7 +7,7 @@ import type {
   ConversationErrorCode,
   ConversationErrorEvent,
 } from "../api/events/conversation-error.js";
-import { getIsPlatform } from "../config/env-registry.js";
+import { getIsCloud } from "../config/env-registry.js";
 import {
   isImageDimensionsTooLargeError,
   isImageMediaTypeMismatchError,
@@ -54,7 +54,7 @@ export interface ClassifiedConversationError {
    * Name of the resolved profile (`llm.activeProfile` / per-call override)
    * in play when the error occurred. Forwarded to the wire message so
    * banners can name the profile when the connection identifier is
-   * generic (e.g. the canonical managed connection). Optional for the
+   * generic (e.g. the canonical cloud connection). Optional for the
    * same reason as `connectionName`.
    */
   profileName?: string;
@@ -71,11 +71,11 @@ export interface ClassifiedConversationError {
 export interface ConversationErrorAttribution {
   connectionName?: string;
   profileName?: string;
-  /** Whether the resolved turn route uses Cadet-managed inference. */
-  isManagedRoute?: boolean;
+  /** Whether the resolved turn route uses Cadet Cloud inference. */
+  isCloudRoute?: boolean;
   /**
    * Which credential the failed request presented. Splits the non-managed side
-   * of `isManagedRoute` into personal keys, subscription logins, and keyless
+   * of `isCloudRoute` into personal keys, subscription logins, and keyless
    * endpoints so rejection copy names the right thing to fix.
    */
   credentialSource?: ProviderCredentialSource;
@@ -198,10 +198,10 @@ export interface ErrorContext {
    */
   profileName?: string;
   /**
-   * Whether the resolved turn route uses Cadet-managed inference. Turn routing
+   * Whether the resolved turn route uses Cadet Cloud inference. Turn routing
    * takes precedence over the provider registry's boot-time default.
    */
-  isManagedRoute?: boolean;
+  isCloudRoute?: boolean;
 }
 
 /**
@@ -282,11 +282,11 @@ export function classifyConversationError(
     error instanceof ProviderError ? error.routeAttribution : undefined;
   const connectionName = providerRoute?.connectionName ?? ctx.connectionName;
   const profileName = providerRoute?.profileName ?? ctx.profileName;
-  const isManagedRoute = providerRoute?.isManagedRoute ?? ctx.isManagedRoute;
+  const isCloudRoute = providerRoute?.isCloudRoute ?? ctx.isCloudRoute;
   const attribution: ConversationErrorAttribution = {
     ...(connectionName ? { connectionName } : {}),
     ...(profileName ? { profileName } : {}),
-    ...(isManagedRoute !== undefined ? { isManagedRoute } : {}),
+    ...(isCloudRoute !== undefined ? { isCloudRoute } : {}),
     ...(providerRoute?.credentialSource
       ? { credentialSource: providerRoute.credentialSource }
       : {}),
@@ -360,7 +360,7 @@ function connectionResolutionUserMessage(
     case "missing_connection":
       return `No provider connection is configured${usedBy}. Ask me to set one up right here, or add an API key in ${fixPath}.`;
     case "unroutable_managed_model":
-      return `The model "${error.model ?? "<unset>"}"${usedBy} isn't served by the Cadet managed route. Pick a model from the Cadet catalog, or choose a concrete provider in ${fixPath}.`;
+      return `The model "${error.model ?? "<unset>"}"${usedBy} isn't served by the Cadet Cloud route. Pick a model from the Cadet catalog, or choose a concrete provider in ${fixPath}.`;
     case "adapter_unavailable":
       return `${connection}${usedBy} could not serve model "${error.model ?? "<unset>"}". This model is only available on the Cadet GPU route and was not sent through another provider.`;
     case "missing_credential":
@@ -369,10 +369,10 @@ function connectionResolutionUserMessage(
       // doesn't.
       return `${connection}${usedBy} has no stored credential. Add an API key or reconnect it in ${fixPath}.`;
     case "platform_unauthenticated":
-      // A platform-managed assistant cannot log in or switch providers, and
+      // A cloud assistant cannot log in or switch providers, and
       // this classifier only sees the reason code, so one honest wording covers
       // both the transient and the re-provision cases.
-      if (getIsPlatform()) {
+      if (getIsCloud()) {
         return `${connection}${usedBy} is unavailable. If this persists, the cloud credential may need to be re-provisioned on Cadet Cloud.`;
       }
       return `${connection}${usedBy} requires a Cadet Cloud login. Log in, or pick a different provider in ${fixPath}.`;
@@ -396,15 +396,15 @@ function classifyCore(
   message: string,
   attribution: ConversationErrorAttribution = {},
 ): Omit<ClassifiedConversationError, "debugDetails"> {
-  const isManagedRoute =
+  const isCloudRoute =
     error instanceof ProviderError &&
-    (attribution.isManagedRoute ??
-      getProviderRoutingSource(error.provider) === "managed-proxy");
+    (attribution.isCloudRoute ??
+      getProviderRoutingSource(error.provider) === "cloud-proxy");
   // Which credential the request actually presented. Only rejection copy needs
-  // this finer axis; every other branch keys off `isManagedRoute`. Routes that
-  // predate per-request stamping collapse to the managed/personal split.
+  // this finer axis; every other branch keys off `isCloudRoute`. Routes that
+  // predate per-request stamping collapse to the cloud/personal split.
   const credentialSource: ProviderCredentialSource =
-    attribution.credentialSource ?? (isManagedRoute ? "cadet-managed" : "byok");
+    attribution.credentialSource ?? (isCloudRoute ? "cadet-cloud" : "byok");
 
