@mycadet/assistant 0.12.7 → 0.12.9

package/src/oauth/seed-providers.ts

@@ -42,7 +42,7 @@ const SLACK_PROVIDER_INJECTION_TEMPLATES: NonNullable<
  * every startup. Only Cadet implementation fields (authorizeUrl, tokenExchangeUrl,
  * refreshUrl, tokenEndpointAuthMethod, userinfoUrl, authorizeParams,
  * pingUrl, pingMethod, pingHeaders, pingBody, revokeUrl, revokeBodyTemplate,
- * managedServiceConfigKey, managedServiceIsPaid,
+ * cloudServiceConfigKey, managedServiceIsPaid,
  * loopbackPort, injectionTemplates, appType, setupNotes,
  * identityUrl, identityMethod, identityHeaders, identityBody,
  * identityResponsePaths, identityFormat, identityOkField, featureFlag,
@@ -76,7 +76,7 @@ export const PROVIDER_SEED_DATA: Record<
     availableScopes?: AvailableScopes;
     scopeSeparator?: string;
     authorizeParams?: Record<string, string>;
-    managedServiceConfigKey?: string;
+    cloudServiceConfigKey?: string;
     managedServiceIsPaid?: boolean;
     displayLabel: string;
     description: string;
@@ -96,8 +96,8 @@ export const PROVIDER_SEED_DATA: Record<
     setupNotes?: string[];
     /**
      * Per-tenant providers only: the host the user supplies at connect time,
-     * which the platform substitutes into `{tenant_host}` URL placeholders.
-     * `pattern` mirrors the platform registry's validation so clients can
+     * which the cloud substitutes into `{tenant_host}` URL placeholders.
+     * `pattern` mirrors the cloud registry's validation so clients can
      * reject a malformed host before the request leaves the browser.
      */
     tenantHost?: { pattern: string; label: string; placeholder: string };
@@ -155,7 +155,7 @@ export const PROVIDER_SEED_DATA: Record<
       "https://developers.google.com/identity/protocols/oauth2/scopes",
     authorizeParams: { access_type: "offline", prompt: "consent" },
     loopbackPort: 17321,
-    managedServiceConfigKey: "google-oauth",
+    cloudServiceConfigKey: "google-oauth",
     injectionTemplates: [
       {
         hostPattern: "gmail.googleapis.com",
@@ -292,7 +292,7 @@ export const PROVIDER_SEED_DATA: Record<
     authorizeParams: { owner: "user" },
     tokenEndpointAuthMethod: "client_secret_basic",
     tokenExchangeBodyFormat: "json",
-    managedServiceConfigKey: "notion-oauth",
+    cloudServiceConfigKey: "notion-oauth",
     loopbackPort: 17323,
     injectionTemplates: [
       {
@@ -335,7 +335,7 @@ export const PROVIDER_SEED_DATA: Record<
       "https://developer.x.com/en/docs/authentication/oauth-2-0/authorization-code",
     tokenEndpointAuthMethod: "client_secret_basic",
     loopbackPort: 17335,
-    managedServiceConfigKey: "twitter-oauth",
+    cloudServiceConfigKey: "twitter-oauth",
     managedServiceIsPaid: true,
     injectionTemplates: [
       {
@@ -372,7 +372,7 @@ export const PROVIDER_SEED_DATA: Record<
     defaultScopes: ["repo", "read:user", "notifications"],
     availableScopes:
       "https://docs.github.com/en/apps/oauth-apps/building-oauth-apps/scopes-for-oauth-apps",
-    managedServiceConfigKey: "github-oauth",
+    cloudServiceConfigKey: "github-oauth",
     loopbackPort: 17332,
     injectionTemplates: [
       {
@@ -421,7 +421,7 @@ export const PROVIDER_SEED_DATA: Record<
     scopeSeparator: ",",
     authorizeParams: { prompt: "consent" },
     loopbackPort: 17324,
-    managedServiceConfigKey: "linear-oauth",
+    cloudServiceConfigKey: "linear-oauth",
     injectionTemplates: [
       {
         hostPattern: "api.linear.app",
@@ -506,7 +506,7 @@ export const PROVIDER_SEED_DATA: Record<
       { scope: "project:delete", description: "Delete entire projects" },
     ],
     loopbackPort: 17325,
-    managedServiceConfigKey: "todoist-oauth",
+    cloudServiceConfigKey: "todoist-oauth",
     injectionTemplates: [
       {
         hostPattern: "api.todoist.com",
@@ -543,7 +543,7 @@ export const PROVIDER_SEED_DATA: Record<
     availableScopes:
       "https://discord.com/developers/docs/topics/oauth2#shared-resources-oauth2-scopes",
     loopbackPort: 17326,
-    managedServiceConfigKey: "discord-oauth",
+    cloudServiceConfigKey: "discord-oauth",
     injectionTemplates: [
       {
         hostPattern: "discord.com",
@@ -614,7 +614,7 @@ export const PROVIDER_SEED_DATA: Record<
     defaultScopes: ["default"],
     availableScopes: "https://developers.asana.com/docs/oauth-scopes",
     loopbackPort: 17328,
-    managedServiceConfigKey: "asana-oauth",
