@mycadet/cli 0.12.7 → 0.12.9-dev.202610131452.9acab64

package/src/lib/local.ts

@@ -74,11 +74,10 @@ import {
   executableName,
   isProcessAlive,
   pathListDelimiter,
-  readProcessCommandLine,
   resolveProcessState,
-  stopProcess,
   stopProcessByPidFile,
 } from "./process.js";
+import { stopTunnelProcess } from "./tunnel.js";
 import { stripVersionPrefix } from "./version-compat.js";
 import { openLogFile, pipeToLogFile } from "./xdg-log.js";
 
@@ -699,7 +698,7 @@ function sleep(ms: number): Promise<void> {
  * A readiness answer proves only that something listens on the port: a foreign
  * listener holding it answers in the daemon's place, so a daemon aborting over
  * the collision still reads as "up" or "migrating". Ownership is confirmed
- * from the listening PID where the platform can report it. Otherwise the spawn
+ * from the listening PID where the cloud can report it. Otherwise the spawn
  * gets a short settle window, which is long enough because transports bind
  * before migrations run, so an address collision aborts the daemon early.
  */
@@ -938,7 +937,7 @@ async function startDaemonWatchFromSource(
   }
   writeFileSync(pidFile, String(daemonPid), "utf-8");
 
-  console.log("   Assistant started in watch mode (bun --watch)");
+  console.log("   Assistant started in watch mode with bun --watch");
   return trackDaemonSpawn(child);
 }
 
@@ -985,6 +984,41 @@ function resolveGatewayDir(resources?: LocalInstanceResources): string {
   }
 }
 
+/**
+ * How to invoke a `gateway <subcommand>` CLI process so it resolves the same
+ * workspace AND gateway security dir as the locally spawned gateway server:
+ * run the gateway package's CLI entry through bun with the spawn state root
+ * as cwd and the instance-pinned CADET_WORKSPACE_DIR / GATEWAY_SECURITY_DIR
+ * the server was given (the file-backed pairing store must resolve
+ * identically in both processes). Callers pass the resolved assistant
+ * entry's `resources` (undefined for the default instance, where both
+ * processes fall back to the same cwd-relative paths).
+ */
+export function gatewayCliInvocation(resources?: LocalInstanceResources): {
+  command: string;
+  args: string[];
+  cwd: string;
+  env: Record<string, string | undefined>;
+} {
+  return {
+    command: resolveBunExecutable(),
+    args: ["run", join(resolveGatewayDir(resources), "src/cli/index.ts")],
+    cwd: spawnStateRoot(),
+    env: {
+      ...process.env,
+      ...(resources
+        ? {
+            CADET_WORKSPACE_DIR: join(resources.instanceDir, "workspace"),
+            GATEWAY_SECURITY_DIR: join(
+              resources.instanceDir,
+              "gateway-security",
+            ),
+          }
+        : {}),
+    },
+  };
+}
+
 function resolveCesDir(resources?: LocalInstanceResources): string {
   const runtimeCesDir = localRuntimeCesDir(resources);
   if (runtimeCesDir) return runtimeCesDir;
@@ -1119,9 +1153,7 @@ export async function startCes(
     // Source tree / bunx: run the CES entry point via bun.
     const cesDir = runtimeCesDir ?? resolveCesDir(resources);
     const cesEntry = join(cesDir, "src/main.ts");
-    const bunArgs = watch
-      ? ["--watch", "run", cesEntry]
-      : ["run", cesEntry];
+    const bunArgs = watch ? ["--watch", "run", cesEntry] : ["run", cesEntry];
     const cesLogFd = openLogFile("hatch.log");
     ces = spawn(resolveBunExecutable(), bunArgs, {
       cwd: spawnStateRoot(),
@@ -1632,7 +1664,7 @@ export async function startLocalDaemon(
         "ANTHROPIC_API_KEY",
         "APP_VERSION",
         "CADET_ENVIRONMENT",
-        "CADET_PLATFORM_URL",
+        "CADET_CLOUD_URL",
         "QDRANT_HTTP_PORT",
         "QDRANT_URL",
         "RUNTIME_HTTP_PORT",
@@ -1642,7 +1674,7 @@ export async function startLocalDaemon(
         "CADET_DEBUG",
         "CADET_DEV",
         "CADET_DESKTOP_APP",
-        "CADET_DISABLE_PLATFORM",
+        "CADET_DISABLE_CLOUD",
         "CADET_MIGRATION_EXPORT_ALLOWED_HOSTS",
         "CADET_MIGRATION_IMPORT_ALLOWED_HOSTS",
         "CADET_WORKSPACE_DIR",
@@ -1931,16 +1963,6 @@ export async function startGateway(
   return gatewayUrl;
 }
 
