@mycadet/cli 0.12.7 → 0.12.9-dev.202610131452.9acab64

package/src/__tests__/wake.test.ts

@@ -20,10 +20,11 @@ import * as httpClient from "../lib/http-client.js";
 import * as ingressConfig from "../lib/ingress-config.js";
 import * as local from "../lib/local.js";
 import * as nginxIngress from "../lib/nginx-ingress.js";
-import * as ngrok from "../lib/ngrok.js";
+import * as ngrok from "../lib/tunnels/ngrok.js";
 import * as processLib from "../lib/process.js";
 import * as portAllocator from "../lib/port-allocator.js";
 import type { AssistantEntry } from "../lib/assistant-config.js";
+import { makeGuardianTokenData } from "./helpers/guardian-token.js";
 
 const realAssistantConfig = { ...assistantConfig };
 const realDocker = { ...docker };
@@ -61,11 +62,15 @@ const dockerResourceNamesMock = mock<typeof docker.dockerResourceNames>(
   realDocker.dockerResourceNames,
 );
 const wakeContainersMock = mock<typeof docker.wakeContainers>(async () => {});
+const recreateDockerContainersMock = mock<typeof docker.recreateDockerContainers>(
+  async () => {},
+);
 
 mock.module("../lib/docker.js", () => ({
   ...realDocker,
   dockerResourceNames: dockerResourceNamesMock,
   wakeContainers: wakeContainersMock,
+  recreateDockerContainers: recreateDockerContainersMock,
 }));
 
 const seedGuardianTokenFromSiblingEnvMock = mock<
@@ -73,18 +78,14 @@ const seedGuardianTokenFromSiblingEnvMock = mock<
 >(() => false);
 // Default: a token exists, so the re-provision recovery path is skipped. Tests
 // that exercise recovery override loadGuardianToken to return null.
-const loadGuardianTokenMock = mock<typeof guardianToken.loadGuardianToken>(
-  () =>
-    ({ accessToken: "existing" }) as ReturnType<
-      typeof guardianToken.loadGuardianToken
-    >,
+const loadGuardianTokenMock = mock<typeof guardianToken.loadGuardianToken>(() =>
+  makeGuardianTokenData({ accessToken: "existing" }),
 );
 const resetGuardianBootstrapMock = mock<
   typeof guardianToken.resetGuardianBootstrap
 >(async () => {});
 const leaseGuardianTokenMock = mock<typeof guardianToken.leaseGuardianToken>(
-  async () =>
-    ({}) as Awaited<ReturnType<typeof guardianToken.leaseGuardianToken>>,
+  async () => makeGuardianTokenData(),
 );
 
 mock.module("../lib/guardian-token.js", () => ({
@@ -156,7 +157,7 @@ const maybeStartNgrokTunnelMock = mock<typeof ngrok.maybeStartNgrokTunnel>(
   async () => null,
 );
 
-mock.module("../lib/ngrok", () => ({
+mock.module("../lib/tunnels/ngrok", () => ({
   ...realNgrok,
   maybeStartNgrokTunnel: maybeStartNgrokTunnelMock,
 }));
@@ -288,15 +289,13 @@ beforeEach(() => {
   seedGuardianTokenFromSiblingEnvMock.mockReset();
   seedGuardianTokenFromSiblingEnvMock.mockReturnValue(false);
   loadGuardianTokenMock.mockReset();
-  loadGuardianTokenMock.mockReturnValue({
-    accessToken: "existing",
-  } as ReturnType<typeof guardianToken.loadGuardianToken>);
+  loadGuardianTokenMock.mockReturnValue(
+    makeGuardianTokenData({ accessToken: "existing" }),
+  );
   resetGuardianBootstrapMock.mockReset();
   resetGuardianBootstrapMock.mockResolvedValue(undefined);
   leaseGuardianTokenMock.mockReset();
-  leaseGuardianTokenMock.mockResolvedValue(
-    {} as Awaited<ReturnType<typeof guardianToken.leaseGuardianToken>>,
-  );
+  leaseGuardianTokenMock.mockResolvedValue(makeGuardianTokenData());
   maybeStartNgrokTunnelMock.mockReset();
   maybeStartNgrokTunnelMock.mockResolvedValue(null);
   loadRawConfigMock.mockReset();
@@ -330,7 +329,7 @@ afterAll(() => {
   mock.module("../lib/process", () => realProcessLib);
   mock.module("../lib/port-allocator.js", () => realPortAllocator);
   mock.module("../lib/local", () => realLocal);
-  mock.module("../lib/ngrok", () => realNgrok);
+  mock.module("../lib/tunnels/ngrok", () => realNgrok);
   mock.module("../lib/ingress-config.js", () => realIngressConfig);
   mock.module("../lib/nginx-ingress.js", () => realNginxIngress);
   mock.module("../lib/http-client.js", () => realHttpClient);
@@ -819,11 +818,11 @@ describe("cadet wake: daemon startup failure", () => {
     // AND a foreign listener on the runtime HTTP port answers readiness in
     // the dead daemon's place
     probeDaemonReadinessWithRetryMock.mockResolvedValue("ready");
-    const exitSpy = spyOn(process, "exit").mockImplementation(((
-      code?: number,
-    ) => {
-      throw new Error(`process.exit:${code}`);
-    }) as never);
+    const exitSpy = spyOn(process, "exit").mockImplementation(
+      (code?: number | string | undefined): never => {
+        throw new Error(`process.exit:${code}`);
+      },
+    );
 