+    cloudServiceConfigKey: "asana-oauth",
     injectionTemplates: [
       {
         hostPattern: "app.asana.com",
@@ -683,7 +683,7 @@ export const PROVIDER_SEED_DATA: Record<
     availableScopes:
       "https://developers.hubspot.com/docs/guides/apps/authentication/scopes",
     loopbackPort: 17330,
-    managedServiceConfigKey: "hubspot-oauth",
+    cloudServiceConfigKey: "hubspot-oauth",
     injectionTemplates: [
       {
         hostPattern: "api.hubapi.com",
@@ -860,7 +860,7 @@ export const PROVIDER_SEED_DATA: Record<
     // time); 17339 is the real next-free slot once all three are seeded
     // together.
     loopbackPort: 17339,
-    managedServiceConfigKey: "monday-oauth",
+    cloudServiceConfigKey: "monday-oauth",
     injectionTemplates: [
       {
         hostPattern: "api.monday.com",
@@ -902,7 +902,7 @@ export const PROVIDER_SEED_DATA: Record<
     defaultScopes: [],
     tokenEndpointAuthMethod: "client_secret_post",
     loopbackPort: 17337,
-    managedServiceConfigKey: "eventbrite-oauth",
+    cloudServiceConfigKey: "eventbrite-oauth",
     injectionTemplates: [
       {
         hostPattern: "www.eventbriteapi.com",
@@ -1000,7 +1000,7 @@ export const PROVIDER_SEED_DATA: Record<
     // independently picked the next free port at the time); 17338 is the
     // real next-free slot once both are seeded together.
     loopbackPort: 17338,
-    managedServiceConfigKey: "calendly-oauth",
+    cloudServiceConfigKey: "calendly-oauth",
     injectionTemplates: [
       {
         hostPattern: "api.calendly.com",
@@ -1172,7 +1172,7 @@ export const PROVIDER_SEED_DATA: Record<
     ],
     tokenEndpointAuthMethod: "client_secret_basic",
     loopbackPort: 17331,
-    managedServiceConfigKey: "figma-oauth",
+    cloudServiceConfigKey: "figma-oauth",
     injectionTemplates: [
       {
         hostPattern: "api.figma.com",
@@ -1231,7 +1231,7 @@ export const PROVIDER_SEED_DATA: Record<
     authorizeParams: { prompt: "select_account" },
     tokenEndpointAuthMethod: "client_secret_post",
     loopbackPort: 17334,
-    managedServiceConfigKey: "outlook-oauth",
+    cloudServiceConfigKey: "outlook-oauth",
     injectionTemplates: [
       {
         hostPattern: "graph.microsoft.com",
@@ -1374,13 +1374,13 @@ export const PROVIDER_SEED_DATA: Record<
     tokenEndpointAuthMethod: "client_secret_post",
     // Link's authorize request also needs a `key` param holding the Stripe
     // publishable key of the account behind the OAuth client. Cadet's own
-    // key lives in the platform registry, which is the only place it is the
-    // right answer: it pairs with the platform's client_id. Seeding it here
+    // key lives in the cloud registry, which is the only place it is the
+    // right answer: it pairs with the cloud's client_id. Seeding it here
     // would hand every self-hosted install our merchant identity to send
     // alongside their own client_id, so BYO is deliberately left without one.
     // See setupNotes.
     loopbackPort: 17340,
-    managedServiceConfigKey: "stripe-link-oauth",
+    cloudServiceConfigKey: "stripe-link-oauth",
     injectionTemplates: [
       {
         hostPattern: "api.link.com",
@@ -1391,7 +1391,7 @@ export const PROVIDER_SEED_DATA: Record<
     ],
     appType: "App",
     setupNotes: [
-      "Link is available in managed mode only. Its authorize endpoint requires a `key` parameter carrying the Stripe publishable key for the account that owns the OAuth client, and a bring-your-own connection has nowhere to put one: authorizeParams is re-stamped from seed data on every startup and no CLI or API surface sets it. Use managed mode, where the platform supplies both halves.",
+      "Link is available in managed mode only. Its authorize endpoint requires a `key` parameter carrying the Stripe publishable key for the account that owns the OAuth client, and a bring-your-own connection has nowhere to put one: authorizeParams is re-stamped from seed data on every startup and no CLI or API surface sets it. Use managed mode, where the cloud supplies both halves.",
     ],
     // /userinfo returns no id, so email is the only stable-ish handle; phone
     // backstops a wallet that has one but no email on file.
@@ -1581,8 +1581,8 @@ export const PROVIDER_SEED_DATA: Record<
       },
     ],
     loopbackPort: 17341,
-    managedServiceConfigKey: "shopify-oauth",
-    // Mirrors `extra_config.tenant_host` in the platform provider registry.