-/** Check whether a PID belongs to an ngrok process via its command line. */
-function isNgrokProcess(pid: number): boolean {
-  try {
-    const output = readProcessCommandLine(pid);
-    return /ngrok/i.test(output);
-  } catch {
-    return false;
-  }
-}
-
 /**
  * Stop any locally-running daemon and gateway processes
  * and clean up PID files. Called when hatch fails partway through
@@ -1969,22 +1991,12 @@ export async function stopLocalProcesses(
   const cesPidFile = join(cadetDir, "ces.pid");
   await stopProcessByPidFile(cesPidFile, "credential-executor");
 
-  // Kill ngrok directly by PID rather than using stopProcessByPidFile, because
-  // isCadetProcess() won't match the ngrok binary — resulting in a no-op that
-  // leaves ngrok running. Verify the PID still belongs to ngrok before killing
-  // to avoid hitting an unrelated process if the OS has reused the PID.
-  const ngrokPidFile = join(cadetDir, "ngrok.pid");
-  if (existsSync(ngrokPidFile)) {
-    try {
-      const pid = parseInt(readFileSync(ngrokPidFile, "utf-8").trim(), 10);
-      if (!isNaN(pid) && isNgrokProcess(pid)) {
-        await stopProcess(pid, "ngrok");
-      }
-      unlinkSync(ngrokPidFile);
-    } catch {}
-  }
+  // Stop the tunnel agent this CLI spawned (root lockfile `tunnel` entry),
+  // verifying the pid still belongs to the provider's binary before signaling
+  // it — PID reuse must never send an unrelated process a signal.
+  await stopTunnelProcess();
 
   // Stop the nginx ingress if one is fronting this gateway (it guards against
-  // PID reuse itself, mirroring the ngrok handling above).
+  // PID reuse itself).
   await stopIngressNginx(join(cadetDir, "workspace"));
 }

package/src/lib/nginx-ingress.ts

@@ -19,10 +19,13 @@ import { join } from "node:path";
 import { cloudAssistantHubUrl } from "@mycadet/environments";
 
 import {
+  clearRootProcess,
   getAssistantDisplayName,
   lookupAssistantByIdentifier,
+  stampRootProcess,
   type AssistantEntry,
 } from "./assistant-config.js";
+import type { RemoteHost } from "./constants.js";
 import { getCurrentEnvironment } from "./environments/resolve.js";
 import { waitForDaemonReady } from "./http-client.js";
 import {
@@ -159,6 +162,12 @@ export function cloudWebHubUrl(env: string | undefined): string {
   return cloudAssistantHubUrl(env);
 }
 
+// The edge serves remote browsers, so the bundle's remote-gateway machinery
+// must always run: it is reached through this self-hosted edge however the
+// cadet itself is hosted. "cloud" is never stamped (the cloud serves its
+// own bundles).
+const EDGE_SERVED_REMOTE: RemoteHost = "custom";
+
 function remoteWebIngressConfig(
   opts: Pick<
     RemoteWebIngressOptions,
@@ -166,10 +175,8 @@ function remoteWebIngressConfig(
   >,
 ): Record<string, unknown> {
   return {
-    mode: "remote-gateway",
+    remote: EDGE_SERVED_REMOTE,
     apiBaseUrl: "/v1",
-    platformDisabled: true,
-    disablePlatform: true,
     ...(opts.assistantName ? { assistantName: opts.assistantName } : {}),
     ...(opts.assistantId ? { assistantId: opts.assistantId } : {}),
     ...(opts.hubUrl ? { hubUrl: opts.hubUrl } : {}),
@@ -182,7 +189,7 @@ function remoteWebIngressConfig(
  * fingerprint matches, so this must change whenever the generated index or
  * nginx template does.
  */
-export const EDGE_TEMPLATE_VERSION = 8;
+export const EDGE_TEMPLATE_VERSION = 10;
 
