@mycadet/assistant 0.12.9 → 0.12.10

package/src/cloud/consent-cache.test.ts

@@ -1,6 +1,5 @@
 import { afterEach, beforeEach, describe, expect, mock, test } from "bun:test";
 
-import { setConfig } from "../__tests__/helpers/set-config.js";
 import type { OwnerConsent } from "./client.js";
 
 // ---------------------------------------------------------------------------
@@ -31,20 +30,16 @@ mock.module("./client.js", () => ({
 // ---------------------------------------------------------------------------
 
 import {
-  __setCachedShareAnalyticsForTest,
   __setCachedShareDiagnosticsForTest,
-  __setCachedShareDiagnosticsVersionForTest,
   getCachedShareDiagnostics,
-  getCachedShareDiagnosticsVersion,
-  getRawShareAnalytics,
   refreshConsentCache,
   startConsentRefresh,
   stopConsentRefresh,
 } from "./consent-cache.js";
 
 /**
- * Build a mock owner consent. Fields default to `false` so existing
- * share_analytics-focused cases don't have to spell them out.
+ * Build a mock owner consent. Fields default to `false` so diagnostics-only
+ * cases don't have to spell them out.
  */
 function makeConsent(overrides: Partial<OwnerConsent> = {}): OwnerConsent {
   return {
@@ -66,131 +61,71 @@ describe("consent-cache", () => {
   beforeEach(() => {
     mockClient = null;
     createCallCount = 0;
-    // Legacy fail-closed opt-out marker read via getConfigReadOnly(). Default
-    // off so existing behavior is unchanged.
-    setConfig("legacyTelemetryOptOut", false);
     // Boot state: no confirmed consent yet.
-    __setCachedShareAnalyticsForTest("unknown");
     __setCachedShareDiagnosticsForTest("unknown");
-    __setCachedShareDiagnosticsVersionForTest("");
   });
 
   afterEach(async () => {
     await stopConsentRefresh();
   });
 
-  test("boot state is unknown", () => {
-    expect(getRawShareAnalytics()).toBe("unknown");
-  });
-
-  test("no platform client available → unknown", async () => {
+  test("no cloud client available → diagnostics stay fail-closed", async () => {
     mockClient = null;
     await refreshConsentCache();
-    expect(getRawShareAnalytics()).toBe("unknown");
+    expect(getCachedShareDiagnostics()).toBe(false);
   });
 
-  test("platform features disabled → confirmed false, not unknown", async () => {
-    // A config-level platform opt-out is permanent, not a cold cache: no
-    // flush will ever drain the outbox, so record-time gates must stay
-    // closed (confirmed false) instead of accumulating rows forever.
-    __setCachedShareAnalyticsForTest(true);
+  test("cloud features disabled → diagnostics confirmed false, not unknown", async () => {
+    __setCachedShareDiagnosticsForTest("unknown");
     process.env.CADET_DISABLE_CLOUD = "1";
     try {
       await refreshConsentCache();
     } finally {
       delete process.env.CADET_DISABLE_CLOUD;
     }
-    expect(getRawShareAnalytics()).toBe(false);
     expect(getCachedShareDiagnostics()).toBe(false);
-    expect(getCachedShareDiagnosticsVersion()).toBe("");
   });
 
-  test("becomes true after a successful fetch reporting shareAnalytics: true", async () => {
-    mockClient = makeClient(makeConsent({ shareAnalytics: true }));
+  test("becomes true after a successful fetch reporting shareDiagnostics: true", async () => {
+    mockClient = makeClient(makeConsent({ shareDiagnostics: true }));
     await refreshConsentCache();
-    expect(getRawShareAnalytics()).toBe(true);
+    expect(getCachedShareDiagnostics()).toBe(true);
   });
 
   test("a null fetch keeps the last known value", async () => {
-    mockClient = makeClient(makeConsent({ shareAnalytics: true }));
+    mockClient = makeClient(makeConsent({ shareDiagnostics: true }));
     await refreshConsentCache();
-    expect(getRawShareAnalytics()).toBe(true);
+    expect(getCachedShareDiagnostics()).toBe(true);
 