+    cloudServiceConfigKey: "shopify-oauth",
+    // Mirrors `extra_config.tenant_host` in the cloud provider registry.
     tenantHost: {
       pattern: "^[a-z0-9][a-z0-9-]*\\.myshopify\\.com$",
       label: "Shop domain",
@@ -1605,7 +1605,7 @@ export const PROVIDER_SEED_DATA: Record<
     // myshopify domain is the stable, human-recognisable handle.
     identityUrl: "https://{tenant_host}/admin/api/2026-07/shop.json",
     identityResponsePaths: ["shop.myshopify_domain", "shop.name"],
-    // Gated like monday/figma/stripe-link: the platform side and the
+    // Gated like monday/figma/stripe-link: the cloud side and the
     // shop-domain input in the clients land separately, and until both are
     // in place a visible Shopify tile would offer a connect flow that
     // cannot complete.
@@ -1618,21 +1618,21 @@ export const PROVIDER_SEED_DATA: Record<
     tokenExchangeUrl:
       "https://oauth.platform.intuit.com/oauth2/v1/tokens/bearer",
     // Access tokens live an hour; refresh tokens 100 days and are rotated on
-    // every refresh, which the platform persists. Both token endpoints
+    // every refresh, which the cloud persists. Both token endpoints
     // authenticate the client with HTTP Basic.
     refreshUrl: "https://oauth.platform.intuit.com/oauth2/v1/tokens/bearer",
     tokenEndpointAuthMethod: "client_secret_basic",
     // No revokeUrl: Intuit's revocation endpoint wants a JSON body under HTTP
     // Basic client auth, and the daemon's revoke helper only posts an
     // unauthenticated form body, so a seeded URL would fail silently on every
-    // your-own disconnect. The platform registry revokes managed tokens itself.
+    // your-own disconnect. The cloud registry revokes managed tokens itself.
     // Every Accounting API path is scoped to the company (realm) the user
     // picked on Intuit's consent screen. The realm arrives only as the
-    // callback's `realmId` query parameter; the platform captures it into the
+    // callback's `realmId` query parameter; the cloud captures it into the
     // connection's `provider_params` and fills the `{realm_id}` placeholder
     // server-side, so managed callers send paths relative to the company
     // (`/query`, `/customer/123`). Production and sandbox keys use different
-    // hosts; the platform picks the host per environment.
+    // hosts; the cloud picks the host per environment.
     baseUrl: "https://quickbooks.api.intuit.com/v3/company/{realm_id}",
     // No pingUrl: the only company-independent probe would still need the
     // realm in its path, which the ping route cannot fill in (it sends the
@@ -1666,7 +1666,7 @@ export const PROVIDER_SEED_DATA: Record<
       { scope: "address", description: "The signing-in user's address" },
     ],
     loopbackPort: 17342,
-    managedServiceConfigKey: "quickbooks-oauth",
+    cloudServiceConfigKey: "quickbooks-oauth",
     injectionTemplates: [
       {
         hostPattern: "quickbooks.api.intuit.com",
@@ -1683,7 +1683,7 @@ export const PROVIDER_SEED_DATA: Record<
     ],
     appType: "App",
     setupNotes: [
-      "QuickBooks scopes every Accounting API call to the company (realm) chosen on Intuit's consent screen. Managed connections carry the realm as provider_params.realm_id and requests are sent relative to /v3/company/{realmId}.",
+      "QuickBooks scopes every Accounting API call to the company (realm) chosen on Intuit's consent screen. Cloud connections carry the realm as provider_params.realm_id and requests are sent relative to /v3/company/{realmId}.",
       "Intuit development keys only authorize sandbox companies, which live on sandbox-quickbooks.api.intuit.com; production keys use quickbooks.api.intuit.com.",
       "The Accounting API returns XML unless the request carries Accept: application/json.",
     ],
@@ -1694,7 +1694,7 @@ export const PROVIDER_SEED_DATA: Record<
       "https://quickbooks.api.intuit.com/v3/company/{realm_id}/companyinfo/{realm_id}",
     identityHeaders: { Accept: "application/json" },
     identityResponsePaths: ["CompanyInfo.CompanyName", "CompanyInfo.LegalName"],
-    // Gated like figma/shopify: the platform side lands separately, and until
+    // Gated like figma/shopify: the cloud side lands separately, and until
     // the client ids are live a visible tile would offer a connect flow that
     // cannot complete.
     featureFlag: "quickbooks-oauth",