 /**
  * Stable fingerprint of the SPA config injected into the served index and
@@ -353,7 +360,7 @@ http {
   # remote client cannot smuggle one. Every caller reaches this loopback-only
   # listener through the TLS-terminating front (tunnel agent), so the raw peer
   # is always 127.0.0.1; the front records the real client as the RIGHTMOST
-  # X-Forwarded-For entry (ngrok/cloudflared append, tailscale serve sets it),
+  # X-Forwarded-For entry (tunnel providers append one; tailscale serve sets it),
   # which the remote client cannot control. Fall back to the raw peer when the
   # front sets no X-Forwarded-For.
   map $http_x_forwarded_for $cadet_edge_client_ip {
@@ -487,7 +494,8 @@ export function getNginxVersion(): string | null {
  * process.ts helpers: stopProcessByPidFile's isCadetProcess() guard only
  * matches command lines containing a cadet path, which fails for a custom
  * CADET_WORKSPACE_DIR and would silently leave nginx running (the same
- * reason local.ts kills ngrok directly). This module is also imported by
+ * reason local.ts stops the tunnel agent directly). This module is also
+ * imported by
  * sleep/retire, whose tests mock.module() process.js process-globally —
  * depending on it here would couple this lib's behavior to those mocks.
  */
@@ -618,13 +626,15 @@ function clearIngressState(workspaceDir: string): void {
 function clearStoppedIngress(workspaceDir: string, pidPath: string): void {
   clearIngressState(workspaceDir);
   rmSync(pidPath, { force: true });
+  // The edge is gone; drop the root lockfile's process entry with it.
+  clearRootProcess("app");
 }
 
 /**
- * Write the nginx config and spawn nginx detached (same idiom as the ngrok
- * spawn in ngrok.ts: stdout/stderr to a log file, fd closed after spawn,
- * caller unrefs). nginx runs with `daemon off` so the spawned process is the
- * master; it writes its pid to nginx.pid under the prefix dir.
+ * Write the nginx config and spawn nginx detached (stdout/stderr to a log
+ * file, fd closed after spawn, caller unrefs). nginx runs with `daemon off`
+ * so the spawned process is the master; it writes its pid to nginx.pid under
+ * the prefix dir.
  */
 export function startIngressNginx(opts: {
   workspaceDir: string;
@@ -1028,8 +1038,22 @@ export async function stopContainerTunnelEdge(
   return stopIngressNginx(workspaceDir);
 }
 
-/** Resolved edge a tunnel (or bring-your-own HTTPS front) should target. */
-export interface TunnelEdge {
+/** Record the running edge's pid in the root lockfile for `cadet ps`. */
+function stampAppProcessEntry(
+  workspaceDir: string,
+  assistantId?: string,
+): void {
+  const pid = getIngressPid(workspaceDir);
+  if (pid !== null) {
+    stampRootProcess("app", {
+      pid,
+      startedAt: new Date().toISOString(),
+      assistantId,
+    });
+  }
+}
+
+/** Resolved edge a tunnel (or bring-your-own HTTPS front) should target. */ export interface TunnelEdge {
   /** Loopback listen port the HTTPS front should forward to. */
   port: number;
   /** True when this call started the edge, false when a running one was reused. */
@@ -1081,7 +1105,6 @@ export async function ensureTunnelEdge(opts: {
   const assistantName = opts.assistantId
     ? lockfileAssistantName(opts.assistantId)
     : undefined;
-
   const result = await startRemoteWebIngress({
     workspaceDir: opts.workspaceDir,
     gatewayPort: opts.gatewayPort,
@@ -1093,6 +1116,7 @@ export async function ensureTunnelEdge(opts: {
 
