@mycadet/assistant 0.12.9 → 0.12.10

package/src/util/disk-usage.ts

@@ -1,15 +1,6 @@
-import { execFile } from "node:child_process";
 import { existsSync, statfsSync } from "node:fs";
-import { promisify } from "node:util";
 
-import {
-  getIsCloud,
-  getIsContainerized,
-  getMinikubeStorageSize,
-} from "../config/env-registry.js";
-import { getWorkspaceDir } from "./platform.js";
-
-const execFileAsync = promisify(execFile);
+import { getWorkspaceDir } from "./layout.js";
 
 export interface DiskUsageInfo {
   path: string;
@@ -19,111 +10,10 @@ export interface DiskUsageInfo {
 }
 
 /**
- * Measure the on-disk usage of one or more directory paths using `du -sb`.
- * Returns the sum of all paths in bytes, or null on failure.
+ * Report the filesystem containing the workspace using filesystem counters.
+ * Docker named volumes and minikube hostPath volumes report the backing
+ * filesystem, including usage outside the workspace and its provisioned quota.
  */
-async function getDirectorySizeBytes(paths: string[]): Promise<number | null> {
-  try {
-    const existing = paths.filter((p) => existsSync(p));
-    if (existing.length === 0) {
-      return null;
-    }
-    const { stdout } = await execFileAsync("du", ["-sb", ...existing], {
-      timeout: 30_000,
-      windowsHide: true,
-    });
-    let total = 0;
-    for (const line of stdout.trim().split("\n")) {
-      const size = parseInt(line.split("\t")[0], 10);
-      if (!isNaN(size) && size > 0) {
-        total += size;
-      }
-    }
-    return total > 0 ? total : null;
-  } catch {
-    return null;
-  }
-}
-
-const DU_CACHE_TTL_MS = 60_000;
-// Caches the in-flight promise so concurrent callers share one `du` run.
-let duCacheValue: Promise<number | null> | null = null;
-let duCacheTime = 0;
-let duCachePaths: string | null = null;
-
-function getCachedDirectorySizeBytes(paths: string[]): Promise<number | null> {
-  const key = paths.join("\0");
-  const now = Date.now();
-  if (
-    duCacheValue !== null &&
-    duCachePaths === key &&
-    now - duCacheTime < DU_CACHE_TTL_MS
-  ) {
-    return duCacheValue;
-  }
-  duCacheValue = getDirectorySizeBytes(paths);
-  duCacheTime = now;
-  duCachePaths = key;
-  return duCacheValue;
-}
-
-export function __resetDiskUsageCacheForTests(): void {
-  duCacheValue = null;
-  duCacheTime = 0;
-  duCachePaths = null;
-}
-
-/**
- * How the workspace volume's capacity should be reported when statfsSync
- * cannot see the volume directly.
- *
- * - `fixed-cap`: minikube hostPath PVC — the PVC request is the hard
- *   capacity, so usage is measured with `du` and free space is whatever
- *   remains within the quota.
- * - `host-free`: local Docker named volume — the volume is backed by the
- *   host (or Colima VM) filesystem and can grow into its free space, so
- *   usage is measured with `du` and the effective capacity is current usage
- *   plus the host's remaining headroom.
- * - `none`: statfsSync already reports the volume accurately (bare metal, or
- *   a cloud-managed instance on a CSI-backed PVC), so use it directly.
- */
-type WorkspaceVolumeReporting =
-  | { kind: "none" }
-  | { kind: "fixed-cap"; totalBytes: number }
-  | { kind: "host-free" };
-
-/**
- * Decide how to report the workspace volume's capacity. Both minikube
- * hostPath PVCs and local Docker named volumes are backed by the host
- * filesystem, so statfsSync reports the host's entire disk rather than the
- * workspace volume — in both cases we measure actual usage with `du` instead.
- */
-function classifyWorkspaceVolume(
-  fsTotalBytes: number,
-): WorkspaceVolumeReporting {
-  // Minikube mode: the cloud passes the PVC storage size so we can report
-  // accurate capacity. Detect the hostPath case by comparing filesystem size
-  // against the PVC size — if the filesystem is larger, statfsSync is seeing
-  // the host disk and we should measure the directory instead.
-  const storageSizeRaw = getMinikubeStorageSize();
-  if (storageSizeRaw) {
-    const pvcTotalBytes = parseK8sMemoryBytes(storageSizeRaw);
-    if (pvcTotalBytes !== null && fsTotalBytes > pvcTotalBytes * 1.1) {
-      return { kind: "fixed-cap", totalBytes: pvcTotalBytes };
-    }
-    return { kind: "none" };
-  }
-
-  // Local Docker hatch: the workspace is a Docker named volume backed by the
-  // host filesystem. Platform-managed remote instances run on CSI-backed PVCs
-  // where statfsSync already reports the volume, so they are excluded.
-  if (getIsContainerized() && !getIsCloud()) {
-    return { kind: "host-free" };
-  }
-
-  return { kind: "none" };
-}
-
 export async function getDiskUsageInfo(): Promise<DiskUsageInfo | null> {
   try {
     const wsDir = getWorkspaceDir();
@@ -134,31 +24,6 @@ export async function getDiskUsageInfo(): Promise<DiskUsageInfo | null> {
     const bytesToMb = (b: number) =>
       Math.round((b / (1024 * 1024)) * 100) / 100;
 