package/src/permissions/approval-provenance.ts

@@ -9,7 +9,7 @@ import type { ApprovalMode, ApprovalReason } from "./types.js";
  *   "allow"                 — auto-allowed by policy (sandbox, trust rule, or threshold)
  *   "deny"                  — user denied via interactive prompt
  *   "denied"                — system denied (no interactive client, or trust rule deny)
- *   "platform_auto_approve" — guardian bash in platform-hosted session
+ *   "platform_auto_approve" — guardian bash in cloud-hosted session
  *   "guardian_auto_approve" — non-interactive guardian session within background threshold
  */
 export function mapApprovalProvenance(

package/src/permissions/checker.test.ts

@@ -7,12 +7,11 @@
 
 import { beforeEach, describe, expect, mock, test } from "bun:test";
 
+import { setAllFlagsOffForTesting } from "../__tests__/feature-flag-test-helpers.js";
+
 // ── Module mocks ─────────────────────────────────────────────────────────────
 
 // Mock feature flags to return false by default.
-mock.module("../config/assistant-feature-flags.js", () => ({
-  isAssistantFeatureFlagEnabled: () => false,
-}));
 
 // `buildPolicyContext` (used by the integration tests below) precomputes the
 // retrospective skill-improvement gate. Keep the v3 tier active while the
@@ -196,6 +195,9 @@ import { RiskLevel } from "./types.js";
 
 describe("Permission Checker (gateway IPC)", () => {
   beforeEach(() => {
+    // Real flag resolution with every default-enabled flag pinned off —
+    // replaces the former blanket `() => false` module mock.
+    setAllFlagsOffForTesting();
     mockIsContainerized = false;
     mockIpcClassifyRiskResult = undefined;
     lastClassifyRiskParams = undefined;
@@ -883,7 +885,7 @@ describe("Permission Checker (gateway IPC)", () => {
     // ── Memory-retrospective skill-authoring auto-grant ─────────────────────
     // The background retrospective guardian session (sourceChannel "cadet",
     // trustClass "guardian", origin "memory_retrospective") cannot answer
-    // interactive prompts, so `scaffold_managed_skill`, `find_similar_skills`,
+    // interactive prompts, so `scaffold_cloud_skill`, `find_similar_skills`,
     // and `skill_load skill-management` resolve to allow without prompting. The
     // grant is scoped to that origin + those tools, and ONLY fires when the
     // feature is active (`procToSkillsActive: true`).
@@ -896,11 +898,11 @@ describe("Permission Checker (gateway IPC)", () => {
       procToSkillsActive: true,
     };
 