   switch (result.status) {
     case "started":
+      stampAppProcessEntry(opts.workspaceDir, opts.assistantId);
       return {
         port: result.listenPort,
         started: true,
@@ -1126,6 +1150,7 @@ export async function ensureTunnelEdge(opts: {
             stuckEdgeRecoveryHint(opts.workspaceDir),
         );
       }
+      stampAppProcessEntry(opts.workspaceDir, opts.assistantId);
       return {
         port: result.listenPort,
         started: false,
@@ -1135,13 +1160,13 @@ export async function ensureTunnelEdge(opts: {
     case "nginx-missing":
       throw new Error(
         "nginx is not installed, so the tunnel edge cannot start. " +
-          "Install it (macOS: `brew install nginx`, Linux: `sudo apt install nginx`) " +
+          "See https://nginx.org/en/docs/install.html for how to install, " +
           "or point NGINX_BIN at an existing binary.",
       );
     case "web-dist-missing":
       throw new Error(
         "Unable to locate built web assets for the remote web edge. " +
-          "Build the SPA (`cd clients/web && VITE_PLATFORM_MODE=false bun run build`) " +
+          "Build the SPA with `cd clients/web && VITE_CLOUD_MODE=false bun run build`, " +
           "or install @mycadet/web so its packaged dist directory is available.",
       );
     case "unreachable":

package/src/lib/pair.ts

@@ -50,6 +50,6 @@ export function formatWebApproveFailure(
   return [
     `${rejection} ${gatewayUrl} (assistant "${assistantReference}", environment "${envName}").`,
     `Codes are minted by the gateway that serves the pair page, expire after ${CODE_TTL_MINUTES} minutes, and are single-use.`,
-    "If the pair page came from a different assistant or environment (e.g. the desktop app's), re-run with that environment's CADET_ENVIRONMENT and that assistant's name.",
+    "If the pair page came from a different assistant or environment, such as the desktop app's, re-run with that environment's CADET_ENVIRONMENT and that assistant's name.",
   ].join("\n");
 }

package/src/lib/process.ts

@@ -76,7 +76,7 @@ export function windowsCommandLineLookupArgs(pid: number): string[] {
   ];
 }
 
-/** Read a process command line using the platform's process inspection tool. */
+/** Read a process command line using the cloud's process inspection tool. */
 export function readProcessCommandLine(
   pid: number,
   hostPlatform: NodeJS.Platform = platform(),

package/src/lib/provider-secrets.ts

@@ -86,7 +86,7 @@ const PROVIDER_LABELS: Record<LlmProviderId, string> = {
   typesafe: "TypeSafe",
 };
 
-// Ranked for the hatch prompt: Cadet Cloud first (the managed connection —
+// Ranked for the hatch prompt: Cadet Cloud first (the cloud connection —
 // no key to collect), then the hosted-inference gateways, then the BYO-key
 // incumbents, then the rest, with the endpoint-supplied catalogs last.
 export const HATCH_PROVIDER_CHOICES: readonly LlmProviderId[] = [
@@ -681,11 +681,11 @@ export async function ensureProviderApiKey(
 
   if (!envVarName) {
     // Managed-connection provider (e.g. Cadet Cloud): authenticated through
-    // the platform, not a user-supplied API key. Checked before the
+    // the cloud, not a user-supplied API key. Checked before the
     // supported-provider guard so the keyless flow stays reachable.
     return {
       status: "skipped",
-      message: `${providerName} authenticates through the managed connection; no API key needed.`,
+      message: `${providerName} authenticates through the cloud connection; no API key needed.`,
     };
   }
 

package/src/lib/retire-apple-container.ts

@@ -7,7 +7,7 @@ import type { AssistantEntry } from "./assistant-config.js";
  * Retire an Apple Container assistant by sending a retire command to the
  * macOS app via the management socket. The app handles the full lifecycle:
  * stop the pod, archive the instance directory, remove the guardian token,
- * deregister from the platform, and remove the lockfile entry.
+ * deregister from the cloud, and remove the lockfile entry.
  */
 export async function retireAppleContainer(
   name: string,

