@mycadet/cli 0.12.7 → 0.12.9

package/src/index.ts

@@ -14,6 +14,7 @@ import cliPkg from "../package.json";
 import { backup } from "./commands/backup";
 import { clean } from "./commands/clean";
 import { client } from "./commands/client";
+import { completeCadet, completions } from "./commands/completions";
 import { confirm } from "./commands/confirm";
 import { connect } from "./commands/connect";
 import { devices } from "./commands/devices";
@@ -27,14 +28,12 @@ import { logs } from "./commands/logs";
 import { message } from "./commands/message";
 import { pair } from "./commands/pair";
 import { ps } from "./commands/ps";
-import { recover } from "./commands/recover";
 import { restore } from "./commands/restore";
-import { roadmap } from "./commands/roadmap";
 import { retire } from "./commands/retire";
+import { restart } from "./commands/restart";
 import { rollback } from "./commands/rollback";
 import { setup } from "./commands/setup";
 import { sleep } from "./commands/sleep";
-import { ssh } from "./commands/ssh";
 import { debug } from "./commands/debug";
 import { teleport } from "./commands/teleport";
 import { terminal } from "./commands/terminal";
@@ -45,7 +44,6 @@ import { upgrade } from "./commands/upgrade";
 import { use } from "./commands/use";
 import { voice } from "./commands/voice";
 import { wake } from "./commands/wake";
-import { workflows } from "./commands/workflows";
 import { red } from "./lib/color";
 import { resolveAssistant, setActiveAssistant } from "./lib/assistant-config";
 import { loadGuardianToken } from "./lib/guardian-token";
@@ -56,6 +54,7 @@ const commands = {
   backup,
   clean,
   client,
+  completions,
   confirm,
   connect,
   debug,
@@ -66,19 +65,17 @@ const commands = {
   gateway,
   hatch,
   login,
-  logout,
   logs,
+  logout,
   message,
   pair,
   ps,
-  recover,
   restore,
   retire,
-  roadmap,
+  restart,
   rollback,
   setup,
   sleep,
-  ssh,
   teleport,
   terminal,
   tunnel,
@@ -89,7 +86,6 @@ const commands = {
   voice,
   wake,
   whoami,
-  workflows,
 };
 
 type CommandName = keyof typeof commands;
@@ -237,6 +233,19 @@ async function main() {
     process.exit(0);
   }
 
+  // Hidden completion hook: the bash completion script calls
+  // `cadet __complete <words-up-to-cursor>` and filters the printed
+  // candidates against the word under the cursor. Deliberately unlisted in
+  // the command map so it never shows up in help.
+  if (commandName === "__complete") {
+    const candidates = completeCadet(
+      process.argv.slice(3),
+      Object.keys(commands),
+    );
+    console.log(candidates.join("\n"));
+    process.exit(0);
+  }
+
   const command = commands[commandName as CommandName];
 
   if (!command) {

package/src/lib/__tests__/{platform-client-signed-url.test.ts → cloud-client-signed-url.test.ts}

@@ -2,10 +2,10 @@ import { afterEach, beforeEach, describe, expect, mock, test } from "bun:test";
 
 import {
   platformPollJobStatus,
-  platformRequestSignedUrl,
+  cloudRequestSignedUrl,
   VersionMismatchError,
   type UnifiedJobStatus,
-} from "../platform-client.js";
+} from "../cloud-client.js";
 
 const PLATFORM_URL = "https://platform.example.test";
 const VAK_TOKEN = "vak_test_1234567890"; // API-key path skips org-ID fetch.
@@ -69,7 +69,7 @@ afterEach(() => {
   globalThis.fetch = originalFetch;
 });
 
-describe("platformRequestSignedUrl", () => {
+describe("cloudRequestSignedUrl", () => {
   test("upload operation with just operation → posts correct body and parses response", async () => {
     const { calls, fetchMock } = captureFetch(() => {
       return new Response(
@@ -83,7 +83,7 @@ describe("platformRequestSignedUrl", () => {
     });
     globalThis.fetch = fetchMock;
 
-    const result = await platformRequestSignedUrl(
+    const result = await cloudRequestSignedUrl(
       { operation: "upload" },
       VAK_TOKEN,
       PLATFORM_URL,
@@ -117,7 +117,7 @@ describe("platformRequestSignedUrl", () => {
     });
     globalThis.fetch = fetchMock;
 