   // Prefer the semantic reason stamped by the provider layer, regardless of
   // HTTP status — statusless errors (e.g. SDK streaming failures) still carry a
@@ -412,7 +412,7 @@ function classifyCore(
   // reason-less error) fall through to the status switch + regex battery below.
   if (error instanceof ProviderError && error.reason) {
     const c = reasonToClassification(error.reason, {
-      isManagedRoute,
+      isCloudRoute,
       credentialSource,
       attribution,
       message,
@@ -446,13 +446,13 @@ function classifyCore(
       );
     }
     if (error.statusCode === 402) {
-      if (isManagedRoute) {
+      if (isCloudRoute) {
         return managedBalanceClassification();
       }
       return providerBillingClassification();
     }
     if (error.statusCode === 429) {
-      if (isManagedUsageLimitError(message, isManagedRoute)) {
+      if (isCloudUsageLimitError(message, isCloudRoute)) {
         return managedUsageLimitClassification();
       }
       return rateLimitClassification();
@@ -592,7 +592,7 @@ function classifyCore(
   }
 
   // Regex fallback for non-ProviderError or ProviderError without statusCode
-  return classifyByMessage(message, isManagedRoute);
+  return classifyByMessage(message, isCloudRoute);
 }
 
 /**
@@ -617,21 +617,21 @@ function extractProviderDetail(message: string): string | undefined {
 
 /**
  * Map a provider-stamped {@link ProviderErrorReason} to a classification,
- * applying the managed-proxy-vs-user-key routing overlay inline. Returns `null`
+ * applying the cloud-proxy-vs-user-key routing overlay inline. Returns `null`
  * for reasons that should defer to the legacy status/regex fallback
  * (`bad_request`, `unknown`).
  */
 function reasonToClassification(
   reason: ProviderErrorReason,
   args: {
-    isManagedRoute: boolean;
+    isCloudRoute: boolean;
     credentialSource: ProviderCredentialSource;
     attribution?: ConversationErrorAttribution;
     message: string;
     providerName: string;
   },
 ): Omit<ClassifiedConversationError, "debugDetails"> | null {
-  const managed = args.isManagedRoute;
+  const managed = args.isCloudRoute;
   switch (reason) {
     case "invalid_credentials":
       return rejectedCredentialClassification(
@@ -653,13 +653,13 @@ function reasonToClassification(
         ? managedBalanceClassification()
         : providerBillingClassification();
     case "daily_limit_reached":
-      // The reason is stamped only from the platform proxy's
+      // The reason is stamped only from the cloud proxy's
       // `"code":"daily_limit_reached"` body, so it is authoritative on its
-      // own — the global routing map can lag per-connection platform-auth
+      // own — the global routing map can lag per-connection cloud-auth
       // routes and must not downgrade this to the generic billing surface.
       return dailyLimitClassification();
     case "free_tier_daily_limit_reached":
-      // Same provenance as `daily_limit_reached`: only the platform proxy's
+      // Same provenance as `daily_limit_reached`: only the cloud proxy's
       // `"code":"free_tier_daily_limit_reached"` body stamps it.
       return freeTierDailyLimitClassification();
     case "overloaded":
@@ -762,12 +762,12 @@ function isStreamingError(message: string): boolean {
   return STREAMING_ERROR_PATTERNS.some((p) => p.test(message));
 }
 