     // WHEN wake runs
     const result = wake();
@@ -945,7 +944,7 @@ describe("cadet wake — tunnel edge restore", () => {
       runtimeUrl: "http://localhost:7930",
       cloud: "docker",
       ingressUrl: "https://assistant.example.com",
-    } as AssistantEntry);
+    });
     loadRawConfigMock.mockReturnValue(enabledConfig);
     process.argv = ["bun", "cadet", "wake", "docker-1"];
 
@@ -957,9 +956,13 @@ describe("cadet wake — tunnel edge restore", () => {
         workspaceDir: defaultWorkspace,
         gatewayPort: 7930,
       });
-      // Container wakes never tracked a spawned ngrok PID, so the auto-tunnel
-      // stays out of this path.
-      expect(maybeStartNgrokTunnelMock).not.toHaveBeenCalled();
+      // Container wakes run the same auto-tunnel as local wakes (docker
+      // parity); the spawned agent records itself in the root lockfile.
+      expect(maybeStartNgrokTunnelMock).toHaveBeenCalledWith(
+        7840,
+        defaultWorkspace,
+        "docker-1",
+      );
       expect(logSpy).toHaveBeenCalledWith("Wake complete.");
     } finally {
       if (originalWorkspaceDir === undefined) {
@@ -971,6 +974,48 @@ describe("cadet wake — tunnel edge restore", () => {
     }
   });
 
+  test("a migrated docker assistant (containers never created) is recreated from the entry", async () => {
+    const defaultWorkspace = mkdtempSync(join(tmpdir(), "cadet-wake-default-"));
+    const originalWorkspaceDir = process.env.CADET_WORKSPACE_DIR;
+    process.env.CADET_WORKSPACE_DIR = defaultWorkspace;
+    const migratedEntry = {
+      assistantId: "docker-1",
+      runtimeUrl: "http://localhost:7930",
+      cloud: "docker" as const,
+      containerInfo: {
+        assistantImage: "mycadet/mycadet-assistant:v0.12.7",
+        gatewayImage: "mycadet/mycadet-gateway:v0.12.7",
+        cesImage: "mycadet/mycadet-credential-executor:v0.12.7",
+      },
+    };
+    resolveTargetAssistantMock.mockReturnValue(migratedEntry);
+    loadRawConfigMock.mockReturnValue(enabledConfig);
+    // The v0.0.10 run feedback: the containers were never created —
+    // `docker start` answers "No such container".
+    wakeContainersMock.mockImplementation(async () => {
+      throw new Error(
+        "Error response from daemon: No such container: docker-1-assistant",
+      );
+    });
+    process.argv = ["bun", "cadet", "wake", "docker-1"];
+
+    try {
+      await wake();
+
+      expect(recreateDockerContainersMock).toHaveBeenCalledWith(migratedEntry);
+      expect(logSpy).toHaveBeenCalledWith("Docker containers started.");
+      expect(logSpy).toHaveBeenCalledWith("Wake complete.");
+    } finally {
+      wakeContainersMock.mockImplementation(async () => {});
+      if (originalWorkspaceDir === undefined) {
+        delete process.env.CADET_WORKSPACE_DIR;
+      } else {
+        process.env.CADET_WORKSPACE_DIR = originalWorkspaceDir;
+      }
+      rmSync(defaultWorkspace, { recursive: true, force: true });
+    }
+  });
+
   test("a docker wake leaves an edge fronting another container alone", async () => {
     const defaultWorkspace = mkdtempSync(join(tmpdir(), "cadet-wake-default-"));
     const originalWorkspaceDir = process.env.CADET_WORKSPACE_DIR;
@@ -980,7 +1025,7 @@ describe("cadet wake — tunnel edge restore", () => {
       runtimeUrl: "http://localhost:7930",
       cloud: "docker",
       ingressUrl: "https://assistant.example.com",
-    } as AssistantEntry);
+    });
     loadRawConfigMock.mockReturnValue(enabledConfig);
     isIngressRunningMock.mockReturnValue(true);
     readIngressStateMock.mockReturnValue({
@@ -1014,7 +1059,7 @@ describe("cadet wake — tunnel edge restore", () => {
       runtimeUrl: "http://localhost:7930",
       cloud: "docker",
       ingressUrl: "https://assistant.example.com",
-    } as AssistantEntry);
+    });
     loadRawConfigMock.mockReturnValue(enabledConfig);
     isIngressRunningMock.mockReturnValue(true);
     readIngressStateMock.mockReturnValue({
@@ -1052,7 +1097,7 @@ describe("cadet wake — tunnel edge restore", () => {
     }
   });
 