-    const result = await platformRequestSignedUrl(
+    const result = await cloudRequestSignedUrl(
       {
         operation: "upload",
         contentType: "application/octet-stream",
@@ -148,7 +148,7 @@ describe("platformRequestSignedUrl", () => {
     });
     globalThis.fetch = fetchMock;
 
-    const result = await platformRequestSignedUrl(
+    const result = await cloudRequestSignedUrl(
       { operation: "download", bundleKey: "bundles/xyz.tar.gz" },
       VAK_TOKEN,
       PLATFORM_URL,
@@ -182,7 +182,7 @@ describe("platformRequestSignedUrl", () => {
     });
     globalThis.fetch = fetchMock;
 
-    const result = await platformRequestSignedUrl(
+    const result = await cloudRequestSignedUrl(
       { operation: "upload" },
       VAK_TOKEN,
       PLATFORM_URL,
@@ -263,7 +263,7 @@ describe("platformRequestSignedUrl", () => {
     );
     globalThis.fetch = fetchMock as unknown as typeof globalThis.fetch;
 
-    const result = await platformRequestSignedUrl(
+    const result = await cloudRequestSignedUrl(
       { operation: "upload" },
       SESSION_TOKEN,
       PLATFORM_URL,
@@ -305,7 +305,7 @@ describe("platformRequestSignedUrl", () => {
     });
     globalThis.fetch = fetchMock;
 
-    await platformRequestSignedUrl(
+    await cloudRequestSignedUrl(
       {
         operation: "upload",
         minRuntimeVersion: "1.2.3",
@@ -335,7 +335,7 @@ describe("platformRequestSignedUrl", () => {
     });
     globalThis.fetch = fetchMock;
 
-    await platformRequestSignedUrl(
+    await cloudRequestSignedUrl(
       {
         operation: "download",
         bundleKey: "bundles/dl-v.tar.gz",
@@ -370,7 +370,7 @@ describe("platformRequestSignedUrl", () => {
 
     let caught: unknown;
     try {
-      await platformRequestSignedUrl(
+      await cloudRequestSignedUrl(
         {
           operation: "download",
           bundleKey: "bundles/foo.tar.gz",
@@ -414,7 +414,7 @@ describe("platformRequestSignedUrl", () => {
 
     let caught: unknown;
     try {
-      await platformRequestSignedUrl(
+      await cloudRequestSignedUrl(
         {
           operation: "download",
           bundleKey: "bundles/foo.tar.gz",
@@ -444,7 +444,7 @@ describe("platformRequestSignedUrl", () => {
 
     let caught: unknown;
     try {
-      await platformRequestSignedUrl(
+      await cloudRequestSignedUrl(
         { operation: "download", bundleKey: "bundles/foo.tar.gz" },
         VAK_TOKEN,
         PLATFORM_URL,
@@ -483,7 +483,7 @@ describe("platformRequestSignedUrl", () => {
 
     let caught: unknown;
     try {
-      await platformRequestSignedUrl(
+      await cloudRequestSignedUrl(
         {
           operation: "download",
           bundleKey: "bundles/foo.tar.gz",
@@ -513,7 +513,7 @@ describe("platformRequestSignedUrl", () => {
     });
     globalThis.fetch = fetchMock;
 
-    const result = await platformRequestSignedUrl(
+    const result = await cloudRequestSignedUrl(
       { operation: "download", bundleKey: "bundles/xyz.tar.gz" },
       VAK_TOKEN,
       PLATFORM_URL,
@@ -535,7 +535,7 @@ describe("platformRequestSignedUrl", () => {
     globalThis.fetch = fetchMock;
 
     await expect(
-      platformRequestSignedUrl(
+      cloudRequestSignedUrl(
         { operation: "upload" },
         VAK_TOKEN,
         PLATFORM_URL,