package/src/lib/runtime-url.ts

@@ -1,4 +1,4 @@
-import { isManagedCloud } from "./managed-cloud.js";
+import { isCloudHome } from "./cloud-values.js";
 import { hostname } from "node:os";
 
 import { getLocalLanIPv4 } from "./local";
@@ -11,12 +11,12 @@ import type { AssistantEntry } from "./assistant-config.js";
  * - For local/docker assistants, `runtimeUrl` is the loopback gateway and
  *   the runtime serves `/v1/migrations/<subpath>` directly. The CLI hits
  *   that path with guardian-token bearer auth.
- * - For platform-managed (cloud="cadet") assistants, `runtimeUrl` is the
- *   platform host (e.g. `https://cloud.mycadet.ai`). The platform's
+ * - For cloud-managed (cloud="cadet") assistants, `runtimeUrl` is the
+ *   platform host (e.g. `https://cloud.mycadet.ai`). The cloud's
  *   `MigrationViewSet` does NOT expose `export-to-gcs` or arbitrary runtime
  *   migration paths under `/v1/migrations/...`. The wildcard runtime proxy
  *   at `/v1/assistants/<id>/<path:rest>` is what forwards arbitrary runtime
- *   paths to the managed runtime — vembda's unified proxy bootstraps the
+ *   paths to the cloud runtime — vembda's unified proxy bootstraps the
  *   guardian token internally for the runtime call. From the CLI side it's
  *   user-session auth.
  *
@@ -27,7 +27,7 @@ export function resolveRuntimeMigrationUrl(
   entry: Pick<AssistantEntry, "cloud" | "runtimeUrl" | "assistantId">,
   subpath: string,
 ): string {
-  if (isManagedCloud(entry.cloud)) {
+  if (isCloudHome(entry.cloud)) {
     return `${entry.runtimeUrl}/v1/assistants/${entry.assistantId}/migrations/${subpath}`;
   }
   return `${entry.runtimeUrl}/v1/migrations/${subpath}`;
@@ -39,9 +39,9 @@ export function resolveRuntimeMigrationUrl(
  *
  * - For local/docker assistants, `runtimeUrl` is the loopback gateway and
  *   the runtime serves `/v1/<subpath>` directly.
- * - For platform-managed (cloud="cadet") assistants the path is rewritten
+ * - For cloud-managed (cloud="cadet") assistants the path is rewritten
  *   to the wildcard runtime proxy:
- *   `{platformUrl}/v1/assistants/<assistantId>/<subpath>`.
+ *   `{cloudUrl}/v1/assistants/<assistantId>/<subpath>`.
  *
  * The `subpath` is appended verbatim (e.g. `"identity"`).
  */
@@ -49,7 +49,7 @@ export function resolveRuntimeUrl(
   entry: Pick<AssistantEntry, "cloud" | "runtimeUrl" | "assistantId">,
   subpath: string,
 ): string {
-  if (isManagedCloud(entry.cloud)) {
+  if (isCloudHome(entry.cloud)) {
     return `${entry.runtimeUrl}/v1/assistants/${entry.assistantId}/${subpath}`;
   }
   return `${entry.runtimeUrl}/v1/${subpath}`;

