@mycadet/assistant 0.12.8 → 0.12.9

package/src/api/events/show-cloud-login.ts

@@ -1,5 +1,5 @@
 /**
- * `show_platform_login` SSE event.
+ * `show_cloud_login` SSE event.
  *
  * Emitted by the cloud-connect route when no cloud credentials are
  * stored yet, signalling connected clients to surface the cloud login UI.
@@ -12,7 +12,7 @@
 import { z } from "zod";
 
 export const ShowCloudLoginEventSchema = z.object({
-  type: z.literal("show_platform_login"),
+  type: z.literal("show_cloud_login"),
 });
 
 export type ShowCloudLoginEvent = z.infer<typeof ShowCloudLoginEventSchema>;

package/src/cli/commands/cloud/__tests__/callback-routes-list.test.ts

@@ -66,7 +66,7 @@ describe("assistant cloud callback-routes list", () => {
     expect((thrown as Error).message).toBe("exitFromIpcResult called");
   });
 
-  test("callback-routes register calls platform_callback_routes_register", async () => {
+  test("callback-routes register calls cloud_callback_routes_register", async () => {
     ipc.response = {
       ok: true,
       result: {
@@ -87,7 +87,7 @@ describe("assistant cloud callback-routes list", () => {
       "--json",
     ]);
 
-    expect(ipc.calls[0][0]).toBe("platform_callback_routes_register");
+    expect(ipc.calls[0][0]).toBe("cloud_callback_routes_register");
     expect((ipc.calls[0][1].body as Record<string, unknown>).path).toBe(
       "webhooks/telegram",
     );

package/src/cli/commands/cloud/index.ts

@@ -260,7 +260,7 @@ export function registerCloudCommand(program: Command): void {
             callbackUrl: string;
             callbackPath: string;
             type: string;
-          }>("platform_callback_routes_register", {
+          }>("cloud_callback_routes_register", {
             body: { path: opts.path, type: opts.type },
           });
           if (!r.ok) {

package/src/cli/commands/config.ts

@@ -153,7 +153,7 @@ export function registerConfigCommand(program: Command): void {
           // the value above cannot be mistaken for the effective one.
           const { describeShadowedConfigGet, findSubstrateShadowing } =
             await import("../../config/substrate-twin-shadowing.js");
-          const shadowing = findSubstrateShadowing(raw, key);
+          const shadowing = findSubstrateShadowing(key);
           if (shadowing) {
             log.warn(describeShadowedConfigGet(shadowing, key));
           }

package/src/config/__tests__/substrate-twin-shadowing.test.ts

@@ -1,3 +1,5 @@
+import { utimesSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
 import { describe, expect, test } from "bun:test";
 
 import { MemorySubstrateConfigSchema } from "../schemas/memory-substrate.js";
@@ -9,6 +11,18 @@ import {
   SUBSTRATE_TWIN_BY_V2_KEY,
 } from "../substrate-twin-shadowing.js";
 
+/**
+ * Write `raw` to the workspace config.json as the state the loader serves.
+ * A distinct mtime per write keeps the loader's file-signature cache from
+ * reading two consecutive seeds as identical.
+ */
+function seedRawConfig(raw: Record<string, unknown>): void {
+  const path = join(process.env.CADET_WORKSPACE_DIR!, "config.json");
+  writeFileSync(path, JSON.stringify(raw));
+  const stamp = new Date(Date.now() + Math.random());
+  utimesSync(path, stamp, stamp);
+}
+
 describe("substrate twin table", () => {
   test("pairs exactly the memory.substrate schema's keys", () => {
     // Drift guard: a substrate key with no entry here is a tunable whose
@@ -44,15 +58,15 @@ describe("substrate twin table", () => {
 
 describe("findSubstrateShadowing", () => {
   test("reports the winning substrate twin for a shadowed memory.v2 key", () => {
-    const raw = {
+    seedRawConfig({
       memory: {
         v2: { consolidation_interval_hours: 4 },
         substrate: { consolidation_interval_hours: 876000 },
       },
-    };
+    });
 
     expect(
-      findSubstrateShadowing(raw, "memory.v2.consolidation_interval_hours"),
+      findSubstrateShadowing("memory.v2.consolidation_interval_hours"),
     ).toEqual({
       substratePath: "memory.substrate.consolidation_interval_hours",
       substrateValue: 876000,
@@ -61,29 +75,31 @@ describe("findSubstrateShadowing", () => {
   });
 
   test("maps the renamed spread keys to their substrate names", () => {
-    const raw = { memory: { v2: {}, substrate: { spread_k: 0.4 } } };
+    seedRawConfig({ memory: { v2: {}, substrate: { spread_k: 0.4 } } });
 