package/src/lib/__tests__/docker.test.ts

@@ -8,6 +8,7 @@ import {
   collectWatchTargets,
   dockerResourceNames,
   ensureDockerDaemonRunning,
+  pullImage,
   resolveAvatarDevicePath,
   resolveDockerHatchMode,
   resolveDockerProviderCredentialSetupAction,
@@ -158,6 +159,38 @@ describe("resolveDockerProviderCredentialSetupAction", () => {
       }),
     ).toBe("skip");
   });
+
+  test("detached hatch with a pre-collected key configures instead of deferring", () => {
+    expect(
+      resolveDockerProviderCredentialSetupAction({
+        provider: "fireworks",
+        guardianAccessToken: "guardian-token",
+        detached: true,
+        precollectedKey: "fw-key-123",
+      }),
+    ).toBe("configure");
+  });
+
+  test("pre-collected key without a guardian token reports missing-token (no silent defer)", () => {
+    expect(
+      resolveDockerProviderCredentialSetupAction({
+        provider: "fireworks",
+        detached: true,
+        precollectedKey: "fw-key-123",
+      }),
+    ).toBe("missing-token");
+  });
+
+  test("an explicitly skipped key still counts as answered — configure runs and reports the gap", () => {
+    expect(
+      resolveDockerProviderCredentialSetupAction({
+        provider: "fireworks",
+        guardianAccessToken: "guardian-token",
+        detached: true,
+        precollectedKey: "",
+      }),
+    ).toBe("configure");
+  });
 });
 
 describe("buildServiceRunArgs — gateway", () => {
@@ -384,25 +417,48 @@ describe("collectWatchTargets", () => {
 });
 
 /**
- * Build a fake `exec` that records calls and fails the probes named in `fail`.
- * Injected into `ensureDockerDaemonRunning` so these cases need no `mock.module`
- * (which is process-global and would leak across the CLI's single-process test
- * run) and no real Docker/Colima subprocesses.
+ * Build a STATEFUL fake `exec` modeling the Docker daemon + Colima interplay:
+ * `docker info` succeeds only while `daemonUp`; a `colima start` heals the
+ * daemon (unless the fake is told to model the zombie state, where Colima's
+ * state file says "already running, ignoring" but the daemon stays dead —
+ * only the stop → start cycle recovers). Injected into
+ * `ensureDockerDaemonRunning` so these cases need no `mock.module` (which is
+ * process-global and would leak across the CLI's single-process test run) and
+ * no real Docker/Colima subprocesses.
  */
-function fakeExec(fail: { dockerInfo?: boolean; colimaStatus?: boolean }) {
+function fakeExec(
+  opts: {
+    /** Daemon already reachable when the test starts. */
+    daemonUpAtStart?: boolean;
+    /** `colima start` exits nonzero instead of healing. */
+    startFails?: boolean;
+    /** First `colima start` is a zombie no-op that does NOT heal the daemon. */
+    zombieFirstStart?: boolean;
+  } = {},
+) {
   const calls: Array<{ cmd: string; args: string[] }> = [];
+  let daemonUp = opts.daemonUpAtStart ?? false;
+  let starts = 0;
   const exec = async (cmd: string, args: string[] = []): Promise<void> => {
     calls.push({ cmd, args });
-    if (cmd === "docker" && args[0] === "info" && fail.dockerInfo) {
-      throw new Error("Cannot connect to the Docker daemon");
+    if (cmd === "docker" && args[0] === "info") {
+      if (!daemonUp) throw new Error("Cannot connect to the Docker daemon");
+      return;
+    }
+    if (cmd === "colima" && args[0] === "start") {
+      starts++;
+      if (opts.startFails) throw new Error("colima start exited 1");
+      if (!opts.zombieFirstStart || starts > 1) daemonUp = true;
+      return;
     }
-    if (cmd === "colima" && args[0] === "status" && fail.colimaStatus) {
-      throw new Error("colima is not running");
+    if (cmd === "colima" && args[0] === "stop") {
+      daemonUp = false;
+      return;
     }
   };
   const ran = (cmd: string, sub: string): boolean =>
     calls.some((c) => c.cmd === cmd && c.args[0] === sub);
-  return { exec: exec as typeof import("../step-runner.js").exec, ran };
+  return { exec, ran };
 }
 
 describe("ensureDockerDaemonRunning", () => {
@@ -410,30 +466,122 @@ describe("ensureDockerDaemonRunning", () => {
   // Colima, because that switches the active `docker context` and points
   // `docker start` at a VM that never held the instance's containers.
   test("reuses an already-reachable daemon (e.g. Docker Desktop) and never touches Colima", async () => {
-    const { exec, ran } = fakeExec({ dockerInfo: false });
+    const { exec, ran } = fakeExec({ daemonUpAtStart: true });
 
     await ensureDockerDaemonRunning(exec);
 
     expect(ran("docker", "info")).toBe(true);
-    expect(ran("colima", "status")).toBe(false);
     expect(ran("colima", "start")).toBe(false);
+    expect(ran("colima", "stop")).toBe(false);
   });
 