-    test("allows scaffold_managed_skill for the retrospective origin without prompting", async () => {
+    test("allows scaffold_cloud_skill for the retrospective origin without prompting", async () => {
       // High risk would normally force a prompt — the grant short-circuits
       // before classification, so no IPC result is needed.
       const result = await check(
-        "scaffold_managed_skill",
+        "scaffold_cloud_skill",
         { skill_id: "deploy-preview" },
         "/home/user/project",
         retrospectiveContext,
@@ -958,7 +960,7 @@ describe("Permission Checker (gateway IPC)", () => {
         scopeOptions: [],
       };
       const result = await check(
-        "delete_managed_skill",
+        "delete_cloud_skill",
         { skill_id: "deploy-preview" },
         "/home/user/project",
         retrospectiveContext,
@@ -975,7 +977,7 @@ describe("Permission Checker (gateway IPC)", () => {
       };
       // A normal interactive turn carries no retrospective origin signals.
       const result = await check(
-        "scaffold_managed_skill",
+        "scaffold_cloud_skill",
         { skill_id: "deploy-preview" },
         "/home/user/project",
         { executionContext: "conversation" },
@@ -994,7 +996,7 @@ describe("Permission Checker (gateway IPC)", () => {
       // consolidation origin does not authorize skill authoring; only the
       // retrospective origin holds this grant.
       const result = await check(
-        "scaffold_managed_skill",
+        "scaffold_cloud_skill",
         { skill_id: "deploy-preview" },
         "/home/user/project",
         {
@@ -1018,7 +1020,7 @@ describe("Permission Checker (gateway IPC)", () => {
       // Same guardian/cadet background trust, but a different origin (e.g.
       // the memory sweep job) must not inherit the retrospective grant.
       const result = await check(
-        "scaffold_managed_skill",
+        "scaffold_cloud_skill",
         { skill_id: "deploy-preview" },
         "/home/user/project",
         {
@@ -1040,7 +1042,7 @@ describe("Permission Checker (gateway IPC)", () => {
         scopeOptions: [],
       };
       const result = await check(
-        "scaffold_managed_skill",
+        "scaffold_cloud_skill",
         { skill_id: "deploy-preview" },
         "/home/user/project",
         {
@@ -1065,7 +1067,7 @@ describe("Permission Checker (gateway IPC)", () => {
       // inactive — `procToSkillsActive` is not true — so the grant must NOT
       // fire and the high-risk tool prompts.
       const result = await check(
-        "scaffold_managed_skill",
+        "scaffold_cloud_skill",
         { skill_id: "deploy-preview" },
         "/home/user/project",
         { ...retrospectiveContext, procToSkillsActive: false },
@@ -1083,7 +1085,7 @@ describe("Permission Checker (gateway IPC)", () => {
 
     /** A bare core tool — `buildPolicyContext` reads only `tool.name`/owner. */
     const scaffoldTool = {
-      name: "scaffold_managed_skill",
+      name: "scaffold_cloud_skill",
     } as unknown as Tool;
 
     /** The ToolContext a memory-retrospective pass produces. */
@@ -1116,7 +1118,7 @@ describe("Permission Checker (gateway IPC)", () => {
       expect(policyContext.procToSkillsActive).toBe(true);
 
       const result = await check(
-        "scaffold_managed_skill",
+        "scaffold_cloud_skill",
         { skill_id: "deploy-preview" },
         "/home/user/project",
         policyContext,
@@ -1148,7 +1150,7 @@ describe("Permission Checker (gateway IPC)", () => {
       expect(policyContext.requestOrigin).toBeUndefined();
 
