@mycadet/cli 0.12.7 → 0.12.9

package/src/lib/cloud-login.ts

@@ -10,7 +10,7 @@ import { randomBytes } from "crypto";
 import { createServer } from "http";
 import type { AddressInfo } from "net";
 
-import { isManagedCloud } from "./managed-cloud.js";
+import { isCloudHome } from "./cloud-values.js";
 import {
   resolveAssistant,
   saveAssistantEntry,
@@ -22,11 +22,11 @@ import {
   fetchCurrentUser,
   fetchOrganizationId,
   ensureSelfHostedLocalRegistration,
-  getPlatformUrl,
+  getCloudUrl,
   injectCredentialsIntoAssistant,
-  readPlatformToken,
-  savePlatformToken,
-} from "./platform-client.js";
+  readCloudToken,
+  saveCloudToken,
+} from "./cloud-client.js";
 import { fetchAssistantIngressUrl, fetchCurrentVersion } from "./upgrade-lifecycle.js";
 import {
   CALLBACK_PATH,
@@ -257,8 +257,8 @@ export function startLoopbackListener(
 }
 
 /** App-held WorkOS PKCE login */
-export async function workosPkceLogin(platformUrl: string): Promise<string> {
-  const clientId = await fetchWorkosClientId(platformUrl);
+export async function workosPkceLogin(cloudUrl: string): Promise<string> {
+  const clientId = await fetchWorkosClientId(cloudUrl);
   const { verifier, challenge } = generatePkcePair();
   const state = randomBytes(32).toString("hex");
 
@@ -286,7 +286,7 @@ export async function workosPkceLogin(platformUrl: string): Promise<string> {
       verifier,
     });
     return await exchangeAccessTokenForSession(
-      platformUrl,
+      cloudUrl,
       clientId,
       accessToken,
     );
@@ -307,7 +307,7 @@ export interface CloudLoginSession {
  * validates the resulting token, and persists it.
  */
 export async function ensureCloudLoginInteractive(): Promise<CloudLoginSession> {
-  const existingToken = readPlatformToken();
+  const existingToken = readCloudToken();
   if (existingToken) {
     try {
       const user = await fetchCurrentUser(existingToken);
@@ -317,16 +317,16 @@ export async function ensureCloudLoginInteractive(): Promise<CloudLoginSession>
     }
   }
 
-  const token = await workosPkceLogin(getPlatformUrl());
+  const token = await workosPkceLogin(getCloudUrl());
   const user = await fetchCurrentUser(token);
-  savePlatformToken(token);
+  saveCloudToken(token);
   return { token, user };
 }
 
 /**
  * TLS failures surface as opaque messages like "unknown certificate
  * verification error" from Bun's fetch. Translate the recognizable ones into
- * something actionable — most commonly the platform host's managed
+ * something actionable — most commonly the cloud host's managed
  * certificate is still provisioning.
  */
 export function describeLoginError(error: unknown): string {
@@ -335,13 +335,13 @@ export function describeLoginError(error: unknown): string {
   if (!tlsish) return raw;
   return (
     `Cadet Cloud is unreachable (${raw}). This usually means ` +
-    `${getPlatformUrl()}'s TLS certificate is missing or still provisioning. ` +
-    "Retry in a few minutes, or point CADET_PLATFORM_URL at a reachable host."
+    `${getCloudUrl()}'s TLS certificate is missing or still provisioning. ` +
+    "Retry in a few minutes, or point CADET_CLOUD_URL at a reachable host."
   );
 }
 
 /**
- * Register the active self-hosted assistant with the platform and inject
+ * Register the active self-hosted assistant with the cloud and inject
  * cloud credentials into its runtime — the post-login half of the desktop
  * app's LocalAssistantBootstrapService flow. Extracted so `cadet hatch` can
  * complete the same flow right after an interactive login on the Cadet Cloud
@@ -355,8 +355,8 @@ export async function registerLocalAssistantWithPlatform(
   const log = options.log ?? console.log;
   const entry = resolveAssistant();
 