-  test("starts Colima only when no daemon is reachable", async () => {
-    const { exec, ran } = fakeExec({ dockerInfo: true, colimaStatus: true });
+  test("starts Colima when no daemon is reachable and confirms the daemon answered", async () => {
+    const { exec, ran } = fakeExec();
 
-    await ensureDockerDaemonRunning(exec);
+    await ensureDockerDaemonRunning(exec, { settleTimeoutMs: 0 });
 
     expect(ran("docker", "info")).toBe(true);
     expect(ran("colima", "start")).toBe(true);
+    expect(ran("colima", "stop")).toBe(false);
   });
 
-  test("does not restart Colima when it is already running", async () => {
-    const { exec, ran } = fakeExec({ dockerInfo: true, colimaStatus: false });
+  // Regression (v0.12.8 release feedback): a zombie Colima — stale state file
+  // saying "already running" while the daemon inside is dead — used to sail
+  // through wake (no `colima status` oracle anymore) and leave every later
+  // docker command dying on the unreachable socket.
+  test("recovers a zombie Colima: start no-ops, daemon stays dead → stop --force → start → daemon up", async () => {
+    const { exec, ran } = fakeExec({ zombieFirstStart: true });
 
-    await ensureDockerDaemonRunning(exec);
+    await ensureDockerDaemonRunning(exec, { settleTimeoutMs: 0 });
 
-    expect(ran("colima", "status")).toBe(true);
-    expect(ran("colima", "start")).toBe(false);
+    expect(ran("colima", "start")).toBe(true);
+    expect(ran("colima", "stop")).toBe(true);
+  });
+
+  test("never deletes the Colima VM — the VM disk holds every image and volume", async () => {
+    const { exec, ran } = fakeExec({ zombieFirstStart: true });
+
+    await ensureDockerDaemonRunning(exec, { settleTimeoutMs: 0 });
+
+    expect(ran("colima", "delete")).toBe(false);
+  });
+
+  test("throws an actionable error when even the restart cannot bring the daemon up", () => {
+    // A start that always exits nonzero: the first failure surfaces its
+    // output, the recovery stop+start runs, and the final wait still finds
+    // no daemon → the helper throws instead of letting hatch proceed.
+    const { exec } = fakeExec({ startFails: true });
+    expect(
+      ensureDockerDaemonRunning(exec, { settleTimeoutMs: 0 }),
+    ).rejects.toThrow(/Failed to restart Colima/);
+  });
+});
+
+describe("pullImage", () => {
+  function fakePull(
+    opts: {
+      failFirstPullWith?: string;
+      failAllPullsWith?: string;
+    } = {},
+  ) {
+    const calls: Array<{ cmd: string; args: string[] }> = [];
+    let pulls = 0;
+    const exec = async (cmd: string, args: string[] = []): Promise<void> => {
+      calls.push({ cmd, args });
+      if (cmd === "docker" && args[0] === "pull") {
+        pulls++;
+        if (opts.failAllPullsWith) throw new Error(opts.failAllPullsWith);
+        if (opts.failFirstPullWith && pulls === 1) {
+          throw new Error(opts.failFirstPullWith);
+        }
+      }
+      // `docker logout` (and anything else) succeeds silently.
+    };
+    const ran = (sub: string): boolean =>
+      calls.some((c) => c.cmd === "docker" && c.args[0] === sub);
+    return { exec, ran };
+  }
+
+  test("pulls without touching stored credentials on success", async () => {
+    const { exec, ran } = fakePull();
+
+    await pullImage("mycadet/mycadet-assistant:v1", () => {}, exec);
+
+    expect(ran("pull")).toBe(true);
+    expect(ran("logout")).toBe(false);
+  });
+
+  test("clears stale Docker Hub credentials and retries once on an expired-token error", async () => {
+    const { exec, ran } = fakePull({
+      failFirstPullWith:
+        "Error response from daemon: authentication required - personal access token is expired",
+    });
+
+    await pullImage("mycadet/mycadet-assistant:v1", () => {}, exec);
+
+    expect(ran("logout")).toBe(true);
+  });
+
+  test("wraps the failure with actionable copy when the auth retry also fails", () => {
+    const { exec } = fakePull({
+      failAllPullsWith:
+        "Error response from daemon: authentication required - personal access token is expired",
+    });
+
+    expect(
+      pullImage("mycadet/mycadet-assistant:v1", () => {}, exec),
+    ).rejects.toThrow("Failed to pull mycadet/mycadet-assistant:v1");
+  });
+
+  test("rethrows non-auth pull errors raw and never logs out", () => {
+    const { exec, ran } = fakePull({
+      failAllPullsWith:
+        "Cannot connect to the Docker daemon at unix:///var/run/docker.sock",
+    });
+
+    expect(
+      pullImage("mycadet/mycadet-assistant:v1", () => {}, exec),
+    ).rejects.toThrow("Cannot connect to the Docker daemon");
+    expect(ran("logout")).toBe(false);
   });
 });