       const result = await check(
-        "scaffold_managed_skill",
+        "scaffold_cloud_skill",
         { skill_id: "deploy-preview" },
         "/home/user/project",
         policyContext,
@@ -1176,7 +1178,7 @@ describe("Permission Checker (gateway IPC)", () => {
       expect(policyContext.requestOrigin).toBe("memory_retrospective");
 
       const result = await check(
-        "scaffold_managed_skill",
+        "scaffold_cloud_skill",
         { skill_id: "deploy-preview" },
         "/home/user/project",
         policyContext,

package/src/permissions/checker.ts

@@ -476,7 +476,7 @@ function buildClassifyRiskParams(
 
   // ── Skill tools ──
   if (
-    ["skill_load", "scaffold_managed_skill", "delete_managed_skill"].includes(
+    ["skill_load", "scaffold_cloud_skill", "delete_cloud_skill"].includes(
       toolName,
     )
   ) {
@@ -610,7 +610,7 @@ export async function classifyRisk(
 }
 
 // ── Background memory-retrospective skill-authoring auto-grant ────────────────
-// Skill scaffolding (`scaffold_managed_skill`, risk: high + allowlist-gated),
+// Skill scaffolding (`scaffold_cloud_skill`, risk: high + allowlist-gated),
 // finding similar skills (`find_similar_skills`), and loading the
 // `skill-management` skill (`skill_load skill-management`, which exposes the
 // scaffold tool) require an interactive approval. The memory-retrospective
@@ -640,7 +640,7 @@ function isRetrospectiveSkillAuthoringGrant(
   ) {
     return false;
   }
-  if (toolName === "scaffold_managed_skill") {
+  if (toolName === "scaffold_cloud_skill") {
     return true;
   }
   if (toolName === "find_similar_skills") {

package/src/persistence/compaction-log-store-clickhouse.ts

@@ -25,8 +25,8 @@
  * on first write so opting in requires no out-of-band DDL.
  */
 import type { AgentEvent } from "../agent/loop.js";
+import { resolveCloudAssistantIdOrNull } from "../config/cloud-identity.js";
 import { getConfig } from "../config/loader.js";
-import { resolvePlatformAssistantIdOrNull } from "../config/platform-identity.js";
 import type { CompactionLogsClickHouseConfig } from "../config/schemas/compaction-logs.js";
 import { credentialKey } from "../security/credential-key.js";
 import { getSecureKeyAsync } from "../security/secure-keys.js";
@@ -164,7 +164,7 @@ export class ClickHouseCompactionLogStore {
       deps.resolvePassword ??
       (() => readCredentialOrNull("clickhouse", "password"));
     this.resolveAssistantId =
-      deps.resolveAssistantId ?? resolvePlatformAssistantIdOrNull;
+      deps.resolveAssistantId ?? resolveCloudAssistantIdOrNull;
     this.fetchImpl = deps.fetchImpl ?? globalThis.fetch.bind(globalThis);
   }
 
@@ -408,7 +408,7 @@ export class ClickHouseCompactionLogStore {
     const val = await this.resolveAssistantId();
     if (!val) {
       throw new Error(
-        "cadet:platform_assistant_id credential is required when compactionLogs.destination=clickhouse",
+        "Cadet Cloud assistant id is required when compactionLogs.destination=clickhouse",
       );
     }
     this.cachedAssistantId = val;

package/src/persistence/embeddings/embedding-backend.test.ts

@@ -31,14 +31,14 @@ function setKey(provider: string, value: string | undefined): void {
 
 const DISABLED_PROXY_CONTEXT = {
   enabled: false,
-  platformBaseUrl: "",
+  cloudBaseUrl: "",
   assistantApiKey: "",
 };
-const resolveManagedProxyContextMock = mock(async () => DISABLED_PROXY_CONTEXT);
-mock.module("../../providers/platform-proxy/context.js", () => ({
-  resolveManagedProxyContext: resolveManagedProxyContextMock,
-  hasManagedProxyPrereqs: mock(async () => false),
-  buildManagedBaseUrl: mock(async () => undefined),
+const resolveCloudProxyContextMock = mock(async () => DISABLED_PROXY_CONTEXT);
+mock.module("../../providers/cloud-proxy/context.js", () => ({
+  resolveCloudProxyContext: resolveCloudProxyContextMock,
+  hasCloudProxyPrereqs: mock(async () => false),
+  buildCloudBaseUrl: mock(async () => undefined),
   managedFallbackEnabledFor: mock(async () => false),
 }));
 