-  // Skip managed ("cadet") assistants — they are handled by the platform.
-  if (!entry || isManagedCloud(entry.cloud)) return;
+  // Skip managed ("cadet") assistants — they are handled by the cloud.
+  if (!entry || isCloudHome(entry.cloud)) return;
 
   const orgId = await fetchOrganizationId(token);
   const clientInstallationId = computeDeviceId();
@@ -364,7 +364,7 @@ export async function registerLocalAssistantWithPlatform(
     fetchCurrentVersion(entry.runtimeUrl),
     fetchAssistantIngressUrl(entry.runtimeUrl, options.bearerToken ?? entry.bearerToken),
   ]);
-  const platformUrl = getPlatformUrl();
+  const cloudUrl = getCloudUrl();
   const registration = await ensureSelfHostedLocalRegistration(
     token,
     orgId,
@@ -372,14 +372,14 @@ export async function registerLocalAssistantWithPlatform(
     entry.assistantId,
     "cli",
     assistantVersion,
-    platformUrl,
+    cloudUrl,
     ingressUrl,
   );
   saveAssistantEntry({
     ...entry,
-    platformAssistantId: registration.assistant.id,
-    platformBaseUrl: platformUrl,
-    platformOrganizationId: orgId,
+    cloudAssistantId: registration.assistant.id,
+    cloudBaseUrl: cloudUrl,
+    cloudOrganizationId: orgId,
   });
   log(
     `Registered assistant: ${registration.assistant.name} (${registration.assistant.id})`,
@@ -408,8 +408,8 @@ export async function registerLocalAssistantWithPlatform(
     gatewayUrl: entry.runtimeUrl,
     bearerToken: options.bearerToken ?? entry.bearerToken,
     assistantApiKey,
-    platformAssistantId: registration.assistant.id,
-    platformBaseUrl: platformUrl,
+    cloudAssistantId: registration.assistant.id,
+    cloudBaseUrl: cloudUrl,
     organizationId: orgId,
     userId: user.id,
     webhookSecret: registration.webhook_secret,

package/src/lib/{platform-releases.ts → cloud-releases.ts}

@@ -1,4 +1,4 @@
-import { getPlatformUrl } from "./platform-client.js";
+import { getCloudUrl } from "./cloud-client.js";
 import { dockerhubImages } from "./docker.js";
 import type { ServiceName } from "./docker.js";
 import { loopbackSafeFetch } from "./loopback-fetch.js";
@@ -40,20 +40,20 @@ const RELEASES_FETCH_LIMIT = 100;
 /**
  * Fetch the releases list from Cadet Cloud, optionally filtered by channel
  * (the `channel` param takes precedence over `stable` server-side).
- * `platformUrl` overrides the lockfile/env-resolved default — pass the
+ * `cloudUrl` overrides the lockfile/env-resolved default — pass the
  * target assistant's platform URL when it may differ from the active one.
  * Returns `null` when Cadet Cloud is unreachable or responds non-OK —
  * distinct from `[]` (it answered, no releases).
  */
 export async function fetchReleases(opts?: {
   channel?: "stable" | "preview";
-  platformUrl?: string;
+  cloudUrl?: string;
 }): Promise<ReleaseListItem[] | null> {
   try {
-    const platformUrl = opts?.platformUrl || getPlatformUrl();
+    const cloudUrl = opts?.cloudUrl || getCloudUrl();
     const filter = opts?.channel ? `channel=${opts.channel}` : "stable=true";
     const response = await loopbackSafeFetch(
-      `${platformUrl}/v1/releases/?${filter}&limit=${RELEASES_FETCH_LIMIT}`,
+      `${cloudUrl}/v1/releases/?${filter}&limit=${RELEASES_FETCH_LIMIT}`,
       { signal: AbortSignal.timeout(10_000) },
     );
     if (!response.ok) return null;
@@ -85,7 +85,9 @@ export async function fetchLatestStableVersion(): Promise<string | null> {
 }
 