     // Transient failure: consent endpoint returns null.
     mockClient = makeClient(null);
     await refreshConsentCache();
-    expect(getRawShareAnalytics()).toBe(true);
-  });
-
-  test("a null fetch keeps a confirmed opt-out", async () => {
-    mockClient = makeClient(makeConsent({ shareAnalytics: false }));
-    await refreshConsentCache();
-    expect(getRawShareAnalytics()).toBe(false);
-
-    mockClient = makeClient(null);
-    await refreshConsentCache();
-    expect(getRawShareAnalytics()).toBe(false);
-  });
-
-  test("a null fetch keeps the boot unknown state", async () => {
-    mockClient = makeClient(null);
-    await refreshConsentCache();
-    expect(getRawShareAnalytics()).toBe("unknown");
-    expect(getCachedShareDiagnostics()).toBe(false);
+    expect(getCachedShareDiagnostics()).toBe(true);
   });
 
-  test("a missing client demotes a prior opt-in to unknown", async () => {
-    __setCachedShareAnalyticsForTest(true);
+  test("a missing client demotes a prior diagnostics opt-in to fail-closed", async () => {
+    __setCachedShareDiagnosticsForTest(true);
     mockClient = null;
     await refreshConsentCache();
-    expect(getRawShareAnalytics()).toBe("unknown");
-  });
-
-  test("a client without a resolvable assistant identity demotes to unknown", async () => {
-    __setCachedShareAnalyticsForTest(true);
-    // Identity cleared mid-session (e.g. assistantId emptied while base URL +
-    // API key persist). getOwnerConsent must not be relied upon to preserve the
-    // prior opt-in here — losing the owner mapping is not an opt-out, but the
-    // stale opt-in must not keep riding either.
-    mockClient = makeClient(makeConsent({ shareAnalytics: true }), "");
-    await refreshConsentCache();
-    expect(getRawShareAnalytics()).toBe("unknown");
-  });
-
-  test("legacy opt-out marker is honored at boot, before any refresh", () => {
-    // The marker is read live from config: a workspace carrying
-    // legacyTelemetryOptOut=true must gate recording in the window between
-    // daemon start and the first consent refresh (unknown-consent recording
-    // would otherwise leak events in that window).
-    setConfig("legacyTelemetryOptOut", true);
-    expect(getRawShareAnalytics()).toBe(false);
-  });
-
-  test("legacy opt-out marker keeps analytics off despite platform opt-in", async () => {
-    setConfig("legacyTelemetryOptOut", true);
-    mockClient = makeClient(makeConsent({ shareAnalytics: true }));
-    await refreshConsentCache();
-    // Platform reports opt-in, but the fail-closed marker forces off. The raw
-    // accessor folds the marker into a confirmed false, not an unknown.
-    expect(getRawShareAnalytics()).toBe(false);
+    expect(getCachedShareDiagnostics()).toBe(false);
   });
 
-  test("a fetch reporting shareAnalytics: false turns the cache off", async () => {
-    __setCachedShareAnalyticsForTest(true);
-    mockClient = makeClient(makeConsent({ shareDiagnostics: true }));
+  test("a client without a resolvable assistant identity demotes diagnostics", async () => {
+    __setCachedShareDiagnosticsForTest(true);
+    mockClient = makeClient(makeConsent({ shareDiagnostics: true }), "");
     await refreshConsentCache();
-    expect(getRawShareAnalytics()).toBe(false);
+    expect(getCachedShareDiagnostics()).toBe(false);
   });
 
   test("startConsentRefresh is idempotent and runs an immediate refresh", async () => {
-    mockClient = makeClient(makeConsent({ shareAnalytics: true }));
+    mockClient = makeClient(makeConsent({ shareDiagnostics: true }));
 
     startConsentRefresh();
     startConsentRefresh(); // no-op: timer already running
     // Let the fire-and-forget immediate refresh settle.
     await new Promise((resolve) => setTimeout(resolve, 0));
 