-  test("a failed docker edge restore does not claim webhooks still work", async () => {
+  test("a failed docker edge restore falls back to the gateway tunnel", async () => {
     const defaultWorkspace = mkdtempSync(join(tmpdir(), "cadet-wake-default-"));
     const originalWorkspaceDir = process.env.CADET_WORKSPACE_DIR;
     process.env.CADET_WORKSPACE_DIR = defaultWorkspace;
@@ -1061,7 +1106,7 @@ describe("cadet wake — tunnel edge restore", () => {
       runtimeUrl: "http://localhost:7930",
       cloud: "docker",
       ingressUrl: "https://assistant.example.com",
-    } as AssistantEntry);
+    });
     loadRawConfigMock.mockReturnValue(enabledConfig);
     ensureTunnelEdgeMock.mockRejectedValue(
       new Error("nginx is not installed."),
@@ -1071,11 +1116,14 @@ describe("cadet wake — tunnel edge restore", () => {
     try {
       await wake();
 
+      // Docker wakes get the same tunnel logic as local ones: when the edge
+      // cannot be rebuilt, the auto-tunnel still fronts the gateway port so
+      // webhook delivery survives.
       expect(warnSpy).toHaveBeenCalledWith(
-        expect.stringContaining("webhook delivery are unavailable"),
+        expect.stringContaining("Webhooks still work"),
       );
       expect(warnSpy).not.toHaveBeenCalledWith(
-        expect.stringContaining("Webhooks still work"),
+        expect.stringContaining("webhook delivery are unavailable"),
       );
     } finally {
       if (originalWorkspaceDir === undefined) {
@@ -1098,14 +1146,14 @@ describe("cadet wake — tunnel edge restore", () => {
       runtimeUrl: "http://localhost:7930",
       cloud: "docker",
       ingressUrl: "https://other.example.com",
-    } as AssistantEntry);
+    });
     loadAllAssistantsMock.mockReturnValue([
       {
         assistantId: "docker-2",
         runtimeUrl: "http://localhost:8030",
         cloud: "docker",
         ingressUrl: "https://assistant.example.com",
-      } as AssistantEntry,
+      },
     ]);
     loadRawConfigMock.mockReturnValue(enabledConfig);
     isIngressRunningMock.mockReturnValue(false);
@@ -1135,7 +1183,7 @@ describe("cadet wake — tunnel edge restore", () => {
       runtimeUrl: "http://localhost:7930",
       cloud: "docker",
       ingressUrl: "https://assistant.example.com",
-    } as AssistantEntry);
+    });
     loadRawConfigMock.mockReturnValue(enabledConfig);
     process.argv = ["bun", "cadet", "wake", "docker-1"];
 