-    const reporting = classifyWorkspaceVolume(fsTotalBytes);
-    if (reporting.kind !== "none") {
-      const volumePaths = [diskPath];
-      if (diskPath !== "/data" && existsSync("/data")) {
-        volumePaths.push("/data");
-      }
-      const usedBytes = await getCachedDirectorySizeBytes(volumePaths);
-      if (usedBytes !== null) {
-        const totalBytes =
-          reporting.kind === "fixed-cap"
-            ? reporting.totalBytes
-            : usedBytes + fsFreeBytes;
-        const freeBytes =
-          reporting.kind === "fixed-cap"
-            ? Math.max(0, reporting.totalBytes - usedBytes)
-            : fsFreeBytes;
-        return {
-          path: diskPath,
-          totalMb: bytesToMb(totalBytes),
-          usedMb: bytesToMb(usedBytes),
-          freeMb: bytesToMb(freeBytes),
-        };
-      }
-    }
-
     return {
       path: diskPath,
       totalMb: bytesToMb(fsTotalBytes),

package/src/util/layout.ts

@@ -3,9 +3,9 @@
  * writes, all rooted at the workspace ($CADET_WORKSPACE_DIR) and its
  * internal data directory.
  *
- * Extracted from `util/platform.ts` — these are directory-layout concerns,
- * not platform-detection concerns. `platform.ts` re-exports this module for
- * backward compatibility; new code should import from here directly.
+ * Extracted from `util/platform.ts` (now deleted) — these are
+ * directory-layout concerns, not platform-detection concerns; the OS
+ * detection and PATH helpers live in `./os.js`.
  */
 
 import { chmodSync, existsSync, mkdirSync } from "node:fs";

package/src/util/logger.ts

@@ -15,8 +15,8 @@ import {
   getDebugStdoutLogs,
   getIsContainerized,
 } from "../config/env-registry.js";
+import { getLogsDir } from "./layout.js";
 import { logSerializers } from "./log-redact.js";
-import { getLogsDir } from "./platform.js";
 
 const loadModule = createRequire(import.meta.url);
 let bundledPino: typeof import("pino") | undefined;

package/src/util/logs-db-path.ts

@@ -1,6 +1,6 @@
 import { join } from "node:path";
 
-import { getDataDir } from "./platform.js";
+import { getDataDir } from "./layout.js";
 
 /**
  * Path to the dedicated SQLite file that houses heavy append-only tables

package/src/util/memory-db-path.ts

@@ -1,6 +1,6 @@
 import { join } from "node:path";
 
-import { getDataDir } from "./platform.js";
+import { getDataDir } from "./layout.js";
 