-    expect(getRawShareAnalytics()).toBe(true);
+    expect(getCachedShareDiagnostics()).toBe(true);
     // One immediate refresh from the first call; the second is a no-op.
     expect(createCallCount).toBe(1);
   });
@@ -199,123 +134,9 @@ describe("consent-cache", () => {
     startConsentRefresh();
     await stopConsentRefresh();
     // A fresh start after stop performs another immediate refresh.
-    mockClient = makeClient(makeConsent({ shareAnalytics: true }));
+    mockClient = makeClient(makeConsent({ shareDiagnostics: true }));
     startConsentRefresh();
     await new Promise((resolve) => setTimeout(resolve, 0));
-    expect(getRawShareAnalytics()).toBe(true);
-  });
-
-  // share_diagnostics tracks the same refresh as share_analytics; the
-  // client's diagnostics consent check re-reads it per report so a revocation is
-  // honored within a cycle.
-  test("diagnostics reads false at boot (unknown collapses to false)", () => {
-    expect(getCachedShareDiagnostics()).toBe(false);
-  });
-
-  test("diagnostics becomes true after a fetch reporting shareDiagnostics: true", async () => {
-    mockClient = makeClient(makeConsent({ shareDiagnostics: true }));
-    await refreshConsentCache();
     expect(getCachedShareDiagnostics()).toBe(true);
   });
-
-  test("a later fetch reporting shareDiagnostics: false honors the revocation", async () => {
-    mockClient = makeClient(makeConsent({ shareDiagnostics: true }));
-    await refreshConsentCache();
-    expect(getCachedShareDiagnostics()).toBe(true);
-
-    mockClient = makeClient(makeConsent({ shareDiagnostics: false }));
-    await refreshConsentCache();
-    expect(getCachedShareDiagnostics()).toBe(false);
-  });
-
-  test("a null diagnostics fetch keeps the last known value", async () => {
-    mockClient = makeClient(makeConsent({ shareDiagnostics: true }));
-    await refreshConsentCache();
-    expect(getCachedShareDiagnostics()).toBe(true);
-
-    mockClient = makeClient(null);
-    await refreshConsentCache();
-    expect(getCachedShareDiagnostics()).toBe(true);
-  });
-
-  test("a missing client demotes a prior diagnostics opt-in", async () => {
-    __setCachedShareDiagnosticsForTest(true);
-    mockClient = null;
-    await refreshConsentCache();
-    expect(getCachedShareDiagnostics()).toBe(false);
-  });
-
-  test("a client without a resolvable assistant identity demotes diagnostics", async () => {
-    __setCachedShareDiagnosticsForTest(true);
-    mockClient = makeClient(makeConsent({ shareDiagnostics: true }), "");
-    await refreshConsentCache();
-    expect(getCachedShareDiagnostics()).toBe(false);
-  });
-
-  test("caches the accepted diagnostics-consent version from a successful fetch", async () => {
-    mockClient = makeClient(
-      makeConsent({
-        shareDiagnostics: true,
-        shareDiagnosticsAcceptedVersion: "2026-06-18",
-      }),
-    );
-    await refreshConsentCache();
-    expect(getCachedShareDiagnosticsVersion()).toBe("2026-06-18");
-  });
-
-  test("a missing client clears a prior cached diagnostics version", async () => {
-    __setCachedShareDiagnosticsVersionForTest("2026-06-18");
-    mockClient = null;
-    await refreshConsentCache();
-    expect(getCachedShareDiagnosticsVersion()).toBe("");
-  });
-
-  test("a client without a resolvable assistant identity clears the diagnostics version", async () => {
-    __setCachedShareDiagnosticsVersionForTest("2026-06-18");
-    mockClient = makeClient(
-      makeConsent({
-        shareDiagnostics: true,
-        shareDiagnosticsAcceptedVersion: "2026-06-18",
-      }),
-      "",
-    );
-    await refreshConsentCache();
-    expect(getCachedShareDiagnosticsVersion()).toBe("");
-  });
-
-  test("a null fetch keeps the last known diagnostics version", async () => {
-    mockClient = makeClient(
-      makeConsent({
-        shareDiagnostics: true,
-        shareDiagnosticsAcceptedVersion: "2026-06-18",
-      }),
-    );
-    await refreshConsentCache();
-    expect(getCachedShareDiagnosticsVersion()).toBe("2026-06-18");
-
-    mockClient = makeClient(null);
-    await refreshConsentCache();
-    expect(getCachedShareDiagnosticsVersion()).toBe("2026-06-18");
-  });
-
-  test("diagnostics accessor collapses unknown to false; raw analytics exposes the tri-state", async () => {
-    // Refresh once so the module's legacy opt-out marker reflects the
-    // beforeEach config (the marker is only re-read during a refresh).
-    mockClient = null;
-    await refreshConsentCache();
-
-    for (const state of [true, false, "unknown"] as const) {
-      __setCachedShareAnalyticsForTest(state);
-      __setCachedShareDiagnosticsForTest(state);
-      expect(getRawShareAnalytics()).toBe(state);
-      expect(getCachedShareDiagnostics()).toBe(state === true);
-    }
-  });
-
-  test("legacy opt-out marker folds the raw analytics state to false", async () => {
-    setConfig("legacyTelemetryOptOut", true);
-    mockClient = null;
-    await refreshConsentCache();
-    expect(getRawShareAnalytics()).toBe(false);
-  });
 });