-function isManagedUsageLimitError(
+function isCloudUsageLimitError(
   message: string,
-  isManagedRoute: boolean,
+  isCloudRoute: boolean,
 ): boolean {
   return (
-    isManagedRoute || MANAGED_USAGE_LIMIT_PATTERNS.some((p) => p.test(message))
+    isCloudRoute || MANAGED_USAGE_LIMIT_PATTERNS.some((p) => p.test(message))
   );
 }
 
@@ -858,7 +858,7 @@ function managedUsageLimitClassification(): Omit<
   return {
     code: "MANAGED_USAGE_LIMIT",
     userMessage:
-      "Cadet managed inference is rate limited. This is a Cadet-side usage limit, not an AI provider outage.",
+      "Cadet Cloud inference is rate limited. This is a Cadet-side usage limit, not an AI provider outage.",
     retryable: true,
     errorCategory: "managed_usage_limit",
   };
@@ -866,7 +866,7 @@ function managedUsageLimitClassification(): Omit<
 
 /**
  * Deliberately instruction-free. The assistant API key is provisioned and
- * pushed by the platform — the assistant only ever reads it — so there is no
+ * pushed by the cloud — the assistant only ever reads it — so there is no
  * Settings affordance to re-provision it and no user action that would help.
  * The copy's job is to rule out the user's own provider key as the cause;
  * clients that can offer a real next step attach one (web renders Doctor).
@@ -1019,7 +1019,7 @@ function rejectedCredentialClassification(
   attribution?: ConversationErrorAttribution,
 ): Omit<ClassifiedConversationError, "debugDetails"> {
   switch (credentialSource) {
-    case "cadet-managed":
+    case "cadet-cloud":
       return managedKeyInvalidClassification();
     case "oauth-subscription":
       return subscriptionLoginRejectedClassification(providerName, attribution);
@@ -1120,7 +1120,7 @@ function providerNotConfiguredClassification(
  */
 function classifyByMessage(
   message: string,
-  isManagedRoute: boolean,
+  isCloudRoute: boolean,
 ): Omit<ClassifiedConversationError, "debugDetails"> {
   // Empty-request-messages is always an internal construction failure — check
   // it before the provider/network patterns so a ProviderError that carries the
@@ -1137,7 +1137,7 @@ function classifyByMessage(
   // Check rate limit first (before network, since 429 could match both)
   for (const pattern of RATE_LIMIT_PATTERNS) {
     if (pattern.test(message)) {
-      if (isManagedUsageLimitError(message, isManagedRoute)) {
+      if (isCloudUsageLimitError(message, isCloudRoute)) {
         return managedUsageLimitClassification();
       }
       return rateLimitClassification();