@@ -274,7 +274,7 @@ const GEMINI_CONFIG = {
 
 const ENABLED_PROXY_CONTEXT = {
   enabled: true,
-  platformBaseUrl: "https://proxy.example.com",
+  cloudBaseUrl: "https://proxy.example.com",
   assistantApiKey: "stale-platform-key",
 };
 
@@ -285,13 +285,13 @@ function jsonResponse(body: unknown, status: number): Response {
   });
 }
 
-describe("managed-proxy Gemini fallback to direct key", () => {
+describe("cloud-proxy Gemini fallback to direct key", () => {
   const originalFetch = globalThis.fetch;
   let fetchMock: ReturnType<typeof mock>;
 
   beforeEach(() => {
     clearEmbeddingBackendCache();
-    // Managed-proxy requests (proxy.example.com) are rejected like a platform
+    // Managed-proxy requests (proxy.example.com) are rejected like a cloud
     // proxy with a bad credential; direct Google API requests succeed.
     fetchMock = mock(async (url: string | URL) => {
       if (String(url).startsWith("https://proxy.example.com/")) {
@@ -306,14 +306,14 @@ describe("managed-proxy Gemini fallback to direct key", () => {
     globalThis.fetch = originalFetch;
     clearEmbeddingBackendCache();
     secureKeys.clear();
-    resolveManagedProxyContextMock.mockReset();
-    resolveManagedProxyContextMock.mockImplementation(
+    resolveCloudProxyContextMock.mockReset();
+    resolveCloudProxyContextMock.mockImplementation(
       async () => DISABLED_PROXY_CONTEXT,
     );
   });
 
-  test("falls back to the direct key when the managed-proxy primary fails", async () => {
-    resolveManagedProxyContextMock.mockImplementation(
+  test("falls back to the direct key when the cloud-proxy primary fails", async () => {
+    resolveCloudProxyContextMock.mockImplementation(
       async () => ENABLED_PROXY_CONTEXT,
     );
     setKey("gemini", "direct-key");
@@ -339,8 +339,8 @@ describe("managed-proxy Gemini fallback to direct key", () => {
     expect(directUrl).toContain("key=direct-key");
   });
 
-  test("surfaces the managed-proxy error when no direct key exists", async () => {
-    resolveManagedProxyContextMock.mockImplementation(
+  test("surfaces the cloud-proxy error when no direct key exists", async () => {
+    resolveCloudProxyContextMock.mockImplementation(
       async () => ENABLED_PROXY_CONTEXT,
     );
 
@@ -350,7 +350,7 @@ describe("managed-proxy Gemini fallback to direct key", () => {
     expect(fetchMock).toHaveBeenCalledTimes(1);
   });
 
-  test("uses the direct key as primary when the managed proxy is disabled", async () => {
+  test("uses the direct key as primary when the cloud proxy is disabled", async () => {
     setKey("gemini", "direct-key");
 
     const result = await embedWithBackend(GEMINI_CONFIG, ["another input"]);

package/src/persistence/embeddings/embedding-backend.ts

@@ -4,8 +4,8 @@ import { getOllamaBaseUrlEnv } from "../../config/env.js";
 import { resolveCallSiteConfig } from "../../config/llm-resolver.js";
 import { isMemoryEnabled } from "../../config/memory-v3-gate.js";
 import type { AssistantConfig } from "../../config/types.js";
-import { PLATFORM_PROVIDER_META } from "../../providers/platform-proxy/constants.js";
-import { resolveManagedProxyContext } from "../../providers/platform-proxy/context.js";
+import { PLATFORM_PROVIDER_META } from "../../providers/cloud-proxy/constants.js";
+import { resolveCloudProxyContext } from "../../providers/cloud-proxy/context.js";
 import { getProviderKeyAsync } from "../../security/secure-keys.js";
 import { getLogger } from "../../util/logger.js";
 import {
@@ -522,19 +522,19 @@ function getCustomEmbeddingBackend(
 }
 