package/src/lib/statefulset.ts

@@ -199,7 +199,7 @@ export const DOCKER_STATEFUL_SET_SPEC: DockerStatefulSetSpec = {
           (v): HostEnv => ({ kind: "host", name: v }),
         ),
         { kind: "host", name: "CADET_ENVIRONMENT" },
-        { kind: "host", name: "CADET_PLATFORM_URL" },
+        { kind: "host", name: "CADET_CLOUD_URL" },
       ],
       volumeMounts: [
         { volumeName: "assistant-workspace",  mountPath: "/workspace" },
@@ -227,7 +227,7 @@ export const DOCKER_STATEFUL_SET_SPEC: DockerStatefulSetSpec = {
         { kind: "secret", name: "ACTOR_TOKEN_SIGNING_KEY",   secret: "signingKey" },
         { kind: "secret", name: "GUARDIAN_BOOTSTRAP_SECRET", secret: "bootstrapSecret" },
         { kind: "host",   name: "CADET_ENVIRONMENT" },
-        { kind: "host",   name: "CADET_PLATFORM_URL" },
+        { kind: "host",   name: "CADET_CLOUD_URL" },
         { kind: "host",   name: "TUNNEL_BASE_URL" },
       ],
       volumeMounts: [

package/src/lib/step-runner.ts

@@ -112,11 +112,16 @@ export function execWithStdin(
 export function execOutput(
   command: string,
   args: string[],
-  options: { cwd?: string; timeoutMs?: number } = {},
+  options: {
+    cwd?: string;
+    timeoutMs?: number;
+    env?: Record<string, string | undefined>;
+  } = {},
 ): Promise<string> {
   return new Promise((resolve, reject) => {
     const child = spawn(command, args, {
       cwd: options.cwd,
+      env: options.env,
       stdio: ["pipe", "pipe", "pipe"],
       windowsHide: true,
     });

package/src/lib/sync-cloud-assistants.ts

@@ -2,7 +2,7 @@
  * Sync cloud-managed (platform) assistants into the local lockfile.
  *
  * - Adds new platform assistants that aren't in the lockfile yet.
- * - Removes lockfile entries whose IDs are no longer returned by the platform
+ * - Removes lockfile entries whose IDs are no longer returned by the cloud
  *   (e.g. retired assistants).
  *
  * Used by both `cadet login` and `cadet ps` to keep the lockfile fresh.
@@ -10,10 +10,10 @@
  * **Contract:** callers must verify the user is logged in (i.e. a non-empty
  * platform token exists) before invoking this helper. The "is there a token?"
  * decision belongs at the command level so commands can render the right
- * "Platform: …" status without ever entering the platform fetch path.
+ * "Platform: …" status without ever entering the cloud fetch path.
  */
 
-import { isManagedCloud } from "./managed-cloud.js";
+import { isCloudHome } from "./cloud-values.js";
 import {
   loadAllAssistants,
   removeAssistantEntry,
@@ -21,9 +21,9 @@ import {
 } from "./assistant-config.js";
 import {
   fetchCurrentUser,
-  fetchPlatformAssistants,
-  getPlatformUrl,
-} from "./platform-client.js";
+  fetchCloudAssistants,
+  getCloudUrl,
+} from "./cloud-client.js";
 
 export type SyncLogger = (message: string) => void;
 
@@ -58,12 +58,12 @@ export async function syncCloudAssistants(
 ): Promise<SyncResult | null> {
   if (!token) {
     throw new Error(
-      "syncCloudAssistants called without a token. Callers must check `readPlatformToken()` first.",
+      "syncCloudAssistants called without a token. Callers must check `readCloudToken()` first.",
     );
   }
   const log = options?.log;
-  const platformUrl = getPlatformUrl();
-  log?.(`Platform URL: ${platformUrl}`);
+  const cloudUrl = getCloudUrl();
+  log?.(`Platform URL: ${cloudUrl}`);
   log?.(`Token found (${token.length} chars, prefix: ${token.slice(0, 6)}…)`);
 
   // Fetch user info for the login status line
@@ -83,12 +83,12 @@ export async function syncCloudAssistants(
     }
   }
 
-  let platformAssistants: { id: string; name: string; status: string }[];
+  let cloudAssistants: { id: string; name: string; status: string }[];
   try {
     log?.("Fetching Cadet Cloud assistants…");
-    platformAssistants = await fetchPlatformAssistants(token);
+    cloudAssistants = await fetchCloudAssistants(token);
     log?.(
-      `Cadet Cloud returned ${platformAssistants.length} assistant(s): ${platformAssistants.map((a) => a.name || a.id).join(", ") || "(none)"}`,
+      `Cadet Cloud returned ${cloudAssistants.length} ${cloudAssistants.length === 1 ? "assistant" : "assistants"}: ${cloudAssistants.map((a) => a.name || a.id).join(", ") || "(none)"}`,
     );
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
@@ -101,29 +101,29 @@ export async function syncCloudAssistants(
     return null;
   }
 