 /**
- * Image refs for a target version: the tag is the target version, the repo
+ * Image refs for a target version: the tag is the target version exactly as
+ * the release workflows push it — bare ("0.12.8", "0.12.8-dev…"); a
+ * git-tag-style "v" prefix on the input is tolerated and stripped. The repo
  * follows the CLI's own version shape (dev CLI → `-dev` repos).
  */
 export function resolveImageRefs(
@@ -93,8 +95,8 @@ export function resolveImageRefs(
   cliVersion: string,
 ): Record<ServiceName, string> {
   const versionTag = targetVersion.startsWith("v")
-    ? targetVersion
-    : `v${targetVersion}`;
+    ? targetVersion.slice(1)
+    : targetVersion;
   const images = dockerhubImages(cliVersion);
   return {
     assistant: `${images.assistant}:${versionTag}`,
@@ -107,5 +109,5 @@ export function resolveImageRefs(
 export function resolveOwnImageRefs(
   cliVersion: string,
 ): Record<ServiceName, string> {
-  return resolveImageRefs(cliVersion ? `v${cliVersion}` : "latest", cliVersion);
+  return resolveImageRefs(cliVersion || "latest", cliVersion);
 }

package/src/lib/cloud-values.ts

@@ -0,0 +1,3 @@
+export function isCloudHome(cloud: unknown): boolean {
+  return cloud === "cloud" || cloud === "cadet";
+}

package/src/lib/config-utils.ts

@@ -34,7 +34,7 @@ export function buildNestedConfig(
 
 /**
  * Ensure hatch always provides enough initial LLM config for the assistant to
- * detect a fresh off-platform hatch and seed BYOK profiles.
+ * detect a fresh off-cloud hatch and seed BYOK profiles.
  *
  * @deprecated Part of the workspace-config overlay path — a CLI→Assistant
  * side channel that bypasses the Assistant's public APIs and has no

package/src/lib/detached-process.ts

@@ -6,7 +6,7 @@ import { isCompiledCli } from "./local.js";
 import { getLogDir, openLogFile, resetLogFile } from "./xdg-log.js";
 
 export interface RelaunchDetachedOptions {
-  /** argv for the re-invoked CLI command, e.g. ["tunnel", "--provider", "ngrok"]. */
+  /** argv for the re-invoked CLI command, e.g. ["tunnel", "--provider", "cloudflare"]. */
   args: string[];
   /** Log file basename under the XDG log dir; truncated before spawn. */
   logFile: string;

package/src/lib/docker.ts

@@ -37,9 +37,10 @@ import {
   isLocalBuildRef,
   loadImageViaHost,
 } from "./host-image-loader.js";
-import { resolveOwnImageRefs } from "./platform-releases.js";
+import { resolveOwnImageRefs } from "./cloud-releases.js";
 import { isDevVersion } from "./version-compat.js";
 import {
+  collectProviderApiKey,
   configureHatchProviderApiKey,
   formatProviderName,
   promptProviderChoice,
@@ -340,14 +341,96 @@ export function resolveDockerProviderCredentialSetupAction(options: {
   provider: string | null | undefined;
   guardianAccessToken?: string;
   detached: boolean;
+  /**
+   * Key — or an explicit skip ("") — collected from the user right after
+   * they picked the provider. When present (even empty), the user already
+   * answered at the prompt, so detached hatches configure (or report the
+   * missing key) instead of deferring to a second `cadet setup` run.
+   */
+  precollectedKey?: string;
 }): DockerProviderCredentialSetupAction {
   if (options.provider === undefined) return "skip";
   if (options.provider === null) return options.detached ? "skip" : "configure";
-  if (options.detached) return "defer";
+  if (options.detached) {
+    if (options.precollectedKey !== undefined) {
+      return options.guardianAccessToken ? "configure" : "missing-token";
+    }
+    return "defer";
+  }
   if (!options.guardianAccessToken) return "missing-token";
   return "configure";
 }
 