@@ -1163,7 +1211,7 @@ describe("cadet wake — tunnel edge restore", () => {
       runtimeUrl: "http://localhost:7930",
       cloud: "docker",
       ingressUrl: "https://assistant.example.com",
-    } as AssistantEntry);
+    });
     loadRawConfigMock.mockReturnValue(enabledConfig);
     waitForDaemonReadyMock.mockImplementation(async () => false);
     process.argv = ["bun", "cadet", "wake", "docker-1"];
@@ -1194,7 +1242,7 @@ describe("cadet wake — tunnel edge restore", () => {
       assistantId: "docker-1",
       runtimeUrl: "http://localhost:7930",
       cloud: "docker",
-    } as AssistantEntry);
+    });
     process.argv = ["bun", "cadet", "wake", "docker-1"];
 
     try {
@@ -1222,13 +1270,13 @@ describe("cadet wake — tunnel edge restore", () => {
       assistantId: "docker-1",
       runtimeUrl: "http://localhost:7930",
       cloud: "docker",
-    } as AssistantEntry);
+    });
     loadAllAssistantsMock.mockReturnValue([
       {
         assistantId: "docker-1",
         runtimeUrl: "http://localhost:7930",
         cloud: "docker",
-      } as AssistantEntry,
+      },
     ]);
     loadRawConfigMock.mockReturnValue(enabledConfig);
     isIngressRunningMock.mockReturnValue(false);
@@ -1260,14 +1308,14 @@ describe("cadet wake — tunnel edge restore", () => {
       assistantId: "docker-1",
       runtimeUrl: "http://localhost:7930",
       cloud: "docker",
-    } as AssistantEntry);
+    });
     loadAllAssistantsAcrossEnvsMock.mockReturnValue([
       {
         assistantId: "docker-2",
         runtimeUrl: "http://localhost:8030",
         cloud: "docker",
         ingressUrl: "https://assistant.example.com",
-      } as AssistantEntry,
+      },
     ]);
     loadRawConfigMock.mockReturnValue(enabledConfig);
     isIngressRunningMock.mockReturnValue(false);
@@ -1296,7 +1344,7 @@ describe("cadet wake — tunnel edge restore", () => {
       runtimeUrl: "http://localhost:7930",
       cloud: "docker",
       ingressUrl: "https://assistant.example.com",
-    } as AssistantEntry);
+    });
     process.argv = ["bun", "cadet", "wake", "docker-1"];
 
     try {
@@ -1455,14 +1503,14 @@ describe("cadet wake — tunnel edge restore", () => {
     loadRawConfigMock.mockReturnValue(webhookConfig);
     ensureTunnelEdgeMock.mockRejectedValue(
       new Error(
-        "nginx is not installed, so the tunnel edge cannot start. Install it (macOS: `brew install nginx`, Linux: `sudo apt install nginx`) or point NGINX_BIN at an existing binary.",
+        "nginx is not installed, so the tunnel edge cannot start. See https://nginx.org/en/docs/install.html for how to install, or point NGINX_BIN at an existing binary.",
       ),
     );
 
     await wake();
 