-  if (platformAssistants.length === 0) {
+  if (cloudAssistants.length === 0) {
     log?.(
       "Cadet Cloud returned 0 assistants — this may mean the API returned a non-ok status (check token validity)",
     );
   }
 
-  const platformIds = new Set(platformAssistants.map((a) => a.id));
+  const platformIds = new Set(cloudAssistants.map((a) => a.id));
 
   // Add new platform assistants not yet in the lockfile
   const existingCloudEntries = loadAllAssistants().filter((a) =>
-    isManagedCloud(a.cloud),
+    isCloudHome(a.cloud),
   );
   const existingCloudById = new Map(
     existingCloudEntries.map((a) => [a.assistantId, a]),
   );
   const existingCloudIds = new Set(existingCloudById.keys());
   log?.(
-    `Lockfile has ${existingCloudIds.size} cloud assistant(s): ${[...existingCloudIds].join(", ") || "(none)"}`,
+    `Lockfile has ${existingCloudIds.size} ${existingCloudIds.size === 1 ? "cloud assistant" : "cloud assistants"}: ${[...existingCloudIds].join(", ") || "(none)"}`,
   );
 
   let added = 0;
   let updated = 0;
-  for (const pa of platformAssistants) {
+  for (const pa of cloudAssistants) {
     const existing = existingCloudById.get(pa.id);
     const assistantName = pa.name.trim();
     const nameFields = assistantName ? { name: assistantName } : {};
@@ -132,7 +132,7 @@ export async function syncCloudAssistants(
       saveAssistantEntry({
         assistantId: pa.id,
         ...nameFields,
-        runtimeUrl: getPlatformUrl(),
+        runtimeUrl: getCloudUrl(),
         cloud: "cloud",
         hatchedAt: new Date().toISOString(),
       });
@@ -147,7 +147,7 @@ export async function syncCloudAssistants(
     }
   }
 
-  // Remove stale lockfile entries that the platform no longer knows about
+  // Remove stale lockfile entries that the cloud no longer knows about
   let removed = 0;
   for (const id of existingCloudIds) {
     if (!platformIds.has(id)) {

package/src/lib/teleport-backup.ts

@@ -23,7 +23,7 @@ import {
 
 import type { AssistantEntry } from "./assistant-config.js";
 import { loopbackSafeFetch } from "./loopback-fetch.js";
-import { authHeaders, invalidateOrgIdCache } from "./platform-client.js";
+import { authHeaders, invalidateOrgIdCache } from "./cloud-client.js";
 import { z } from "zod";
 
 const ManagedBackupEntrySchema = z.object({
@@ -53,7 +53,7 @@ async function errorSuffix(response: Response): Promise<string> {
 }
 
 /**
- * Send a platform backup request with user-session auth, refreshing the
+ * Send a cloud backup request with user-session auth, refreshing the
  * cached organization id once on 401 (the same recovery the runtime identity
  * probe applies).
  */
@@ -93,7 +93,7 @@ async function fetchPlatformBackups(
 }
 
 /**
- * `created_at` of every restorable PVC snapshot of a platform assistant:
+ * `created_at` of every restorable PVC snapshot of a cloud assistant:
  * `GET /v1/assistants/<id>/backups/`.
  */
 export async function listPlatformBackups(
@@ -109,7 +109,7 @@ export interface CreatePlatformBackupOptions {
 }
 
 /**
- * Take a PVC snapshot of a platform assistant and wait until it is
+ * Take a PVC snapshot of a cloud assistant and wait until it is
  * restorable: `POST /v1/assistants/<id>/backups/`, then re-list until the
  * returned `snapshot_name` reports `ready_to_use`. Throws if the POST fails
  * or the snapshot is not ready within `timeoutMs`.