 /**
- * Build (or reuse) the managed-proxy Gemini backend, or return undefined
- * when the managed proxy prerequisites (platform URL + assistant API key)
+ * Build (or reuse) the cloud-proxy Gemini backend, or return undefined
+ * when the cloud proxy prerequisites (platform URL + assistant API key)
  * are not satisfied.
  */
 async function tryGetManagedGeminiBackend(
   config: AssistantConfig,
 ): Promise<EmbeddingBackend | undefined> {
-  const proxyCtx = await resolveManagedProxyContext();
+  const proxyCtx = await resolveCloudProxyContext();
   const meta = PLATFORM_PROVIDER_META["gemini"];
   if (!proxyCtx.enabled || !meta?.managed || !meta.proxyPath) {
     return undefined;
   }
-  const managedBaseUrl = `${proxyCtx.platformBaseUrl}${meta.proxyPath}`;
+  const cloudBaseUrl = `${proxyCtx.cloudBaseUrl}${meta.proxyPath}`;
   return getCachedOrCreate(
     "gemini",
     config.memory.embeddings.geminiModel,
@@ -545,7 +545,7 @@ async function tryGetManagedGeminiBackend(
         {
           taskType: config.memory.embeddings.geminiTaskType,
           dimensions: config.memory.embeddings.geminiDimensions ?? 3072,
-          managedBaseUrl,
+          cloudBaseUrl,
         },
       ),
     [...geminiCacheExtras(config), "managed"],
@@ -607,8 +607,8 @@ export async function selectEmbeddingBackend(
     };
   }
 
-  // When managed proxy prerequisites are satisfied, insert managed-proxy Gemini
-  // at the front of the auto chain so platform assistants use Cadet-managed
+  // When cloud proxy prerequisites are satisfied, insert cloud-proxy Gemini
+  // at the front of the auto chain so platform assistants use Cadet Cloud
   // Gemini embeddings.
   if (requested === "auto" || requested === "gemini") {
     const managed = await tryGetManagedGeminiBackend(config);
@@ -817,7 +817,7 @@ export async function isEmbeddingDimensionAvailable(
   }
 
   // Probe the exact backend chain `embedWithBackend` would try (primary +
-  // auto-mode fallbacks + the managed→direct Gemini fallback) via the shared
+  // auto-mode fallbacks + the cloud→direct Gemini fallback) via the shared
   // assembler, so this preflight can never be more pessimistic than the real
   // embed path. Dense recall stays available if ANY backend in the chain
   // produces the committed dimension. `resolveBackendDimension` memoizes per
@@ -898,7 +898,7 @@ export class EmbeddingBackendUnavailableError extends Error {
  * Assemble the ordered backend chain {@link embedWithBackend} will try for a
  * given primary selection: the primary, then (in `auto` mode, non-Gemini
  * primary) the configured fallbacks, then a direct-key Gemini fallback when the
- * primary is managed-proxy Gemini. This is the single source of truth for the
+ * primary is cloud-proxy Gemini. This is the single source of truth for the
  * fallback chain, shared with the dimension-availability preflight
  * ({@link isEmbeddingDimensionAvailable}) so the preflight cannot diverge from
  * what the real embed path attempts.
@@ -916,7 +916,7 @@ async function assembleEmbeddingBackends(
       ? await selectFallbackBackends(config, primary.provider)
       : [];
 
-  // A managed-proxy Gemini primary can fail at the proxy (e.g. a stale or
+  // A cloud-proxy Gemini primary can fail at the proxy (e.g. a stale or
   // revoked cloud credential) while a valid direct Gemini key sits in the
   // credential store. The provider chain above never includes Gemini when
   // Gemini IS the primary, so without this the direct key would never be tried.
@@ -1133,7 +1133,7 @@ async function selectFallbackBackends(
         if (geminiKey) {
           backends.push(getDirectGeminiBackend(config, geminiKey));
         } else {
-          // Try managed proxy Gemini as fallback when no direct key exists.
+          // Try cloud proxy Gemini as fallback when no direct key exists.
           const managed = await tryGetManagedGeminiBackend(config);
           if (managed) {
             backends.push(managed);