 /**
  * Path to the dedicated SQLite file that houses the high-churn memory

package/src/util/{platform.ts → os.ts}

@@ -1,17 +1,15 @@
 /**
- * Platform detection and environment-shaping helpers.
+ * Platform detection and host-environment shaping helpers.
  *
- * Directory-layout helpers (every canonical path under the workspace and
- * its data dir) live in `util/layout.ts` — they were never platform
- * concerns. This module re-exports that module for backward compatibility;
- * new code should import layout helpers from `./layout.js` directly.
+ * OS detection (`isMacOS`/`isLinux`/`isWindows`/`getPlatformName`), the
+ * per-user application-data root, and the PATH-shaping helpers
+ * daemon-spawned tools rely on. Directory-layout helpers (every canonical
+ * path under the workspace and its data dir) live in `./layout.js`.
  */
 
 import { homedir } from "node:os";
 import { delimiter, join } from "node:path";
 
-export * from "./layout.js";
-
 export function isMacOS(): boolean {
   return process.platform === "darwin";
 }
@@ -88,26 +86,3 @@ export function addToPathEnv(
 export function getPlatformName(): string {
   return process.platform;
 }
-
-/**
- * Normalize an assistant ID to its canonical form for DB operations.
- *
- * The system uses "self" as the canonical single-tenant identifier
- * (see migration 007-assistant-id-to-self). However, the desktop UI
- * sends the real assistant ID (e.g., "cadet-true-eel") while the
- * inbound call path resolves phone numbers to config keys (typically
- * "self"). This function maps the current assistant's ID to "self"
- * so both sides use a consistent DB key.
- */
-export function normalizeAssistantId(assistantId: string): string {
-  if (assistantId === "self") {
-    return "self";
-  }
-
-  const ownName = process.env.CADET_ASSISTANT_NAME;
-  if (ownName && assistantId === ownName) {
-    return "self";
-  }
-
-  return assistantId;
-}

package/src/util/process-tree.ts

@@ -129,6 +129,25 @@ export function deriveName(command: string): string {
   return argv0;
 }
 
+/**
+ * Display cap for command-derived labels in `ps` output. `deriveName` can
+ * surface a whole argument list when an interpreter runs without a script
+ * (`bun x -y @scope/server --stdio …`), and a super-long label pads every
+ * row and stretches the whole table. The cap keeps the head (the interpreter
+ * or binary) and the tail (the identifying end), collapsing the middle to
+ * one ellipsis.
+ */
+export const MAX_COMMAND_LABEL_LENGTH = 60;
+
+export function truncateCommandLabel(label: string): string {
+  if (label.length <= MAX_COMMAND_LABEL_LENGTH) {
+    return label;
+  }
+  const head = 16;
+  const tail = MAX_COMMAND_LABEL_LENGTH - head - 1; // 1 char for the ellipsis
+  return `${label.slice(0, head)}…${label.slice(-tail)}`;
+}
+
 /**
  * Redacted command descriptor for a live PID from `/proc/<pid>/cmdline`, or
  * null when the process is gone or its `/proc` entry is unreadable. Kernel

package/src/util/sqlite3-runtime.ts

@@ -24,7 +24,7 @@ import { existsSync } from "node:fs";
 import { homedir } from "node:os";
 import { join } from "node:path";
 
-import { isWindows } from "./platform.js";
+import { isWindows } from "./os.js";
 
 let cachedSqlite3Path: string | undefined | null;
 

package/src/util/telemetry-db-path.ts

@@ -1,6 +1,6 @@
 import { join } from "node:path";
 
-import { getDataDir } from "./platform.js";
+import { getDataDir } from "./layout.js";
 
 /**
  * Path to the dedicated SQLite file that houses the telemetry-only tables:

package/src/watcher/__tests__/engine.test.ts

@@ -123,21 +123,6 @@ mock.module("../../runtime/background-job-runner.js", () => ({
   },
 }));
 
-const inventoryCalls: number[] = [];
-const llmProcessedCalls: Array<{
-  providerId: string;
-  conversationId: string;
-}> = [];
-
-mock.module("../telemetry.js", () => ({
-  recordWatcherInventoryIfDue: (now: number) => {
-    inventoryCalls.push(now);
-  },
-  recordWatcherLlmProcessed: (providerId: string, conversationId: string) => {
-    llmProcessedCalls.push({ providerId, conversationId });
-  },
-}));
-
 // Import after mocks are in place.
 const { runWatchersOnce } = await import("../engine.js");
 