     expect(warnSpy).toHaveBeenCalledWith(
-      expect.stringContaining("brew install nginx"),
+      expect.stringContaining("https://nginx.org/en/docs/install.html"),
     );
     // No tunnel is recorded here, so no provider can be named and the advice
     // points at the help that lists them.
@@ -1541,4 +1589,173 @@ describe("cadet wake — tunnel edge restore", () => {
       "local-assistant",
     );
   });
+
+  describe("--all", () => {
+    function makeAllEntry(
+      assistantId: string,
+      instanceDir: string,
+    ): AssistantEntry {
+      return {
+        assistantId,
+        runtimeUrl: "http://127.0.0.1:7830",
+        cloud: "local",
+        resources: {
+          instanceDir,
+          daemonPort: 7821,
+          gatewayPort: 7830,
+          qdrantPort: 6333,
+          cesPort: 7822,
+          signingKey: "ab".repeat(32),
+        },
+      };
+    }
+
+    function makeAllEntries(): AssistantEntry[] {
+      mkdirSync(join(tempDir, "instance-1"), { recursive: true });
+      mkdirSync(join(tempDir, "instance-2"), { recursive: true });
+      return [
+        makeAllEntry("wake-all-1", join(tempDir, "instance-1")),
+        makeAllEntry("wake-all-2", join(tempDir, "instance-2")),
+      ];
+    }
+
+    // Cold-start both assistants so each wake's starts are observable.
+    function mockColdStart(): void {
+      resolveProcessStateMock.mockImplementation(async () => ({
+        status: "needs_start",
+        pid: null,
+      }));
+      isProcessAliveMock.mockReturnValue({ alive: true, pid: 123 });
+    }
+
+    test("starts every assistant in the lockfile", async () => {
+      mockColdStart();
+      loadAllAssistantsMock.mockReturnValue(makeAllEntries());
+      process.argv = ["bun", "cadet", "wake", "--all"];
+
+      await wake();
+
+      expect(startCesMock).toHaveBeenCalledTimes(2);
+      expect(startLocalDaemonMock).toHaveBeenCalledTimes(2);
+      expect(startGatewayMock).toHaveBeenCalledTimes(2);
+    });
+
+    test("skips assistants whose lifecycle is managed elsewhere", async () => {
+      mockColdStart();
+      const entries = makeAllEntries();
+      entries[1] = {
+        assistantId: "paired-one",
+        runtimeUrl: "http://127.0.0.1:1",
+        cloud: "paired",
+      };
+      loadAllAssistantsMock.mockReturnValue(entries);
+      process.argv = ["bun", "cadet", "wake", "--all"];
+
+      await wake();
+
+      expect(startCesMock).toHaveBeenCalledTimes(1);
+      expect(startLocalDaemonMock).toHaveBeenCalledTimes(1);
+      expect(startGatewayMock).toHaveBeenCalledTimes(1);
+      expect(logSpy.mock.calls.flat().join("\n")).toContain(
+        "Skipping 'paired-one' (paired) — its lifecycle is managed elsewhere.",
+      );
+    });
+
+    test("continues past a failing assistant and exits 1", async () => {
+      mockColdStart();
+      loadAllAssistantsMock.mockReturnValue([
+        // Missing resources is a deliberate refusal for this entry.
+        {
+          assistantId: "wake-all-1",
+          runtimeUrl: "http://127.0.0.1:7830",
+          cloud: "local",
+        },
+        makeAllEntry("wake-all-2", join(tempDir, "instance-2")),
+      ]);
+      mkdirSync(join(tempDir, "instance-2"), { recursive: true });
+      process.argv = ["bun", "cadet", "wake", "--all"];
+
+      const exitSpy = spyOn(process, "exit").mockImplementation(
+        (code?: number | string | undefined): never => {
+          throw new Error(`process.exit:${code}`);
+        },
+      );
+
+      try {
+        await expect(wake()).rejects.toThrow("process.exit:1");
+        expect(errorSpy.mock.calls.flat().join("\n")).toContain(
+          "failed to wake 'wake-all-1'",
+        );
+      } finally {
+        exitSpy.mockRestore();
+      }
+
+      // The healthy assistant was still started.
+      expect(startCesMock).toHaveBeenCalledTimes(1);
+      expect(startLocalDaemonMock).toHaveBeenCalledTimes(1);
+      expect(startGatewayMock).toHaveBeenCalledTimes(1);
+    });
+
+    test("exits 1 when there is nothing to start", async () => {
+      loadAllAssistantsMock.mockReturnValue([]);
+      process.argv = ["bun", "cadet", "wake", "--all"];
+
+      const exitSpy = spyOn(process, "exit").mockImplementation(
+        (code?: number | string | undefined): never => {
+          throw new Error(`process.exit:${code}`);
+        },
+      );
+
+      try {
+        await expect(wake()).rejects.toThrow("process.exit:1");
+        expect(errorSpy).toHaveBeenCalledWith(
+          expect.stringContaining("no assistants found"),
+        );
+      } finally {
+        exitSpy.mockRestore();
+      }
+    });
+
+    test("refuses --all combined with a name", async () => {
+      process.argv = ["bun", "cadet", "wake", "local-assistant", "--all"];
+
+      const exitSpy = spyOn(process, "exit").mockImplementation(
+        (code?: number | string | undefined): never => {
+          throw new Error(`process.exit:${code}`);
+        },
+      );
+
+      try {
+        await expect(wake()).rejects.toThrow("process.exit:1");
+        expect(errorSpy).toHaveBeenCalledWith(
+          expect.stringContaining("--all cannot be combined"),
+        );
+      } finally {
+        exitSpy.mockRestore();
+      }
+    });
+
+    test("refuses --all with --foreground and --repair-guardian", async () => {
+      const exitSpy = spyOn(process, "exit").mockImplementation(
+        (code?: number | string | undefined): never => {
+          throw new Error(`process.exit:${code}`);
+        },
+      );
+
+      try {
+        for (const flag of ["--foreground", "--repair-guardian"]) {
+          process.argv = ["bun", "cadet", "wake", "--all", flag];
+          await expect(wake()).rejects.toThrow("process.exit:1");
+        }
+      } finally {
+        exitSpy.mockRestore();
+      }
+
+      expect(errorSpy).toHaveBeenCalledWith(
+        expect.stringContaining(
+          "--all cannot be combined with --foreground or --repair-guardian",
+        ),
+      );
+    });
+  });
 });