package/src/cloud/consent-cache.ts

@@ -1,38 +1,27 @@
 /**
- * In-memory cache of the cloud owner's telemetry consent.
+ * In-memory cache of the cloud owner's diagnostics consent.
  *
- * Three values are cached, all refreshed from the same owner-consent fetch:
- *  - `share_analytics`: gates usage telemetry collection.
- *  - `share_diagnostics`: gates crash diagnostics (read by the client's
- *    client diagnostics reporting),
- *    and composes the per-turn trace-collection gate alongside the accepted
- *    consent version.
- *  - `share_diagnostics_accepted_version`: the consent version the owner
- *    accepted; the disclosing-version half of the trace-collection gate (see
- *    telemetry/trace-collection-policy.ts).
+ * One value is cached from the owner-consent fetch:
+ *  - `share_diagnostics`: gates crash diagnostics (read by the client
+ *    diagnostics reporting).
  *
- * Hot-path gates (record-time telemetry writes, the client diagnostics
- * consent check) need a
- * synchronous, I/O-free read, so this module owns the values and refreshes them
- * periodically in the background. Consent is opt-out — an owner who never made
- * an explicit choice reports as consented (the client maps a never-chose wire
- * value to `true`).
+ * Hot-path gates (the client diagnostics consent check) need a synchronous,
+ * I/O-free read, so this module owns the value and refreshes it periodically
+ * in the background. Consent is opt-out — an owner who never made an explicit
+ * choice reports as consented (the client maps a never-chose wire value to
+ * `true`).
  *
- * The consent values are tri-state (`ConsentState`): `true`/`false` are
- * confirmed states from a successful platform fetch; `"unknown"` means no
- * confirmed state exists — boot before the first refresh, no platform session,
- * or no resolvable owner identity. A transient fetch failure keeps the
- * previous value so a known opt-in is not flipped mid-session. Analytics
- * exposes only the raw tri-state accessor (gates drop solely on a confirmed
- * opt-out); the diagnostics boolean accessors collapse `"unknown"` to `false`
- * — diagnostics gates are deliberately fail-closed, so no raw diagnostics
- * accessor exists.
+ * The cached value is tri-state: `true`/`false` are confirmed states from a
+ * successful cloud fetch; `"unknown"` means no confirmed state exists — boot
+ * before the first refresh, no cloud session, or no resolvable owner
+ * identity. A transient fetch failure keeps the previous value so a known
+ * opt-in is not flipped mid-session. The diagnostics accessor collapses
+ * `"unknown"` to `false` — diagnostics gates are deliberately fail-closed, so
+ * no raw diagnostics accessor exists.
  */
 
-import { getConfigReadOnly } from "../config/loader.js";
 import { getLogger } from "../util/logger.js";
 import { CadetCloudClient } from "./client.js";
-import { areCloudFeaturesEnabled } from "./feature-gate.js";
 
 const log = getLogger("consent-cache");
 
@@ -41,39 +30,9 @@ const REFRESH_INTERVAL_MS = 5 * 60_000; // refresh consent every 5 min
 /** Cached consent value: a confirmed boolean, or `"unknown"` when no confirmed state exists. */
 export type ConsentState = boolean | "unknown";
 