-    expect(findSubstrateShadowing(raw, "memory.v2.k")).toEqual({
+    expect(findSubstrateShadowing("memory.v2.k")).toEqual({
       substratePath: "memory.substrate.spread_k",
       substrateValue: 0.4,
       alsoReadByV2Engine: true,
     });
     // hops has no twin set, so nothing shadows it.
-    expect(findSubstrateShadowing(raw, "memory.v2.hops")).toBeUndefined();
+    expect(findSubstrateShadowing("memory.v2.hops")).toBeUndefined();
   });
 
   test("treats an explicit null twin as set, matching resolveSubstrateTuning", () => {
     // `orV2` falls back only on `undefined`, so a null substrate value wins —
-    // and it is exactly the value the consolidation freeze writes.
-    const raw = {
+    // and it is exactly the value the consolidation freeze writes. The field
+    // is nullable in the schema, so the null survives the loader's parse and
+    // stays present in the running config.
+    seedRawConfig({
       memory: {
         v2: { consolidation_max_buffer_lines: 100 },
         substrate: { consolidation_max_buffer_lines: null },
       },
-    };
+    });
 
     expect(
-      findSubstrateShadowing(raw, "memory.v2.consolidation_max_buffer_lines"),
+      findSubstrateShadowing("memory.v2.consolidation_max_buffer_lines"),
     ).toEqual({
       substratePath: "memory.substrate.consolidation_max_buffer_lines",
       substrateValue: null,
@@ -92,29 +108,23 @@ describe("findSubstrateShadowing", () => {
   });
 
   test("returns nothing for unshadowed paths", () => {
-    const raw = {
+    // No memory.substrate subtree at all.
+    seedRawConfig({ memory: { v2: { bm25_b: 0.6 } } });
+    expect(findSubstrateShadowing("memory.v2.bm25_b")).toBeUndefined();
+
+    seedRawConfig({
       memory: {
         v2: { bm25_b: 0.6, enabled: true },
         substrate: { bm25_b: 0.3 },
       },
-    };
-
-    // No memory.substrate subtree at all.
-    expect(
-      findSubstrateShadowing(
-        { memory: { v2: { bm25_b: 0.6 } } },
-        "memory.v2.bm25_b",
-      ),
-    ).toBeUndefined();
+    });
     // A v2 key with no substrate twin.
-    expect(findSubstrateShadowing(raw, "memory.v2.enabled")).toBeUndefined();
+    expect(findSubstrateShadowing("memory.v2.enabled")).toBeUndefined();
     // The substrate key itself is what wins — writing it is never shadowed.
-    expect(
-      findSubstrateShadowing(raw, "memory.substrate.bm25_b"),
-    ).toBeUndefined();
+    expect(findSubstrateShadowing("memory.substrate.bm25_b")).toBeUndefined();
     // Paths outside the memory namespace, and the wrong depth.
-    expect(findSubstrateShadowing(raw, "memory.v2")).toBeUndefined();
-    expect(findSubstrateShadowing(raw, "llm.v2.bm25_b")).toBeUndefined();
+    expect(findSubstrateShadowing("memory.v2")).toBeUndefined();
+    expect(findSubstrateShadowing("llm.v2.bm25_b")).toBeUndefined();
   });
 });
 

package/src/config/env-registry.ts

@@ -20,7 +20,7 @@ function str(name: string): string | undefined {
 }
 
 function flag(name: string): boolean {
-  const raw = str(name);
+  const raw = str(name)?.toLowerCase();
   return raw === "true" || raw === "1";
 }
 