package/src/lib/__tests__/job-polling.test.ts

@@ -1,7 +1,7 @@
 import { afterEach, beforeEach, describe, expect, spyOn, test } from "bun:test";
 
 import { pollJobUntilDone } from "../job-polling.js";
-import type { UnifiedJobStatus } from "../platform-client.js";
+import type { UnifiedJobStatus } from "../cloud-client.js";
 
 describe("pollJobUntilDone", () => {
   test("returns terminal 'complete' after N processing polls", async () => {
@@ -203,7 +203,7 @@ describe("pollJobUntilDone", () => {
       expect(refreshes).toBe(1);
       expect(calls).toBe(2);
       // The 401 branch logs its own distinct warning (not the generic
-      // "polling failed, retrying" one) so operators can distinguish an
+      // "polling failed:" one) so operators can distinguish an
       // auth refresh from a transient-error retry in the output.
       expect(warnSpy).toHaveBeenCalledWith(
         expect.stringContaining("refreshing auth"),

package/src/lib/__tests__/local-runtime-client.test.ts

@@ -14,7 +14,7 @@ const TOKEN = "local-bearer-token";
 
 // All tests in this file exercise the local/docker code path (cloud="local"),
 // which builds `{runtimeUrl}/v1/migrations/<subpath>` URLs and uses
-// guardian-token bearer auth. The platform path (cloud="cadet") is covered
+// guardian-token bearer auth. The cloud path (cloud="cadet") is covered
 // by `runtime-url.test.ts` (URL construction) and the teleport tests
 // (call-site wiring).
 const ENTRY: Pick<AssistantEntry, "cloud" | "runtimeUrl" | "assistantId"> = {
@@ -384,7 +384,7 @@ describe("localRuntimePollJobStatus", () => {
 });
 
 // ---------------------------------------------------------------------------
-// Platform-managed assistants (cloud="cadet") route through the platform's
+// Cloud assistants (cloud="cadet") route through the cloud's
 // wildcard runtime proxy at `/v1/assistants/<id>/migrations/...` with
 // platform-token auth (NOT guardian-token bearer). This block asserts the
 // actual URL and headers built by the helpers — not mocked, not abstracted.
@@ -588,7 +588,7 @@ describe("localRuntimeIdentity", () => {
   });
 
   // ---------------------------------------------------------------------
-  // 401-retry parity with platformRequestSignedUrl (Codex P2 regression
+  // 401-retry parity with cloudRequestSignedUrl (Codex P2 regression
   // guard). localRuntimeIdentity is the first network call in the
   // backup/teleport export flow for cadet-cloud assistants, so a stale
   // Cadet-Organization-Id cache entry would surface as a hard abort
@@ -613,7 +613,7 @@ describe("localRuntimeIdentity", () => {
         orgIdFetchedAs.push(`org-${orgIdFetchedAs.length + 1}`);
         return new Response(
           JSON.stringify({
-            results: [{ id: orgIdFetchedAs[orgIdFetchedAs.length - 1]! }],
+            results: [{ id: orgIdFetchedAs[orgIdFetchedAs.length - 1]!, name: "My Cadet" }],
           }),
           { status: 200 },
         );

package/src/lib/__tests__/runtime-url.test.ts

@@ -49,7 +49,7 @@ describe("resolveRuntimeMigrationUrl", () => {
     );
   });
 
-  test("cadet (platform-managed) cloud uses wildcard-proxy /v1/assistants/<id>/migrations/<subpath>", () => {
+  test("cadet (cloud-managed) cloud uses wildcard-proxy /v1/assistants/<id>/migrations/<subpath>", () => {
     const entry = makeEntry({
       cloud: "cadet",
       runtimeUrl: "https://cloud.mycadet.ai",

package/src/lib/assistant-api-key-resolution.ts

@@ -8,8 +8,8 @@
 import {
   readGatewayCredential,
   reprovisionAssistantApiKey,
-  verifyGatewayManagedCredential,
-} from "./platform-client.js";
+  verifyGatewayCloudCredential,
+} from "./cloud-client.js";
 