+/** Time to wait for the Docker daemon to answer `docker info` after a Colima start. */
+const COLIMA_SETTLE_TIMEOUT_MS = 15_000;
+
+/** Poll `docker info` until the daemon answers or the timeout elapses. */
+async function waitForDockerDaemon(
+  execFn: typeof exec,
+  timeoutMs: number,
+): Promise<boolean> {
+  const deadline = Date.now() + timeoutMs;
+  for (;;) {
+    try {
+      await execFn("docker", ["info"]);
+      return true;
+    } catch {
+      if (Date.now() >= deadline) return false;
+      await new Promise((resolve) => setTimeout(resolve, 1000));
+    }
+  }
+}
+
+/**
+ * Start Colima and wait for the Docker daemon to actually answer.
+ *
+ * `colima start` exiting 0 only means Colima's own state file says the VM is
+ * up — that state can be stale (zombie VM after a host sleep or crash), in
+ * which case start is a no-op ("already running, ignoring") while the daemon
+ * inside stays dead. So success is decided by re-probing `docker info`, and a
+ * failed probe triggers the manual-fix cycle: force-stop and start fresh.
+ * Never `colima delete` — the VM disk holds every container image and volume.
+ * `startArgs` carries extra flags (e.g. `--memory`) for a first start; the
+ * wake path starts an existing instance bare.
+ */
+async function startColimaAndAwaitDaemon(
+  execFn: typeof exec,
+  log: (msg: string) => void,
+  opts: { startArgs?: string[]; settleTimeoutMs?: number } = {},
+): Promise<void> {
+  const startArgs = opts.startArgs ?? [];
+  const settleTimeoutMs = opts.settleTimeoutMs ?? COLIMA_SETTLE_TIMEOUT_MS;
+
+  try {
+    await execFn("colima", ["start", ...startArgs]);
+  } catch (err) {
+    // exec captures the child's output and only surfaces it in the error —
+    // print it so a failed start is never silent.
+    log(`⚠️  colima start failed: ${err instanceof Error ? err.message : err}`);
+  }
+
+  if (await waitForDockerDaemon(execFn, settleTimeoutMs)) return;
+
+  log(
+    "🔄 Colima state looks stale — restarting the VM (colima stop --force, then start)...",
+  );
+  await execFn("colima", ["stop", "--force"]).catch(() => {});
+  try {
+    await execFn("colima", ["start", ...startArgs]);
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    throw new Error(
+      `Failed to restart Colima. Please run 'colima stop --force && colima start' manually.\n${message}`,
+    );
+  }
+  if (!(await waitForDockerDaemon(execFn, settleTimeoutMs))) {
+    throw new Error(
+      "Docker daemon is still not reachable after restarting Colima. " +
+        "Check `colima status` and `docker info`, then try again.",
+    );
+  }
+}
+
 /**
  * Checks whether the `docker` CLI and daemon are available on the system.
  * Installs Colima and Docker via direct binary download if missing (no sudo
@@ -418,41 +501,9 @@ async function ensureDockerInstalled(): Promise<void> {
     }
 