package/src/__tests__/workos-pkce.test.ts

@@ -88,7 +88,7 @@ describe("buildAuthorizeUrl", () => {
 });
 
 describe("selectWorkosClientId", () => {
-  // During coexistence the platform lists two providers that share the
+  // During coexistence the cloud lists two providers that share the
   // "workos-oidc" id; only the OAuth2 one (no discovery URL) is usable.
   const legacy = {
     id: "workos-oidc",
@@ -110,7 +110,7 @@ describe("selectWorkosClientId", () => {
     expect(selectWorkosClientId([modern, legacy])).toBe("client_um");
   });
 
-  test("returns null when the platform lacks token auth", () => {
+  test("returns null when the cloud lacks token auth", () => {
     const preTokenAuth = { ...modern, flows: ["provider_redirect"] };
     expect(selectWorkosClientId([legacy, preTokenAuth])).toBeNull();
     expect(selectWorkosClientId([])).toBeNull();

package/src/commands/backup.ts

@@ -1,4 +1,4 @@
-import { isManagedCloud } from "../lib/managed-cloud.js";
+import { isCloudHome } from "../lib/cloud-values.js";
 import { mkdirSync, writeFileSync } from "fs";
 import { dirname, join } from "path";
 
@@ -14,9 +14,9 @@ import {
   localRuntimePollJobStatus,
 } from "../lib/local-runtime-client.js";
 import {
-  platformRequestSignedUrl,
-  readPlatformToken,
-} from "../lib/platform-client.js";
+  cloudRequestSignedUrl,
+  readCloudToken,
+} from "../lib/cloud-client.js";
 import { loopbackSafeFetch } from "../lib/loopback-fetch.js";
 
 // Default timeout for the runtime-direct export request. Overridable via
@@ -42,10 +42,10 @@ export const backup = Object.assign(
     console.log("Options:");
     console.log("  --output <path>          Path to save the .vbundle file");
     console.log(
-      "                           (default: ~/.local/share/cadet/backups/<name>-<timestamp>.vbundle)",
+      "                           defaults to ~/.local/share/cadet/backups/<name>-<timestamp>.vbundle",
     );
     console.log(
-      `  --export-timeout <secs>  Export request timeout in seconds (default: ${DEFAULT_EXPORT_TIMEOUT_MS / 1000})`,
+      `  --export-timeout <secs>  Export request timeout in seconds, defaults to ${DEFAULT_EXPORT_TIMEOUT_MS / 1000}`,
     );
     console.log("");
     console.log("Examples:");
@@ -102,7 +102,7 @@ export const backup = Object.assign(
     process.exit(1);
   }
 