package/src/daemon/conversation-skill-tools.ts

@@ -23,8 +23,8 @@ import type { Message, ToolDefinition } from "../providers/types.js";
 import type { ActiveSkillEntry } from "../skills/active-skill-tools.js";
 import { deriveActiveSkills } from "../skills/active-skill-tools.js";
 import { getCachedCatalogSync } from "../skills/catalog-cache.js";
+import { isSkillCompatibleWithCloud } from "../skills/cloud-compatibility.js";
 import { readInstallMeta, touchSkillLastUsed } from "../skills/install-meta.js";
-import { isSkillCompatibleWithPlatform } from "../skills/platform-compatibility.js";
 import { parseToolManifestFile } from "../skills/tool-manifest.js";
 import { computeSkillVersionHash } from "../skills/version-hash.js";
 import { recordSkillLoadedEvent } from "../telemetry/skill-loaded-events-store.js";
@@ -218,7 +218,7 @@ function recordSkillLoadedTelemetry(
  * track. Only managed skills carry install metadata; bundled, workspace, and
  * plugin skills are skipped. Best-effort: the underlying write never throws.
  */
-function stampManagedSkillUsage(skill: SkillSummary): void {
+function stampCloudSkillUsage(skill: SkillSummary): void {
   if (skill.source !== "managed") {
     return;
   }
@@ -228,7 +228,7 @@ function stampManagedSkillUsage(skill: SkillSummary): void {
   } catch (err) {
     log.warn(
       { err, skillId: skill.id },
-      "Failed to stamp managed-skill lastUsedAt (non-fatal)",
+      "Failed to stamp cloud-skill lastUsedAt (non-fatal)",
     );
   }
 }
@@ -365,7 +365,7 @@ export function projectSkillTools(
     const skill = catalogById.get(id);
     const flagKey = skill ? skillFlagKey(skill) : undefined;
     if (
-      (!skill || isSkillCompatibleWithPlatform(skill)) &&
+      (!skill || isSkillCompatibleWithCloud(skill)) &&
       (!flagKey || isAssistantFeatureFlagEnabled(flagKey, config))
     ) {
       activeIds.add(id);
@@ -440,7 +440,7 @@ export function projectSkillTools(
       successfulEntries.set(skillId, NO_TOOLS_VERSION);
       if (prevHash === undefined) {
         recordSkillLoadedTelemetry(skill, options?.telemetry);
-        stampManagedSkillUsage(skill);
+        stampCloudSkillUsage(skill);
       }
       continue;
     }
@@ -485,7 +485,7 @@ export function projectSkillTools(
         // activation gaining a TOOLS.json re-registers, which — like a
         // version-hash change — counts as a new load.
         recordSkillLoadedTelemetry(skill, options?.telemetry);
-        stampManagedSkillUsage(skill);
+        stampCloudSkillUsage(skill);
       } else if (prevHash !== currentHash) {
         // Hash changed — unregister stale tools, then re-register with new definitions
         log.info(
@@ -506,7 +506,7 @@ export function projectSkillTools(
         }
         // A version change that re-registers counts as a new skill load.
         recordSkillLoadedTelemetry(skill, options?.telemetry);
-        stampManagedSkillUsage(skill);
+        stampCloudSkillUsage(skill);
       } else {
         // Hash unchanged — filter to only tools that are actually registered
         // for this skill. Some tools may have been skipped during initial

package/src/daemon/conversation-surfaces.ts

@@ -3232,7 +3232,7 @@ export async function surfaceProxyResolver(
       if (!canUseVirtualDesktop(desktopContext)) {
         return {
           content:
-            "The assistant desktop requires an identified guardian and an enabled platform-hosted assistant.",
+            "The assistant desktop requires an identified guardian and an enabled cloud-hosted assistant.",
           isError: true,
         };
       }

package/src/daemon/conversation-tool-setup.ts

@@ -12,7 +12,7 @@ import {
   type HostProxyCapability,
   supportsHostProxy,
 } from "../channels/types.js";
-import { getIsPlatform } from "../config/env-registry.js";
+import { getIsCloud } from "../config/env-registry.js";
 import { getConfig } from "../config/loader.js";
 import { isMemoryEnabled } from "../config/memory-v3-gate.js";
 import {
@@ -463,7 +463,7 @@ export function createToolExecutor(
       // offered on a gated cleanup turn is not refused at execution.
       sendUserMessageActive: resolveSendUserMessageActive(ctx),
       toolUseId,
-      isPlatformHosted: getIsPlatform(),
+      isCloudHosted: getIsCloud(),
       ...resolveTurnClientOs(ctx),
       overrideProfile: ctx.currentTurnOverrideProfile,
       cronRunId: ctx.currentTurnCronRunId,

package/src/daemon/conversation-turn-finalize.ts

@@ -342,7 +342,7 @@ export async function runDeferredTurnTail(params: {
   // check necessarily runs with the conversation already free. A follow-up
   // send that beats it there advances the cursor and suppresses the push,
   // which is the right answer: a user typing the next message is looking at
-  // the reply. Not awaited: the pipeline awaits the platform adapter's HTTP
+  // the reply. Not awaited: the pipeline awaits the cloud adapter's HTTP
   // dispatch, which retries with backoff, and nothing below here depends on
   // the emit. The producer never rejects.
   if (turnCompleted && state.lastAssistantMessageId) {

package/src/daemon/conversation-workspace.ts

@@ -17,7 +17,7 @@ export interface WorkspaceConversationContext {
   /**
    * Client-reported host home directory, populated from host-proxy
    * transport metadata (see `supportsHostProxy` / `HostProxyInterfaceId`).
-   * Used to render the `<workspace>` block correctly for platform-managed
+   * Used to render the `<workspace>` block correctly for cloud-managed
    * daemons where `os.homedir()` would return the container's home instead
    * of the user's actual client-side home.
    */