@@ -189,8 +174,6 @@ beforeEach(() => {
   setConvCalls.length = 0;
   dispositionCalls.length = 0;
   runJobCalls.length = 0;
-  inventoryCalls.length = 0;
-  llmProcessedCalls.length = 0;
   fakeProviderSource = "webhook";
   insertedEvents.length = 0;
   fetchedItems = [];
@@ -296,9 +279,6 @@ describe("runWatchersOnce — Phase 2 runBackgroundJob integration", () => {
     expect(setConvCalls).toEqual([
       { watcherId: "watcher-1", conversationId: "conv-success" },
     ]);
-    expect(llmProcessedCalls).toEqual([
-      { providerId: "linear", conversationId: "conv-success" },
-    ]);
     expect(dispositionCalls).toHaveLength(2);
     for (const call of dispositionCalls) {
       expect(call.disposition).toBe("silent");
@@ -344,7 +324,6 @@ describe("runWatchersOnce — Phase 2 runBackgroundJob integration", () => {
     // which would clobber a valid prior conversation id in the DB.
     expect(setConvCalls).toEqual([]);
     // No conversation was bootstrapped, so no usage breadcrumb either.
-    expect(llmProcessedCalls).toEqual([]);
     // Failure path still updates event dispositions.
     expect(dispositionCalls).toHaveLength(1);
     expect(dispositionCalls[0].disposition).toBe("error");
@@ -358,8 +337,6 @@ describe("runWatchersOnce — Phase 2 runBackgroundJob integration", () => {
 
     expect(runJobCalls).toHaveLength(0);
     expect(setConvCalls).toHaveLength(0);
-    // Inventory telemetry runs on every tick regardless of pending work.
-    expect(inventoryCalls).toHaveLength(1);
   });
 
   test("malicious payload reaches the runner only inside assistant-role sandwich.content", async () => {

package/src/watcher/engine.ts

@@ -25,10 +25,6 @@ import {
 } from "./constants.js";
 import { capPayloadForRender, capPayloadForStorage } from "./payload-bounds.js";
 import { getWatcherProvider } from "./provider-registry.js";
-import {
-  recordWatcherInventoryIfDue,
-  recordWatcherLlmProcessed,
-} from "./telemetry.js";
 import {
   claimDueWatchers,
   completeWatcherPoll,
@@ -229,8 +225,6 @@ export async function runWatchersOnce(
   const now = Date.now();
   let processed = 0;
 
-  recordWatcherInventoryIfDue(now);
-
   // ── Phase 1: Poll providers for new events ──────────────────────
   const claimed = claimDueWatchers(now);
   for (const watcher of claimed) {
@@ -473,7 +467,6 @@ export async function runWatchersOnce(
     // is empty) — otherwise we'd overwrite a valid prior id with "".
     if (result.conversationId !== "") {
       setWatcherConversationId(watcher.id, result.conversationId);
-      recordWatcherLlmProcessed(watcher.providerId, result.conversationId);
     }
 
     if (result.ok) {

package/src/windows-compiled-cli.ts

@@ -5,8 +5,6 @@ import * as pluginInstallPlatform from "./cli/lib/install-from-cloud.js";
 import * as pluginInstallGitHub from "./cli/lib/install-from-github.js";
 import * as pluginInstalled from "./cli/lib/list-installed-plugins.js";
 import * as pluginCatalogCache from "./cli/lib/plugin-catalog-cache.js";
-import * as pluginCatalogLocal from "./cli/lib/plugin-catalog-local.js";
-import * as pluginPinHistory from "./cli/lib/plugin-pin-history.js";
 import * as pluginSurfaces from "./cli/lib/plugin-surfaces.js";
 import * as pluginSearch from "./cli/lib/search-plugins.js";
 import * as pluginUninstall from "./cli/lib/uninstall-plugin.js";
@@ -18,13 +16,11 @@ setBundledCliModules({
   configEnv,
   providerSecretCatalog,
   pluginCatalogCache,
-  pluginCatalogLocal,
   pluginDiff,
   pluginInspect,
   pluginInstallGitHub,
   pluginInstallPlatform,
   pluginInstalled,
-  pluginPinHistory,
   pluginSearch,
   pluginSurfaces,
   pluginUninstall,