-let cachedShareAnalytics: ConsentState = "unknown"; // no confirmed state until first success
 let cachedShareDiagnostics: ConsentState = "unknown"; // no confirmed state until first success
-let cachedShareDiagnosticsVersion = ""; // "" fails the trace disclosure gate
-// Fail-closed marker for a workspace that locally opted out of usage data
-// before telemetry moved to platform `share_analytics` consent (migration 106).
-// While set, telemetry stays off regardless of platform consent. Cleared by a
-// future cross-repo reconciliation once the cloud exposes an explicit
-// re-consent signal; not auto-cleared here. Read live from config (an
-// in-memory cached read, safe on the hot path): a boot-time default would
-// leave the record-time gates open between daemon start and the first
-// consent refresh, exactly the window unknown-consent recording now keeps
-// events flowing in.
-function isLegacyOptedOut(): boolean {
-  try {
-    return getConfigReadOnly().legacyTelemetryOptOut === true;
-  } catch {
-    // Config not yet loaded — no marker to honor yet.
-    return false;
-  }
-}
 let refreshTimer: ReturnType<typeof setInterval> | null = null;
 
-/**
- * Raw tri-state `share_analytics` consent — the ONLY analytics accessor:
- * every gate distinguishes a confirmed opt-out (`false`, the only state that
- * drops or purges) from a not-yet-known one. The legacy fail-closed opt-out
- * marker folds into `false` — a workspace-level opt-out is a confirmed
- * opt-out, not an unknown. Never does I/O; hot-path safe.
- */
-export function getRawShareAnalytics(): ConsentState {
-  return isLegacyOptedOut() ? false : cachedShareAnalytics;
-}
-
 /**
  * Synchronous hot-path accessor for the `share_diagnostics` consent (read
  * by the client's diagnostics consent check). Never does I/O; returns `false` unless a successful
@@ -85,15 +44,6 @@ export function getCachedShareDiagnostics(): boolean {
   return cachedShareDiagnostics === true;
 }
 
-/**
- * Synchronous hot-path accessor for the owner's accepted diagnostics-consent
- * version ("YYYY-MM-DD", or "" until a successful refresh / if never accepted).
- * The disclosing-version half of the per-turn trace-collection gate.
- */
-export function getCachedShareDiagnosticsVersion(): string {
-  return cachedShareDiagnosticsVersion;
-}
-
 /**
  * Refresh the cached consent from the cloud.
  *
@@ -106,17 +56,6 @@ export function getCachedShareDiagnosticsVersion(): string {
  * flipped off mid-session.
  */
 export async function refreshConsentCache(): Promise<void> {
-  // Platform features disabled is a PERMANENT condition (config-level), not a
-  // cold-cache transient: telemetry can never ship, so confirmed-off keeps the
-  // record-time gates closed and the outbox from accumulating rows that no
-  // flush will ever drain.
-  if (!areCloudFeaturesEnabled()) {
-    setCachedShareAnalytics(false);
-    setCachedShareDiagnostics(false);
-    setCachedShareDiagnosticsVersion("");
-    return;
-  }
-
   const client = await CadetCloudClient.create();
   if (!client) {
     resetConsentToUnknown();
@@ -131,26 +70,12 @@ export async function refreshConsentCache(): Promise<void> {
 
   const consent = await client.getOwnerConsent();
   if (consent) {
-    setCachedShareAnalytics(consent.shareAnalytics);
     setCachedShareDiagnostics(consent.shareDiagnostics);
-    setCachedShareDiagnosticsVersion(consent.shareDiagnosticsAcceptedVersion);
   }
 }
 
 function resetConsentToUnknown(): void {
-  setCachedShareAnalytics("unknown");
   setCachedShareDiagnostics("unknown");
-  setCachedShareDiagnosticsVersion("");
-}
-
-function setCachedShareAnalytics(value: ConsentState): void {
-  if (value !== cachedShareAnalytics) {
-    log.debug(
-      { from: cachedShareAnalytics, to: value },
-      "share_analytics consent changed",
-    );
-    cachedShareAnalytics = value;
-  }
 }
 
 function setCachedShareDiagnostics(value: ConsentState): void {
@@ -163,16 +88,6 @@ function setCachedShareDiagnostics(value: ConsentState): void {
   }
 }
 