     console.log("🚀 Docker daemon not running. Starting Colima...");
-    try {
-      await exec("colima", [
-        "start",
-        "--memory",
-        String(COLIMA_DEFAULT_MEMORY_GIB),
-      ]);
-    } catch {
-      // Colima may fail if a previous VM instance is in a corrupt state.
-      // Attempt to delete the stale instance and retry once.
-      console.log(
-        "⚠️  Colima start failed — attempting to reset stale VM state...",
-      );
-      try {
-        await exec("colima", ["stop", "--force"]).catch(() => {});
-        await exec("colima", ["delete", "--force"]);
-      } catch {
-        // If delete also fails, fall through to the retry which will
-        // produce a clear error message.
-      }
-
-      try {
-        console.log("🔄 Retrying colima start...");
-        await exec("colima", [
-          "start",
-          "--memory",
-          String(COLIMA_DEFAULT_MEMORY_GIB),
-        ]);
-      } catch (retryErr) {
-        const message =
-          retryErr instanceof Error ? retryErr.message : String(retryErr);
-        throw new Error(
-          `Failed to start Colima after resetting stale VM state. Please run 'colima start' manually.\n${message}`,
-        );
-      }
-    }
+    await startColimaAndAwaitDaemon(exec, console.log, {
+      startArgs: ["--memory", String(COLIMA_DEFAULT_MEMORY_GIB)],
+    });
   }
 }
 
@@ -486,6 +537,56 @@ export async function removeContainer(containerName: string): Promise<void> {
   }
 }
 
+/**
+ * Error signatures Docker Hub returns when the host has STALE Docker Hub
+ * credentials: an expired personal access token saved by a past
+ * `docker login` gets attached to the pull, and Hub rejects the request
+ * instead of falling back to anonymous access for a public image.
+ */
+export function isExpiredDockerHubCredentialError(err: unknown): boolean {
+  const message = err instanceof Error ? err.message : String(err);
+  return /personal access token is expired|authentication required|unauthorized/i.test(
+    message,
+  );
+}
+
+/**
+ * Pull an image, retrying once without stale credentials when Docker Hub
+ * rejects the pull with an expired-token/auth error — public pulls need no
+ * login, so `docker logout` (clears the stored Docker Hub credentials the
+ * docker CLI attaches to pulls) costs nothing. Other failures propagate raw;
+ * a still-failing auth retry is rethrown with actionable copy.
+ */
+export async function pullImage(
+  ref: string,
+  log: (msg: string) => void = console.log,
+  execFn: typeof exec = exec,
+): Promise<void> {
+  try {
+    await execFn("docker", ["pull", ref]);
+    return;
+  } catch (err) {
+    if (!isExpiredDockerHubCredentialError(err)) throw err;
+    log(
+      `⚠️  Docker Hub rejected the pull of ${ref} with an expired-credential ` +
+        `error — clearing stale Docker Hub login and retrying (public images ` +
+        `need no credentials)...`,
+    );
+    await execFn("docker", ["logout"]).catch(() => {});
+  }
+  try {
+    await execFn("docker", ["pull", ref]);
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    throw new Error(
+      `Failed to pull ${ref}.\n${message}\n` +
+        `If the Docker daemon is not running, start it, e.g. 'colima start' on macOS. ` +
+        `If the error mentions authentication, run 'docker logout' and check your ` +
+        `Docker Hub credentials — public image pulls need none.`,
+    );
+  }
+}
+
 export async function retireDocker(name: string): Promise<void> {
   console.log(`\u{1F5D1}\ufe0f  Stopping Docker containers for '${name}'...\n`);
 
