@mycadet/cli 0.12.7 → 0.12.9

package/src/lib/nginx-ingress.ts

@@ -19,10 +19,13 @@ import { join } from "node:path";
 import { cloudAssistantHubUrl } from "@mycadet/environments";
 
 import {
+  clearRootProcess,
   getAssistantDisplayName,
   lookupAssistantByIdentifier,
+  stampRootProcess,
   type AssistantEntry,
 } from "./assistant-config.js";
+import type { RemoteHost } from "./constants.js";
 import { getCurrentEnvironment } from "./environments/resolve.js";
 import { waitForDaemonReady } from "./http-client.js";
 import {
@@ -159,6 +162,12 @@ export function cloudWebHubUrl(env: string | undefined): string {
   return cloudAssistantHubUrl(env);
 }
 
+// The edge serves remote browsers, so the bundle's remote-gateway machinery
+// must always run: it is reached through this self-hosted edge however the
+// cadet itself is hosted. "cloud" is never stamped (the cloud serves its
+// own bundles).
+const EDGE_SERVED_REMOTE: RemoteHost = "custom";
+
 function remoteWebIngressConfig(
   opts: Pick<
     RemoteWebIngressOptions,
@@ -166,10 +175,10 @@ function remoteWebIngressConfig(
   >,
 ): Record<string, unknown> {
   return {
-    mode: "remote-gateway",
+    remote: EDGE_SERVED_REMOTE,
     apiBaseUrl: "/v1",
-    platformDisabled: true,
-    disablePlatform: true,
+    cloudDisabled: true,
+    disableCloud: true,
     ...(opts.assistantName ? { assistantName: opts.assistantName } : {}),
     ...(opts.assistantId ? { assistantId: opts.assistantId } : {}),
     ...(opts.hubUrl ? { hubUrl: opts.hubUrl } : {}),
@@ -182,7 +191,7 @@ function remoteWebIngressConfig(
  * fingerprint matches, so this must change whenever the generated index or
  * nginx template does.
  */
-export const EDGE_TEMPLATE_VERSION = 8;
+export const EDGE_TEMPLATE_VERSION = 9;
 
 /**
  * Stable fingerprint of the SPA config injected into the served index and
@@ -353,7 +362,7 @@ http {
   # remote client cannot smuggle one. Every caller reaches this loopback-only
   # listener through the TLS-terminating front (tunnel agent), so the raw peer
   # is always 127.0.0.1; the front records the real client as the RIGHTMOST
-  # X-Forwarded-For entry (ngrok/cloudflared append, tailscale serve sets it),
+  # X-Forwarded-For entry (tunnel providers append one; tailscale serve sets it),
   # which the remote client cannot control. Fall back to the raw peer when the
   # front sets no X-Forwarded-For.
   map $http_x_forwarded_for $cadet_edge_client_ip {
@@ -487,7 +496,8 @@ export function getNginxVersion(): string | null {
  * process.ts helpers: stopProcessByPidFile's isCadetProcess() guard only
  * matches command lines containing a cadet path, which fails for a custom
  * CADET_WORKSPACE_DIR and would silently leave nginx running (the same
- * reason local.ts kills ngrok directly). This module is also imported by
+ * reason local.ts stops the tunnel agent directly). This module is also
+ * imported by
  * sleep/retire, whose tests mock.module() process.js process-globally —
  * depending on it here would couple this lib's behavior to those mocks.
  */
@@ -618,13 +628,15 @@ function clearIngressState(workspaceDir: string): void {
 function clearStoppedIngress(workspaceDir: string, pidPath: string): void {
   clearIngressState(workspaceDir);
   rmSync(pidPath, { force: true });
+  // The edge is gone; drop the root lockfile's process entry with it.
+  clearRootProcess("app");
 }
 
 /**
- * Write the nginx config and spawn nginx detached (same idiom as the ngrok
- * spawn in ngrok.ts: stdout/stderr to a log file, fd closed after spawn,
- * caller unrefs). nginx runs with `daemon off` so the spawned process is the
- * master; it writes its pid to nginx.pid under the prefix dir.
+ * Write the nginx config and spawn nginx detached (stdout/stderr to a log
+ * file, fd closed after spawn, caller unrefs). nginx runs with `daemon off`
+ * so the spawned process is the master; it writes its pid to nginx.pid under
+ * the prefix dir.
  */
 export function startIngressNginx(opts: {
   workspaceDir: string;
@@ -1028,8 +1040,22 @@ export async function stopContainerTunnelEdge(
   return stopIngressNginx(workspaceDir);
 }
 
-/** Resolved edge a tunnel (or bring-your-own HTTPS front) should target. */
-export interface TunnelEdge {
+/** Record the running edge's pid in the root lockfile for `cadet ps`. */
+function stampAppProcessEntry(
+  workspaceDir: string,
+  assistantId?: string,
+): void {
+  const pid = getIngressPid(workspaceDir);
+  if (pid !== null) {
+    stampRootProcess("app", {
+      pid,
+      startedAt: new Date().toISOString(),
+      assistantId,
+    });
+  }
+}
+
+/** Resolved edge a tunnel (or bring-your-own HTTPS front) should target. */ export interface TunnelEdge {
   /** Loopback listen port the HTTPS front should forward to. */
   port: number;
   /** True when this call started the edge, false when a running one was reused. */
@@ -1081,7 +1107,6 @@ export async function ensureTunnelEdge(opts: {
   const assistantName = opts.assistantId
     ? lockfileAssistantName(opts.assistantId)
     : undefined;
-
   const result = await startRemoteWebIngress({
     workspaceDir: opts.workspaceDir,
     gatewayPort: opts.gatewayPort,
@@ -1093,6 +1118,7 @@ export async function ensureTunnelEdge(opts: {
 