 /** Where the key came from, so callers can report what they did. */
 export type AssistantApiKeySource =
@@ -39,13 +39,13 @@ export interface ResolvedAssistantApiKey {
  * Three steps, in order: the key the registration just issued, the key the
  * assistant already holds, then a rotation.
  *
- * A stored key the platform has rejected is skipped, because reinjecting it
+ * A stored key the cloud has rejected is skipped, because reinjecting it
  * repairs nothing while looking like a repair. The verdict is asked for
  * before the key is read, so the key returned is one the verdict covers: a
  * repair that lands between the two requests is then read, not overwritten
  * by the value it replaced. Rotation is still withheld when the gateway is
  * merely unreachable: rotating without being able to store the replacement
- * would start the platform's grace clock on a key the assistant still needs,
+ * would start the cloud's grace clock on a key the assistant still needs,
  * with nothing to hand it in exchange.
  */
 export async function resolveAssistantApiKeyForInjection(
@@ -55,7 +55,7 @@ export async function resolveAssistantApiKeyForInjection(
     return { apiKey: args.registrationApiKey, source: "registration" };
   }
 
-  const status = await verifyGatewayManagedCredential(
+  const status = await verifyGatewayCloudCredential(
     args.runtimeUrl,
     args.bearerToken,
   );

package/src/lib/assistant-client.ts

@@ -14,10 +14,10 @@
  * The auth scheme follows the assistant's topology, so callers never pick it.
  * Platform-managed entries in particular have no local guardian token: they
  * authenticate against the wildcard runtime proxy at
- * `{platformUrl}/v1/assistants/<id>/<rest>` with the stored cloud credential.
+ * `{cloudUrl}/v1/assistants/<id>/<rest>` with the stored cloud credential.
  */
 
-import { isManagedCloud } from "./managed-cloud.js";
+import { isCloudHome } from "./cloud-values.js";
 import { resolveAssistant } from "./assistant-config.js";
 import { GATEWAY_PORT } from "./constants.js";
 import {
@@ -29,8 +29,8 @@ import { loopbackSafeFetch } from "./loopback-fetch.js";
 import {
   authHeaders,
   invalidateOrgIdCache,
-  readPlatformToken,
-} from "./platform-client.js";
+  readCloudToken,
+} from "./cloud-client.js";
 
 const DEFAULT_TIMEOUT_MS = 30_000;
 const FALLBACK_RUNTIME_URL = `http://127.0.0.1:${GATEWAY_PORT}`;
@@ -54,7 +54,7 @@ export interface AssistantClientOpts {
    * sent as `X-Session-Token: <sessionToken>` and the org id is
    * sent via the `Cadet-Organization-Id` header.
    *
-   * Platform-managed assistants do NOT need this: they are detected from the
+   * Cloud assistants do NOT need this: they are detected from the
    * lockfile entry and authenticated from the stored platform token.
    */
   sessionToken?: string;
@@ -75,7 +75,7 @@ export class AssistantClient {
   private readonly _assistantId: string;
   /**
    * The credential for the current mode. Mutable: a 401 on the guardian path
-   * refreshes it in place (see request), and the platform path fills it in on
+   * refreshes it in place (see request), and the cloud path fills it in on
    * first use (see resolveAuthHeaders).
    */
   private token: string | undefined;
@@ -103,7 +103,7 @@ export class AssistantClient {
     }
 
     this._assistantId = entry.assistantId;
-    const platformManaged = !opts?.sessionToken && isManagedCloud(entry.cloud);
+    const platformManaged = !opts?.sessionToken && isCloudHome(entry.cloud);
     const platformHost = stripTrailingSlashes(entry.runtimeUrl);
 
     // SECURITY: a cloud credential is account-scoped, far broader than the
@@ -155,7 +155,7 @@ export class AssistantClient {
    * error rather than letting an anonymous request fall through to a bare 403.
    */
   private requirePlatformToken(): string {
-    const token = readPlatformToken();
+    const token = readCloudToken();
     if (!token) {
       throw new Error(
         "Not logged in. Run `cadet login` first to authenticate with Cadet Cloud.",