package/src/windows-compiled-worker-entry.ts

@@ -18,12 +18,6 @@ switch (worker) {
     await import("./embedded/plugin-api.js");
     await import("./routes/worker.js");
     break;
-  case "db-integrity": {
-    const { runIntegrityCheck } =
-      await import("./monitoring/db-integrity-check.js");
-    console.log(JSON.stringify(runIntegrityCheck(process.argv[3] ?? "")));
-    break;
-  }
   default:
     throw new Error(`Unknown Windows worker entry: ${worker ?? "missing"}`);
 }

package/src/workflows/leaf-runner.test.ts

@@ -136,7 +136,7 @@ import { initializeDb } from "../persistence/db-init.js";
 import { conversations } from "../persistence/schema/index.js";
 import { setBroadcastOverrideForTesting } from "../runtime/assistant-event-hub.js";
 import type { Tool, ToolContext, ToolExecutionResult } from "../tools/types.js";
-import { getWorkspaceDir } from "../util/platform.js";
+import { getWorkspaceDir } from "../util/layout.js";
 import { runLeaf, WorkflowUnknownProfileError } from "./leaf-runner.js";
 
 await initializeDb();

package/src/workflows/leaf-runner.ts

@@ -58,8 +58,8 @@ import {
 import type { Message, ToolDefinition } from "../providers/types.js";
 import { broadcastMessage } from "../runtime/assistant-event-hub.js";
 import type { Tool, ToolContext, ToolExecutionResult } from "../tools/types.js";
+import { getWorkspaceDir } from "../util/layout.js";
 import { getLogger } from "../util/logger.js";
-import { getWorkspaceDir } from "../util/platform.js";
 
 const log = getLogger("workflow-leaf-runner");
 

package/src/workflows/library.ts

@@ -22,8 +22,8 @@
 import { existsSync, readdirSync, readFileSync } from "node:fs";
 import { join } from "node:path";
 
+import { getWorkspaceWorkflowsDir } from "../util/layout.js";
 import { getLogger } from "../util/logger.js";
-import { getWorkspaceWorkflowsDir } from "../util/platform.js";
 import { extractWorkflowMeta, type WorkflowMeta } from "./engine.js";
 
 const log = getLogger("workflow-library");

package/src/workspace/adaptive-thinking-repair.ts

@@ -13,22 +13,14 @@ import { getCatalogProviderForModel } from "../providers/model-catalog.js";
 // up on every boot because the seeder overwrites cloud profiles. On-platform
 // instances preserve existing profiles (the cloud overlay is authoritative),
 // so instances that were hatched before thinking was enabled in the templates
-// are stuck with thinking disabled or absent.
-//
-// Workspace migration 097 patches the on-disk config once, but it runs before
-// mergeDefaultWorkspaceConfig() which can overwrite the fix with overlay
-// profiles that have thinking disabled or absent. lifecycle.ts calls this
-// repair again after the overlay merge + profile seeding so the fix sticks.
-// The migration keeps its own frozen copy of this logic (migration files are
-// self-contained snapshots and must not be imported from).
+// are stuck with thinking disabled or absent. lifecycle.ts calls this repair
+// after the overlay merge + profile seeding so the fix sticks.
 //
 // The repair patches both profiles, adding thinking: { enabled: true,
 // streamThinking: true } where it's missing or explicitly disabled. It skips
 // profiles that:
 //   - Don't exist (no profile to patch)
 //   - Already have thinking enabled (idempotent)
-//   - Are source: "user" (user-created profiles are untouched)
-//   - Have a non-managed, non-absent source (unknown origin)
 //   - Resolve to a non-Anthropic provider (adaptive thinking is
 //     Anthropic-specific). Effective provider is the profile's explicit
 //     `provider`; otherwise the provider implied by a known catalog `model`
@@ -93,20 +85,9 @@ export function repairAdaptiveThinkingOnCloudProfiles(
       continue;
     }
 