package/src/daemon/conversation.ts

@@ -877,7 +877,7 @@ export class Conversation {
    * `NSHomeDirectory()`). Populated from `HostProxyTransportMetadata` when
    * a message arrives from an interface that supports host-proxy tools
    * (see `supportsHostProxy`). Consumed by the `<workspace>` block renderer
-   * so platform-managed (containerized) daemons show the user's actual
+   * so cloud-managed (containerized) daemons show the user's actual
    * client-side home dir instead of the container's `os.homedir()`.
    * @internal
    */

package/src/daemon/credential-transcript-scrub.ts

@@ -86,55 +86,52 @@ export interface TranscriptScrubResult {
  * Never throws — partial failures are logged (counts only, never content)
  * and reflected in the best-effort result.
  */
+export interface TranscriptScrubContext {
+  service?: string;
+  field?: string;
+  provider?: string;
+}
+
 export async function scrubStoredCredentialFromTranscripts(
   value: string,
+  context: TranscriptScrubContext = {},
 ): Promise<TranscriptScrubResult> {
   const result: TranscriptScrubResult = {
     dbMessagesScrubbed: 0,
     residentMessagesScrubbed: 0,
   };
-  if (value.trim().length < MIN_SCRUB_VALUE_LENGTH) {
-    return result;
-  }
-  const targets = buildSearchTargets(value);
   try {
-    result.dbMessagesScrubbed = sweepDbMessages(targets);
-  } catch (err) {
-    log.warn(
-      { err, valueLength: value.length },
-      "Credential transcript DB sweep failed; continuing with in-memory sweep",
-    );
-  }
-  try {
-    result.residentMessagesScrubbed = sweepResidentConversations(targets);
+    if (value.trim().length < MIN_SCRUB_VALUE_LENGTH) {
+      return result;
+    }
+    const targets = buildSearchTargets(value);
+    try {
+      result.dbMessagesScrubbed = sweepDbMessages(targets);
+    } catch (err) {
+      log.warn(
+        { err, valueLength: value.length },
+        "Credential transcript DB sweep failed; continuing with in-memory sweep",
+      );
+    }
+    try {
+      result.residentMessagesScrubbed = sweepResidentConversations(targets);
+    } catch (err) {
+      log.warn(
+        { err, valueLength: value.length },
+        "Credential transcript in-memory sweep failed",
+      );
+    }
   } catch (err) {
     log.warn(
       { err, valueLength: value.length },
-      "Credential transcript in-memory sweep failed",
+      "Credential transcript scrub failed",
     );
   }
-  return result;
-}
-
-/**
- * The Cadet Cloud identity ids and base URL are stored through the
- * credential routes but are not secrets — they are UUIDs/URLs that
- * legitimately appear in conversation text, so scrubbing them would redact
- * benign transcript content. Both credential write paths
- * (`credentials_set` and the `/v1/secrets` credential branch) consult this
- * one exemption so they cannot drift.
- */
-export function isNonSecretPlatformField(
-  service: string,
-  field: string,
-): boolean {
-  return (
-    service === "cadet" &&
-    (field === "platform_assistant_id" ||
-      field === "platform_organization_id" ||
-      field === "platform_user_id" ||
-      field === "platform_base_url")
+  log.info(
+    { ...context, ...result },
+    "Credential stored; scrubbed value from recent transcripts",
   );
+  return result;
 }
 
 /**

package/src/daemon/daemon-readiness.ts

@@ -78,7 +78,7 @@ export const DB_MIGRATION_FAILED_STATE_EXEMPT_OPERATIONS: ReadonlySet<string> =
     "migrations/import",
     "migrations_import_post",
     // Restore has three transports; all must stay repair-capable. The
-    // preflights are read-only analysis; the GCS import is the managed
+    // preflights are read-only analysis; the GCS import is the cloud
     // platform's restore path and is job-based, so its job-status GET (a
     // parameterized route, matched by prefix in isDbMigrationGateBypassed)
     // must answer too.