-function setCachedShareDiagnosticsVersion(value: string): void {
-  if (value !== cachedShareDiagnosticsVersion) {
-    log.debug(
-      { from: cachedShareDiagnosticsVersion, to: value },
-      "share_diagnostics_accepted_version changed",
-    );
-    cachedShareDiagnosticsVersion = value;
-  }
-}
-
 /**
  * Begin periodic consent refresh. Idempotent — a second call is a no-op while a
  * timer is already running. Runs one immediate refresh, then every 5 minutes.
@@ -200,17 +115,7 @@ export async function stopConsentRefresh(): Promise<void> {
   }
 }
 
-/** Test-only: override the cached analytics value without going through a refresh. */
-export function __setCachedShareAnalyticsForTest(value: ConsentState): void {
-  cachedShareAnalytics = value;
-}
-
 /** Test-only: override the cached diagnostics value without going through a refresh. */
 export function __setCachedShareDiagnosticsForTest(value: ConsentState): void {
   cachedShareDiagnostics = value;
 }
-
-/** Test-only: override the cached diagnostics-consent version directly. */
-export function __setCachedShareDiagnosticsVersionForTest(value: string): void {
-  cachedShareDiagnosticsVersion = value;
-}

package/src/cloud/sync-identity.ts

@@ -12,8 +12,8 @@
 import { existsSync, readFileSync } from "node:fs";
 
 import { parseIdentityFields } from "../daemon/handlers/identity.js";
+import { getWorkspacePromptPath } from "../util/layout.js";
 import { getLogger } from "../util/logger.js";
-import { getWorkspacePromptPath } from "../util/platform.js";
 import { createCloudPatchQueue } from "./cloud-patch-queue.js";
 
 const log = getLogger("sync-identity");

package/src/config/__tests__/chat-settings.test.ts

@@ -1,7 +1,7 @@
 import { readFileSync, writeFileSync } from "node:fs";
 import { describe, expect, test } from "bun:test";
 
-import { getWorkspaceConfigPath } from "../../util/platform.js";
+import { getWorkspaceConfigPath } from "../../util/layout.js";
 import { loadRawConfig, saveRawConfig } from "../loader.js";
 import { AssistantConfigSchema } from "../schema.js";
 import { AutoArchiveConfigSchema } from "../schemas/conversations.js";

package/src/config/__tests__/cloud-identity.test.ts

@@ -1,16 +1,19 @@
 import { afterEach, beforeEach, describe, expect, test } from "bun:test";
 
-import { useMemorySecureKeys } from "../../__tests__/helpers/secure-keys.js";
+import { useFaultableSecureKeyMap } from "../../__tests__/helpers/secure-keys.js";
+import { credentialKey } from "../../security/credential-key.js";
 import {
+  getCloudAssistantId,
   getCloudBaseUrl,
   setCloudAssistantId,
   setCloudOrganizationId,
   setCloudUserId,
 } from "../env.js";
 
-useMemorySecureKeys();
+const { setUnreachableKey } = useFaultableSecureKeyMap();
 const {
   _resetCloudIdentityEnsureForTests,
+  ensureCloudIdentityIds,
   fetchCloudIdentityIds,
   CLOUD_IDENTITY_VALIDATE_PATH,
   resolveCloudAssistantId,
@@ -306,3 +309,13 @@ describe("resolveCloudAssistantId", () => {
     expect(fetchCalls).toHaveLength(1);
   });
 });
+
+describe("ensureCloudIdentityIds", () => {
+  test("an unreachable credential store is non-fatal — identity stays unbound", async () => {
+    process.env.CADET_PLATFORM_URL = BASE_URL;
+    setUnreachableKey(credentialKey("cadet", "assistant_api_key"));
+
+    await expect(ensureCloudIdentityIds()).resolves.toBeUndefined();
+    expect(getCloudAssistantId()).toBe("");
+  });
+});

package/src/config/__tests__/default-plugin-skill-discovery.test.ts

@@ -19,7 +19,7 @@ import { join } from "node:path";
 import { afterEach, beforeEach, describe, expect, test } from "bun:test";
 
 import { getDefaultPluginSkillRoots } from "../../plugins/defaults/main.js";
-import { getWorkspacePluginsDir } from "../../util/platform.js";
+import { getWorkspacePluginsDir } from "../../util/layout.js";
 import {
   discoverDefaultPluginResidentSkills,
   discoverPluginResidentSkills,