@@ -785,6 +886,113 @@ export async function wakeContainers(
   }
 }
 
+/** The `docker start` failure for a container that was never created. */
+export function isNoSuchContainerError(err: unknown): boolean {
+  const msg = err instanceof Error ? err.message : String(err);
+  return msg.includes("No such container");
+}
+
+/**
+ * Recreate a docker instance's service group from its lockfile entry — the
+ * wake path for containers that don't exist yet. A migrated install has its
+ * data in the volumes but no containers: nothing ever ran `docker run` for
+ * it (v0.0.10 run feedback: `wake --all` died on "No such container:
+ * <name>-assistant").
+ *
+ * Network and volume creates are idempotent; the three service containers
+ * come up from the entry's recorded images (the migrator points those at
+ * the installed cadet's release). The guardian bootstrap secret rides
+ * through from the entry; the signing key and CES token are deliberately
+ * NOT invented — with no env value the gateway and assistant load the
+ * persisted trust material from their security volumes (a migrated install
+ * keeps its own), matching the gateway's resolution order (env → file →
+ * generate). Empty volumes just get fresh state on first boot.
+ */
+export async function recreateDockerContainers(entry: AssistantEntry): Promise<void> {
+  const info = entry.containerInfo;
+  if (!info?.assistantImage || !info.gatewayImage || !info.cesImage) {
+    throw new Error(
+      `no container images recorded for '${entry.assistantId}' — re-hatch or run \`cadet upgrade\` to set them`,
+    );
+  }
+  const res = dockerResourceNames(entry.assistantId);
+  const log = (msg: string): void => console.log(msg);
+
+  // Clean slate for the create: an existing container (even a stopped one)
+  // would collide with `docker run --name` (the upgrade path does the same).
+  await stopContainers(res);
+
+  try {
+    await exec("docker", ["network", "inspect", res.network]);
+  } catch {
+    await exec("docker", ["network", "create", res.network]);
+  }
+  for (const vol of [
+    res.socketVolume,
+    res.assistantIpcVolume,
+    res.gatewayIpcVolume,
+    res.workspaceVolume,
+    res.gatewaySecurityVolume,
+    res.cesSecurityVolume,
+  ]) {
+    try {
+      await exec("docker", ["volume", "inspect", vol]);
+    } catch {
+      await exec("docker", ["volume", "create", vol]);
+    }
+  }
+
+  // The recorded images may not be on the machine yet (a migrated install
+  // gets its refs written before anything pulled them) — a pull of an
+  // already-present image is a cheap no-op.
+  for (const image of [info.assistantImage, info.gatewayImage, info.cesImage]) {
+    log(`📦 Pulling ${image}...`);
+    await pullImage(image, log);
+  }
+
+  const gatewayPort = parseGatewayPort(entry.runtimeUrl) ??
+    getDefaultPorts(getCurrentEnvironment()).gateway;
+  const assistantPort = info.assistantPort ?? ASSISTANT_INTERNAL_PORT;
+  const device = getOrCreateHostDeviceId();
+  await startContainers(
+    {
+      bootstrapSecret: entry.guardianBootstrapSecret,
+      extraAssistantEnv: { CADET_DEVICE_ID: device },
+      extraGatewayEnv: { CADET_DEVICE_ID: device },
+      gatewayPort,
+      assistantPort,
+      imageTags: {
+        assistant: info.assistantImage,
+        gateway: info.gatewayImage,
+        "credential-executor": info.cesImage,
+      },
+      instanceName: entry.assistantId,
+      res,
+    },
+    log,
+  );
+
+  // Persist what the recreation decided (the gateway port in the runtime
+  // url, the assistant port when it defaulted) so plain `docker start`
+  // wakes work and clients reach the right endpoints.
+  saveAssistantEntry({
+    ...entry,
+    runtimeUrl: `http://localhost:${gatewayPort}`,
+    containerInfo: { ...info, assistantPort },
+  });
+}
+
+/** The port of the CLI's own runtime url form (`http://localhost:7830`). */
+function parseGatewayPort(runtimeUrl: string): number | null {
+  try {
+    const port = new URL(runtimeUrl).port;
+    const parsed = parseInt(port, 10);
+    return Number.isFinite(parsed) && parsed > 0 ? parsed : null;
+  } catch {
+    return null;
+  }
+}
+
 /**
  * Ensure a Docker daemon is reachable before waking an instance's containers
  * (macOS only — on Linux the daemon runs natively).
@@ -805,6 +1013,7 @@ export async function wakeContainers(
  */
 export async function ensureDockerDaemonRunning(
   execFn: typeof exec = exec,
+  opts: { settleTimeoutMs?: number } = {},
 ): Promise<void> {
   ensureLocalBinOnPath();
 
@@ -817,12 +1026,10 @@ export async function ensureDockerDaemonRunning(
     // No daemon reachable — fall through to the Colima fallback below.
   }
 