-  if (isManagedCloud(cloud)) {
+  if (isCloudHome(cloud)) {
     await backupPlatform(entry, name, outputArg);
     return;
   }
@@ -233,9 +233,9 @@ export const backup = Object.assign(
 // ---------------------------------------------------------------------------
 // Platform-managed (cloud="cadet") backup over GCS.
 //
-// The runtime exports the bundle straight to a platform-issued signed GCS
+// The runtime exports the bundle straight to a cloud-issued signed GCS
 // URL; the CLI then downloads from GCS to local disk. Bytes never flow
-// through Django. Same architectural shape as the platform-source half of
+// through Django. Same architectural shape as the cloud-source half of
 // `cadet teleport`. Output format and success log lines match mode 1
 // (runtime-direct local backup) so users see one consistent UX.
 //
@@ -251,24 +251,24 @@ async function backupPlatform(
   name: string,
   outputArg?: string,
 ): Promise<void> {
-  const platformToken = readPlatformToken();
-  if (!platformToken) {
+  const cloudToken = readCloudToken();
+  if (!cloudToken) {
     console.error(
-      "Not logged in. Run 'cadet login' first (required for platform-managed backup).",
+      "Not logged in. Run 'cadet login' first.",
     );
     process.exit(1);
   }
   // Pin upload, download, and runtime requests to the same platform instance
-  // the assistant lives on. Using `getPlatformUrl()` instead would target
+  // the assistant lives on. Using `getCloudUrl()` instead would target
   // whatever the lockfile / env-var resolves to, which may differ from
   // `entry.runtimeUrl` for staging/dev assistants and end up signing URLs
-  // for the wrong GCS bucket. Mirrors the teleport bundlePlatformUrl
+  // for the wrong GCS bucket. Mirrors the teleport bundleCloudUrl
   // threading at `cli/src/commands/teleport.ts:1311-1312`.
-  const platformUrl = entry.runtimeUrl;
+  const cloudUrl = entry.runtimeUrl;
   // Track the working platform token across kickoff/poll/download so a
   // 401-driven refresh during polling stays consistent through the final
   // signed-download request.
-  let exportPlatformToken = platformToken;
+  let exportPlatformToken = cloudToken;
 
   // Step 0 — Ask the source runtime which version it's running. The bundle
   // is produced by the daemon (not the CLI), and the CLI version can drift
@@ -288,17 +288,17 @@ async function backupPlatform(
   }
 
   // Step 1 — Request a signed upload URL.
-  const { url: uploadUrl, bundleKey } = await platformRequestSignedUrl(
+  const { url: uploadUrl, bundleKey } = await cloudRequestSignedUrl(
     {
       operation: "upload",
       minRuntimeVersion: runtimeIdentity.version,
       maxRuntimeVersion: null,
     },
     exportPlatformToken,
-    platformUrl,
+    cloudUrl,
   );
 
-  // Step 2 — Kick off runtime export-to-GCS through the platform's
+  // Step 2 — Kick off runtime export-to-GCS through the cloud's
   // wildcard runtime proxy. `localRuntimeExportToGcs` builds the
   // `/v1/assistants/<id>/migrations/export-to-gcs` URL for cloud="cadet"
   // and uses platform-token auth (no guardian-token bootstrap).
@@ -327,7 +327,7 @@ async function backupPlatform(
     label: "platform export",
     poll: () => localRuntimePollJobStatus(entry, exportPlatformToken, jobId),
     refreshOn401: async () => {
-      const refreshed = readPlatformToken();
+      const refreshed = readCloudToken();
       if (!refreshed) {
         throw new Error(
           "Platform auth expired during export and no credential was found on disk. Run 'cadet login' and retry.",
@@ -344,7 +344,7 @@ async function backupPlatform(
 
   // Step 4 — Request a signed download URL for the same bundle and fetch
   // it from GCS directly. No auth on signed URLs.
-  // Use `exportPlatformToken` (not the original `platformToken`) so a
+  // Use `exportPlatformToken` (not the original `cloudToken`) so a
   // poll-loop 401 refresh doesn't get clobbered here — otherwise a long
   // export that recovered mid-poll via re-auth would still 401 on the
   // download-URL request and abort an otherwise successful run.
@@ -354,15 +354,15 @@ async function backupPlatform(
   // runtime to gate against, and the user can later restore the file
   // into any compatible runtime. Sending the CLI's version would
   // incorrectly block older CLIs from backing up newer assistants.
-  // The platform treats `target_runtime_version` as optional and skips
+  // The cloud treats `target_runtime_version` as optional and skips
   // the version check when it's omitted.
-  const { url: bundleUrl } = await platformRequestSignedUrl(
+  const { url: bundleUrl } = await cloudRequestSignedUrl(
     {
       operation: "download",
       bundleKey,
     },
     exportPlatformToken,
-    platformUrl,
+    cloudUrl,
   );
 
   let downloadResponse: Response;