package/src/daemon/event-loop-watchdog.ts

@@ -270,7 +270,7 @@ export function evaluateTick(
 }
 
 /**
- * Check name emitted for event-loop block events. The platform's
+ * Check name emitted for event-loop block events. The cloud's
  * `watchdog__event_loop_blocking_daily` admin query filters `check_name` to
  * this exact string, so it is the primary group-by dimension downstream —
  * keep it stable.
@@ -322,7 +322,7 @@ async function reportBlock(
     },
     "event loop blocked",
   );
-  // Persist a `watchdog` telemetry event so the platform can surface
+  // Persist a `watchdog` telemetry event so the cloud can surface
   // event-loop blocking in the infrastructure admin chart. `recordWatchdogEvent`
   // no-ops when usage-data collection is disabled (the event is dropped to
   // honor the opt-out), so the watchdog runs unconditionally without leaking

package/src/daemon/handlers/config-ingress.ts

@@ -11,13 +11,13 @@ import {
 
 import { updatePhoneNumberWebhooks } from "../../calls/twilio-rest.js";
 import {
+  getCloudAssistantId,
+  getCloudBaseUrl,
   getGatewayInternalBaseUrl,
-  getPlatformAssistantId,
-  getPlatformBaseUrl,
 } from "../../config/env.js";
-import { getIsPlatform } from "../../config/env-registry.js";
+import { getIsCloud } from "../../config/env-registry.js";
 import { loadRawConfig } from "../../config/loader.js";
-import { resolveCallbackUrl } from "../../inbound/platform-callback-registration.js";
+import { resolveCallbackUrl } from "../../inbound/cloud-callback-registration.js";
 import {
   getTwilioStatusCallbackUrl,
   getTwilioVoiceWebhookUrl,
@@ -142,18 +142,18 @@ export function getIngressConfigResult(): {
   managedCallbacks: boolean;
   success: boolean;
 } {
-  // Platform-managed assistants don't configure ingress.publicBaseUrl —
+  // Cloud assistants don't configure ingress.publicBaseUrl —
   // they receive webhooks through platform callback routing. Surface the
   // platform callback URL and flag managedCallbacks so consumers (including
   // the assistant LLM) don't mistakenly try to set up ngrok or a tunnel.
-  if (getIsPlatform()) {
-    const platformBase = getPlatformBaseUrl().replace(/\/+$/, "");
-    const assistantId = getPlatformAssistantId();
+  if (getIsCloud()) {
+    const cloudBase = getCloudBaseUrl().replace(/\/+$/, "");
+    const assistantId = getCloudAssistantId();
     if (assistantId) {
       return {
         enabled: true,
         explicitlyDisabled: false,
-        publicBaseUrl: `${platformBase}/gateway/callbacks/${assistantId}`,
+        publicBaseUrl: `${cloudBase}/gateway/callbacks/${assistantId}`,
         localGatewayTarget: computeGatewayTarget(),
         managedCallbacks: true,
         success: true,

package/src/daemon/handlers/config-telegram.ts

@@ -7,7 +7,7 @@ import {
   setNestedValue,
 } from "../../config/loader.js";
 import { hasWebhookRoutingConfigured } from "../../config/webhook-routing.js";
-import { registerCallbackRoute } from "../../inbound/platform-callback-registration.js";
+import { registerCallbackRoute } from "../../inbound/cloud-callback-registration.js";
 import {
   ensureManualTokenConnection,
   removeManualTokenConnection,
@@ -246,17 +246,17 @@ export async function setTelegramConfig(
     hasWebhookSecret,
   };
 
-  // Register the Telegram callback route so the platform knows how to
+  // Register the Telegram callback route so the cloud knows how to
   // forward Telegram webhooks. This applies whenever webhooks are delivered
-  // via managed callbacks: platform pods, and platform-connected local
+  // via cloud callbacks: cloud pods, and platform-connected local
   // assistants with no public ingress. For both, platform callbacks are the
   // only way to receive Telegram webhooks. `hasWebhookRoutingConfigured`
   // encodes the resolution order (a configured ingress wins; an explicit
-  // `ingress.enabled: false` blocks the platform fallback) and is the same
+  // `ingress.enabled: false` blocks the cloud fallback) and is the same
   // derivation the Telegram status checks read, so registration and reported
   // status stay in agreement.
-  const { usesManagedCallbacks } = await hasWebhookRoutingConfigured(true);
-  if (usesManagedCallbacks) {
+  const { usesCloudCallbacks } = await hasWebhookRoutingConfigured(true);
+  if (usesCloudCallbacks) {
     registerCallbackRoute("webhooks/telegram", "telegram").catch((err) => {
       log.warn({ err }, "Failed to register Telegram platform callback route");
     });