-  try {
-    await execFn("colima", ["status"]);
-  } catch {
-    console.log("🚀 Docker daemon not running. Starting Colima...");
-    await execFn("colima", ["start"]);
-  }
+  // Deliberately no `colima status` probe: it trusts Colima's own state file,
+  // which can be stale (zombie VM) — daemon reachability is the oracle.
+  console.log("🚀 Docker daemon not running. Starting Colima...");
+  await startColimaAndAwaitDaemon(execFn, console.log, opts);
 }
 
 /**
@@ -1127,6 +1334,7 @@ export async function hatchDocker(params: HatchDockerParams): Promise<void> {
   let provider = setupProviderCredentials
     ? resolveHatchProvider(configValues)
     : undefined;
+  let precollectedApiKey: string | undefined;
 
   if (
     shouldPromptForHatchProvider({
@@ -1139,6 +1347,9 @@ export async function hatchDocker(params: HatchDockerParams): Promise<void> {
     const picked = await promptProviderChoice();
     if (picked) {
       provider = picked;
+      // Collect the key immediately, while the choice is fresh — the
+      // startup logs are quiet now, so nothing separates the two prompts.
+      precollectedApiKey = await collectProviderApiKey(picked);
     }
   }
 
@@ -1320,7 +1531,7 @@ export async function hatchDocker(params: HatchDockerParams): Promise<void> {
           const MAX_PULL_RETRIES = 3;
           for (let attempt = 1; attempt <= MAX_PULL_RETRIES; attempt++) {
             try {
-              await exec("docker", ["pull", ref]);
+              await pullImage(ref, log);
               break;
             } catch (err) {
               if (attempt === MAX_PULL_RETRIES) throw err;
@@ -1434,9 +1645,9 @@ export async function hatchDocker(params: HatchDockerParams): Promise<void> {
       : ownSecret;
 
     emitProgress(4, 6, "Starting containers...");
-    if (flagEnvVars.CADET_DISABLE_PLATFORM) {
-      extraAssistantEnv.CADET_DISABLE_PLATFORM =
-        flagEnvVars.CADET_DISABLE_PLATFORM;
+    if (flagEnvVars.CADET_DISABLE_CLOUD) {
+      extraAssistantEnv.CADET_DISABLE_CLOUD =
+        flagEnvVars.CADET_DISABLE_CLOUD;
     }
     const hostDeviceId = getOrCreateHostDeviceId();
     extraAssistantEnv.CADET_DEVICE_ID = hostDeviceId;
@@ -1478,8 +1689,6 @@ export async function hatchDocker(params: HatchDockerParams): Promise<void> {
     );
     const containersUpAt = Date.now();
 
-    const imageDigests = await captureImageRefs(res);
-
     const runtimeUrl = `http://localhost:${gatewayPort}`;
     const dockerEntry: AssistantEntry = {
       assistantId: instanceName,
@@ -1491,10 +1700,6 @@ export async function hatchDocker(params: HatchDockerParams): Promise<void> {
         assistantImage: imageTags.assistant,
         gatewayImage: imageTags.gateway,
         cesImage: imageTags["credential-executor"],
-        assistantDigest: imageDigests?.assistant,
-        gatewayDigest: imageDigests?.gateway,
-        cesDigest: imageDigests?.["credential-executor"],
-        networkName: res.network,
         assistantPort,
       },
     };
@@ -1530,6 +1735,7 @@ export async function hatchDocker(params: HatchDockerParams): Promise<void> {
         provider,
         guardianAccessToken,
         detached: waitDetached,
+        precollectedKey: precollectedApiKey,
       });
 
       if (providerSetupAction === "defer" && provider !== null) {
@@ -1556,6 +1762,7 @@ export async function hatchDocker(params: HatchDockerParams): Promise<void> {
           provider,
           bearerToken: guardianAccessToken,
           env: process.env,
+          precollectedKey: precollectedApiKey,
           log,
         });
       }