-    // Only patch managed Anthropic profiles.
-    // Legacy profiles created before the `source` metadata field was introduced
-    // have source=undefined. Treat these as managed when the profile name is one
-    // of the canonical managed names (which TARGET_PROFILES already guarantees)
-    // and the effective provider is Anthropic. Effective provider is the
-    // explicit `provider`, else the provider implied by a known catalog
-    // `model`, else the inherited llm.default.provider. Explicit
-    // `source: "user"` profiles are always skipped.
-    if (profile.source === "user") {
-      continue;
-    }
-    if (profile.source !== undefined && profile.source !== "managed") {
-      continue;
-    }
+    // Only patch managed-name entries resolving to Anthropic. Effective
+    // provider is the explicit `provider`, else the provider implied by a
+    // known catalog `model`, else the inherited llm.default.provider.
     const effectiveProvider = resolveEffectiveProvider(
       profile,
       defaultProvider,

package/src/workspace/byok-default-profile-ensure.ts

@@ -78,22 +78,20 @@ const HATCH_ERA_PROFILE_KEYS = [
 type HatchEraProfileKey = (typeof HATCH_ERA_PROFILE_KEYS)[number];
 
 /**
- * The exact stub shapes BYOK hatching left on each default key: thin (only
- * the workspace-owned overlay fields), `source: "managed"`, the frozen
- * per-key label, and a `status` of `"disabled"` (seeded at hatch, #30367),
- * `"active"` (re-enabled through the guard; safe to delete because the bare
- * key resolves active post-conversion), or no `status` key at all (installs
- * that already existed when #30367 landed got only the label rewrite;
- * migration 126 thinned those bodies to `{ source, label }`). Deletion
- * requires the full shape: a thin managed entry differing in any other way
- * (a guard-side edit on the bare key, or a non-frozen label or status
- * carried off a retired copy by this pass) is user overlay state and stays.
- * The carry arm below never writes the frozen label, so a match is always
- * hatch-written modulo the status toggle. A managed-source entry with any
- * other key (a cloud overlay body) is not a stub and is likewise left
- * alone.
+ * The exact stub shapes hatching leaves on each default key: thin (only
+ * the cadet-provider marker plus workspace-owned overlay fields), the
+ * frozen per-key label, and a `status` of `"disabled"` (seeded at hatch,
+ * #30367), `"active"` (re-enabled through the guard; safe to delete because
+ * the bare key resolves active post-conversion), or no `status` key at all
+ * (label-only rewrites). Deletion requires the full shape: a thin managed
+ * entry differing in any other way (a guard-side edit on the bare key, or a
+ * non-frozen label or status carried off a retired copy by this pass) is
+ * user overlay state and stays. The carry arm below never writes the frozen
+ * label, so a match is always hatch-written modulo the status toggle. A
+ * cadet-provider entry with any other key (a cloud overlay body) is not a
+ * stub and is likewise left alone.
  */
-const STUB_ONLY_KEYS = new Set(["source", "status", "label", "thinking"]);
+const STUB_ONLY_KEYS = new Set(["provider", "status", "label", "thinking"]);
 const HATCH_STUB_LABELS: Record<HatchEraProfileKey, string> = {
   balanced: "Balanced (Managed)",
   "quality-optimized": "Quality (Managed)",
@@ -116,7 +114,7 @@ function isHatchStub(
   entry: Record<string, unknown>,
 ): boolean {
   return (
-    entry.source === "managed" &&
+    entry.provider === "cadet" &&
     Object.keys(entry).every((k) => STUB_ONLY_KEYS.has(k)) &&
     (!("status" in entry) ||
       entry.status === "disabled" ||
@@ -332,7 +330,7 @@ export function ensureByokDefaultProfiles(workspaceDir: string): void {
     const overlay = userOverlayState(entry, key);
     delete profiles[name];
     if (overlay !== null && readObject(profiles[key]) === null) {
-      const stub: Record<string, unknown> = { source: "managed", ...overlay };
+      const stub: Record<string, unknown> = { provider: "cadet", ...overlay };
       // A carried label that reproduces the hatch-stub shape is
       // indistinguishable from a genuine hatch stub and would be deleted by
       // the stub arm on the next boot, so the colliding label is never
@@ -370,7 +368,7 @@ export function ensureByokDefaultProfiles(workspaceDir: string): void {
   repairProfileSelections(llm, profiles, blob, carriedDisables);
 