@@ -65,14 +65,7 @@ export function getIsContainerized(): boolean {
  * deployments provisioned before the rename keep working.
  */
 export function getIsCloud(): boolean {
-  return flag("IS_CLOUD") || flag("IS_CLOUD");
-}
-
-/**
- * Whether this assistant is running as a Cadet Cloud-managed remote instance.
- */
-export function isCloudRemote(): boolean {
-  return getIsCloud();
+  return flag("IS_CLOUD");
 }
 
 /**

package/src/config/schemas/ingress.ts

@@ -1,5 +1,23 @@
+import {
+  INGRESS_ASSISTANT_ID_KEY,
+  INGRESS_LAST_TUNNEL_KEY,
+  INGRESS_PAIRING_TUNNEL_KEY,
+  TUNNEL_PROVIDERS,
+} from "@mycadet/service-contracts/ingress";
 import { z } from "zod";
 
+/**
+ * A recorded tunnel under `ingress.lastTunnel` / `ingress.pairingTunnel`.
+ * The CLI writes these records (validated by `parseTunnelRecord` in
+ * service-contracts — the single source for the key names, the provider
+ * allowlist, and record validation); the schema carries them so schema-
+ * canonical config writes preserve live tunnel state instead of dropping it.
+ */
+const TunnelRecordSchema = z.object({
+  provider: z.enum(TUNNEL_PROVIDERS),
+  publicBaseUrl: z.string(),
+});
+
 function emptyOrAbsoluteHttpUrl(fieldPath: string) {
   return z
     .string({ error: `${fieldPath} must be a string` })
@@ -94,6 +112,18 @@ const IngressBaseSchema = z
     rateLimit: IngressRateLimitConfigSchema.default(
       IngressRateLimitConfigSchema.parse({}),
     ),
+    [INGRESS_ASSISTANT_ID_KEY]: z
+      .string()
+      .optional()
+      .describe("The assistant id the tunnel fronted (CLI-owned record)"),
+    [INGRESS_LAST_TUNNEL_KEY]: TunnelRecordSchema.optional(),
+    [INGRESS_PAIRING_TUNNEL_KEY]: TunnelRecordSchema.optional(),
+    publicBaseUrlManagedBy: z
+      .string()
+      .optional()
+      .describe(
+        'Who owns the current publicBaseUrl — "tunnel" when the tunnel machinery stamped it, anything else is user-managed (CLI/route-owned bookkeeping)',
+      ),
   })
   .describe(
     "Ingress HTTP server configuration — handles incoming webhooks, API requests, and channel events",

package/src/config/schemas/llm.ts

@@ -733,15 +733,6 @@ export const ProfileEntry = LLMConfigFragment.extend({
    * not supported.
    */
   fallbackProfile: z.string().min(1).optional().meta({ readOnly: true }),
-  /**
-   * Wire-only capability flags: stamped onto config-read responses by
-   * `enrichProfilesForWire` and stripped from incoming writes by
-   * `stripWireOnlyProfileKeys` (conversation-query-routes), so they never
-   * persist. Declared here so the wire contract (AssistantConfig → SDK
-   * types) describes the enriched profile shape clients consume.
-   */
-  supportsVision: z.boolean().optional(),
-  invariant: z.boolean().optional(),
 }).meta({ id: "ProfileEntry" });
 export type ProfileEntry = z.infer<typeof ProfileEntry>;
 

package/src/config/seed-inference-profiles.ts

@@ -14,6 +14,7 @@ import {
   MANAGED_PROFILE_NAMES,
   MANAGED_PROFILE_TEMPLATES,
 } from "./default-profile-catalog.js";
+import { getIsCloud } from "./env-registry.js";
 import { loadConfig, loadRawConfig, saveRawConfig } from "./loader.js";
 import { isDispatchableProfile } from "./profile-dispatchability.js";
 import {
@@ -67,8 +68,7 @@ export function seedInferenceProfiles(
   const llm = config.llm;
   const profiles = llm.profiles;
 
-  const isCloud =
-    process.env.IS_CLOUD === "true" || process.env.IS_CLOUD === "1";
+  const isCloud = getIsCloud();
 
   // A hatch overlay that explicitly selected a cloud connection routes the
   // default provider through cadet rather than the entered BYOK key.

package/src/config/substrate-twin-shadowing.ts

@@ -2,6 +2,8 @@
 // Memory substrate — twin-namespace shadowing detection
 // ---------------------------------------------------------------------------
 
+import { getConfig } from "./loader.js";
+
 /** One `memory.v2` tunable's `memory.substrate` twin. */
 interface SubstrateTwin {
   /** The twin's `memory.substrate` key, e.g. `spread_k` for `k`. */
@@ -93,29 +95,22 @@ export type SubstrateShadowing = {
   alsoReadByV2Engine: boolean;
 };
 
-function readPlainObject(value: unknown): Record<string, unknown> | undefined {
-  return value != null && typeof value === "object" && !Array.isArray(value)
-    ? (value as Record<string, unknown>)
-    : undefined;
-}
-
 /**
  * The `memory.substrate` twin covering `path`, or `undefined` when `path` is
  * not a shadowable `memory.v2` tunable or its twin is unset.
  *
  * `memory.substrate` is override-only and wins for substrate recall whenever
- * its key is present — including when it holds an explicit `null`, which
- * `resolveSubstrateTuning` treats as present. Detection therefore keys on
- * presence, not truthiness. What that means for the `memory.v2` key depends on
- * `alsoReadByV2Engine`: for a substrate-only twin the `memory.v2` value has no
- * remaining consumer, while for the three engine-read twins it still tunes v2
- * injection.
+ * its key is set. Detection keys on presence in the RUNNING config — the same
+ * typed view `resolveSubstrateTuning` consults, so the check can never
+ * disagree with runtime precedence: a key absent from the parsed config is
+ * absent for the resolver too.
  *
- * `raw` is the unparsed config object (`loadRawConfig()` / the `config_get`
- * payload), so the check sees exactly what is persisted.
+ * What a set twin means for the `memory.v2` key depends on
+ * {@link SubstrateTwin.alsoReadByV2Engine}: for a substrate-only twin the
+ * `memory.v2` value has no remaining consumer, while for the three
+ * engine-read twins it still tunes v2 injection.
  */
 export function findSubstrateShadowing(
-  raw: Record<string, unknown>,
   path: string,
 ): SubstrateShadowing | undefined {
   const segments = path.split(".");
@@ -130,8 +125,8 @@ export function findSubstrateShadowing(
   if (twin === undefined) {
     return undefined;
   }
-  const substrate = readPlainObject(readPlainObject(raw.memory)?.substrate);
-  if (!substrate || !(twin.substrateKey in substrate)) {
+  const substrate: Record<string, unknown> = getConfig().memory.substrate;
+  if (!(twin.substrateKey in substrate)) {
     return undefined;
   }
   return {

package/src/config/sync-gated-profiles.ts

@@ -12,6 +12,7 @@ import {
   AUTO_PROFILE_KEY,
   OS_BETA_PROFILE_KEY,
 } from "./default-profile-names.js";
+import { getIsCloud } from "./env-registry.js";
 import {
   getConfigReadOnly,
   invalidateConfigCache,
@@ -97,9 +98,7 @@ export function reconcileFlagGatedProfiles(): boolean {
     : [];
   llm.profileOrder = profileOrder;
 
-  const isCloud =
-    process.env.IS_CLOUD === "true" || process.env.IS_CLOUD === "1";
-  const isByokMode = !isCloud;
+  const isCloud = getIsCloud();
 
   let changed = false;
   for (const gated of GATED_PROFILES) {
@@ -123,7 +122,7 @@ export function reconcileFlagGatedProfiles(): boolean {
 
     const order = llm.profileOrder as string[];
     const profileChanged = enabled
-      ? enableProfile(gated, profiles, order, previous, isByokMode)
+      ? enableProfile(gated, profiles, order, previous, !isCloud)
       : disableProfile(gated.key, llm, profiles, order, previous);
     if (profileChanged) {
       changed = true;

package/src/credential-execution/prompted-credential.ts

@@ -201,16 +201,7 @@ export async function persistPromptedCredential(args: {
     }
   }
 