   writeFileSync(configPath, JSON.stringify(config, null, 2) + "\n");
-  // The lifecycle call site runs before the first loadConfig() of this boot;
+  // The lifecycle call site runs before the first getConfig() of this boot;
   // this guards callers that read config earlier (and future reordering).
   invalidateConfigCache();
 }
@@ -413,13 +411,9 @@ function isKnownUneditedBody(
   ) {
     return false;
   }
-  // Completion skips managed-source bodies, so a copy from the era whose
-  // templates wrote `source: "managed"` (#29755 to #29768, 2026-05-05) is
-  // compared as if user-source to keep both sides normalized identically.
   const normalizedEntry: Record<string, unknown> = {
     ...entry,
     provider: copyProvider,
-    ...(entry.source === "managed" ? { source: "user" } : {}),
   };
   // The conventional personal binding is machinery-written (hatch stamps,
   // completion re-stamps); normalize it away. Any other binding is user
@@ -485,8 +479,6 @@ function uniformCopyProvider(profiles: Record<string, unknown>): string | null {
  *   retiring the copy cannot switch keys. Any other connection value is a
  *   user edit and never matches.
  *
- * The final hatch-written deviation, `source: "managed"` from the earliest
- * templates, is handled by the caller's source normalization.
  */
 function hatchBodyVariants(
   known: Record<string, unknown>,
@@ -653,9 +645,15 @@ function repairProfileSelections(
   const advisor = llm.advisorProfile;
   const advisorEntry =
     typeof advisor === "string" ? effectiveEntry(advisor) : undefined;
+  // The workspace view decides ownership: a cadet-provider stub (or an
+  // absent entry) is a managed default the write governs; a non-cadet
+  // entry is a user shadow whose disable is user intent and stays.
+  const advisorWorkspace =
+    typeof advisor === "string" ? readObject(profiles[advisor]) : null;
   const advisorUnusable =
     advisorEntry === undefined ||
-    (advisorEntry.source === "managed" && advisorEntry.status === "disabled");
+    (advisorEntry.status === "disabled" &&
+      (advisorWorkspace === null || advisorWorkspace.provider === "cadet"));
   if (advisorUnusable) {
     // A default key whose surviving workspace entry is a disabled managed
     // stub still dispatches the pure catalog body (`providerAwareEntry` in
@@ -678,7 +676,7 @@ function repairProfileSelections(
       const workspace = readObject(profiles[key]);
       return (
         workspace !== null &&
-        workspace.source === "managed" &&
+        workspace.provider === "cadet" &&
         resolveDefaultProfileForProvider(undefined, key, defaultBlob)
           ?.status !== "disabled"
       );

package/src/workspace/custom-profile-ensure.ts

@@ -23,7 +23,7 @@ const log = getLogger("custom-profile-ensure");
 // construction. Running
 // unconditionally each boot also covers configs restored from backups
 // and entries injected after the migration registry checkpoints — and it
-// completes before the first `loadConfig()`, so no resolution ever sees a
+// completes before the first `getConfig()`, so no resolution ever sees a
 // partial custom profile.
 //
 // Idempotent and write-avoidant: entries that are already complete (and mix
@@ -87,7 +87,7 @@ export function ensureCompleteCustomProfiles(workspaceDir: string): void {
     return;
   }
   writeFileSync(configPath, JSON.stringify(config, null, 2) + "\n");
-  // The lifecycle call site runs before the first loadConfig() of this boot;
+  // The lifecycle call site runs before the first getConfig() of this boot;
   // this guards callers that read config earlier (and future reordering).
   invalidateConfigCache();
 }

package/src/workspace/git-service.ts

@@ -16,7 +16,7 @@ import { trackDaemonActivity } from "../daemon/activity-trail.js";
 import { isFileUnheld } from "../util/file-use.js";
 import { getLogger } from "../util/logger.js";
 import { Mutex } from "../util/mutex.js";
-import { addToPathEnv, getExtraToolPathDirs } from "../util/platform.js";
+import { addToPathEnv, getExtraToolPathDirs } from "../util/os.js";
 import { PromiseGuard } from "../util/promise-guard.js";
 import {
   collectDirtyPathsFromPorcelain,