-  // The prompt UI never puts the value in the transcript, but the flow is
-  // routinely used to RE-collect a secret the user already pasted into chat
-  // (the 06-credential-security rail promises that pasted message is
-  // scrubbed after storage). Run the scrub right after the store succeeds,
-  // best-effort and invisible to the caller, mirroring credentials_set.
-  const scrubbed = await scrubStoredCredentialFromTranscripts(value);
-  log.info(
-    { service, field, ...scrubbed },
-    "Prompted credential stored; scrubbed value from recent transcripts",
-  );
+  await scrubStoredCredentialFromTranscripts(value, { service, field });
 
   try {
     upsertCredentialMetadata(service, field, {

package/src/credential-health/credential-health-service.ts

@@ -668,10 +668,14 @@ export async function checkAssistantApiKey(): Promise<CredentialHealthResult | n
 
   if (stored.value == null) {
     // A workspace that was never connected to the cloud has no managed
-    // credential and is not unhealthy. The identity ids resolve from the
-    // api key via the validate endpoint, so a missing key means nothing is
-    // bound — there is nothing to check.
-    return null;
+    // credential yet — missing, not unhealthy.
+    return {
+      ...base,
+      status: "missing_token",
+      details:
+        "No Cadet Cloud credentials are stored yet. Log in to Cadet Cloud to set them up.",
+      canAutoRecover: true,
+    };
   }
 
   const { CadetCloudClient } = await import("../cloud/client.js");

package/src/daemon/credential-transcript-scrub.ts

@@ -86,8 +86,15 @@ export interface TranscriptScrubResult {
  * Never throws — partial failures are logged (counts only, never content)
  * and reflected in the best-effort result.
  */
+export interface TranscriptScrubContext {
+  service?: string;
+  field?: string;
+  provider?: string;
+}
+
 export async function scrubStoredCredentialFromTranscripts(
   value: string,
+  context: TranscriptScrubContext = {},
 ): Promise<TranscriptScrubResult> {
   const result: TranscriptScrubResult = {
     dbMessagesScrubbed: 0,
@@ -120,6 +127,10 @@ export async function scrubStoredCredentialFromTranscripts(
       "Credential transcript scrub failed",
     );
   }
+  log.info(
+    { ...context, ...result },
+    "Credential stored; scrubbed value from recent transcripts",
+  );
   return result;
 }
 

package/src/plugins/defaults/memory/__tests__/memory-tier-boundary-guard.test.ts

@@ -209,8 +209,13 @@ interface TierKeyExemption {
  *   tuning when building the graph view.
  * - `src/memory-v2-routes.ts` (v2) — the v2 tuning routes read and merge
  *   `memory.v2` config directly.
+ * - `config/substrate-twin-shadowing.ts` (substrate) — the operator-facing
+ *   twin detector: it reads substrate PRESENCE so a `memory.v2` write can
+ *   warn that the twin namespace wins. It never resolves a tunable itself —
+ *   resolution stays in `substrate/tuning.ts`.
  */
 const TIER_KEY_READ_ALLOWLIST: readonly TierKeyExemption[] = [
+  { path: "src/config/substrate-twin-shadowing.ts", keys: ["substrate"] },
   { path: "src/config/loader.ts", keys: ["v3"] },
   { path: "src/config/memory-v3-gate.ts", keys: ["v2", "v3"] },
   {

package/src/providers/inference/backfill.ts

@@ -18,6 +18,7 @@
  */
 
 import { MANAGED_PROFILE_NAMES } from "../../config/default-profile-catalog.js";
+import { getIsCloud } from "../../config/env-registry.js";
 import { loadRawConfig, saveRawConfig } from "../../config/loader.js";
 import type { DrizzleDb } from "../../persistence/db-connection.js";
 import { credentialKey } from "../../security/credential-key.js";
@@ -73,8 +74,7 @@ function backfillConfigProfiles(db: DrizzleDb): void {
     return;
   }
 
-  const isCloud =
-    process.env.IS_CLOUD === "true" || process.env.IS_CLOUD === "1";
+  const isCloud = getIsCloud();
   const globalMode = isCloud ? "managed" : "your-own";
 
   let changed = false;