   switch (result.status) {
     case "started":
+      stampAppProcessEntry(opts.workspaceDir, opts.assistantId);
       return {
         port: result.listenPort,
         started: true,
@@ -1126,6 +1152,7 @@ export async function ensureTunnelEdge(opts: {
             stuckEdgeRecoveryHint(opts.workspaceDir),
         );
       }
+      stampAppProcessEntry(opts.workspaceDir, opts.assistantId);
       return {
         port: result.listenPort,
         started: false,
@@ -1135,13 +1162,13 @@ export async function ensureTunnelEdge(opts: {
     case "nginx-missing":
       throw new Error(
         "nginx is not installed, so the tunnel edge cannot start. " +
-          "Install it (macOS: `brew install nginx`, Linux: `sudo apt install nginx`) " +
+          "See https://nginx.org/en/docs/install.html for how to install, " +
           "or point NGINX_BIN at an existing binary.",
       );
     case "web-dist-missing":
       throw new Error(
         "Unable to locate built web assets for the remote web edge. " +
-          "Build the SPA (`cd clients/web && VITE_PLATFORM_MODE=false bun run build`) " +
+          "Build the SPA with `cd clients/web && VITE_CLOUD_MODE=false bun run build`, " +
           "or install @mycadet/web so its packaged dist directory is available.",
       );
     case "unreachable":

package/src/lib/pair.ts

@@ -50,6 +50,6 @@ export function formatWebApproveFailure(
   return [
     `${rejection} ${gatewayUrl} (assistant "${assistantReference}", environment "${envName}").`,
     `Codes are minted by the gateway that serves the pair page, expire after ${CODE_TTL_MINUTES} minutes, and are single-use.`,
-    "If the pair page came from a different assistant or environment (e.g. the desktop app's), re-run with that environment's CADET_ENVIRONMENT and that assistant's name.",
+    "If the pair page came from a different assistant or environment, such as the desktop app's, re-run with that environment's CADET_ENVIRONMENT and that assistant's name.",
   ].join("\n");
 }

package/src/lib/process.ts

@@ -76,7 +76,7 @@ export function windowsCommandLineLookupArgs(pid: number): string[] {
   ];
 }
 
-/** Read a process command line using the platform's process inspection tool. */
+/** Read a process command line using the cloud's process inspection tool. */
 export function readProcessCommandLine(
   pid: number,
   hostPlatform: NodeJS.Platform = platform(),

package/src/lib/provider-secrets.ts

@@ -86,7 +86,7 @@ const PROVIDER_LABELS: Record<LlmProviderId, string> = {
   typesafe: "TypeSafe",
 };
 
-// Ranked for the hatch prompt: Cadet Cloud first (the managed connection —
+// Ranked for the hatch prompt: Cadet Cloud first (the cloud connection —
 // no key to collect), then the hosted-inference gateways, then the BYO-key
 // incumbents, then the rest, with the endpoint-supplied catalogs last.
 export const HATCH_PROVIDER_CHOICES: readonly LlmProviderId[] = [
@@ -681,11 +681,11 @@ export async function ensureProviderApiKey(
 
   if (!envVarName) {
     // Managed-connection provider (e.g. Cadet Cloud): authenticated through
-    // the platform, not a user-supplied API key. Checked before the
+    // the cloud, not a user-supplied API key. Checked before the
     // supported-provider guard so the keyless flow stays reachable.
     return {
       status: "skipped",
-      message: `${providerName} authenticates through the managed connection; no API key needed.`,
+      message: `${providerName} authenticates through the cloud connection; no API key needed.`,
     };
   }
 

package/src/lib/retire-apple-container.ts

@@ -7,7 +7,7 @@ import type { AssistantEntry } from "./assistant-config.js";
  * Retire an Apple Container assistant by sending a retire command to the
  * macOS app via the management socket. The app handles the full lifecycle:
  * stop the pod, archive the instance directory, remove the guardian token,
- * deregister from the platform, and remove the lockfile entry.
+ * deregister from the cloud, and remove the lockfile entry.
  */
 export async function retireAppleContainer(
   name: string,

package/src/lib/runtime-url.ts

@@ -1,4 +1,4 @@
-import { isManagedCloud } from "./managed-cloud.js";
+import { isCloudHome } from "./cloud-values.js";
 import { hostname } from "node:os";
 
 import { getLocalLanIPv4 } from "./local";
@@ -11,12 +11,12 @@ import type { AssistantEntry } from "./assistant-config.js";
  * - For local/docker assistants, `runtimeUrl` is the loopback gateway and
  *   the runtime serves `/v1/migrations/<subpath>` directly. The CLI hits
  *   that path with guardian-token bearer auth.
- * - For platform-managed (cloud="cadet") assistants, `runtimeUrl` is the
- *   platform host (e.g. `https://cloud.mycadet.ai`). The platform's
+ * - For cloud-managed (cloud="cadet") assistants, `runtimeUrl` is the
+ *   platform host (e.g. `https://cloud.mycadet.ai`). The cloud's
  *   `MigrationViewSet` does NOT expose `export-to-gcs` or arbitrary runtime
  *   migration paths under `/v1/migrations/...`. The wildcard runtime proxy
  *   at `/v1/assistants/<id>/<path:rest>` is what forwards arbitrary runtime
- *   paths to the managed runtime — vembda's unified proxy bootstraps the
+ *   paths to the cloud runtime — vembda's unified proxy bootstraps the
  *   guardian token internally for the runtime call. From the CLI side it's
  *   user-session auth.
  *
@@ -27,7 +27,7 @@ export function resolveRuntimeMigrationUrl(
   entry: Pick<AssistantEntry, "cloud" | "runtimeUrl" | "assistantId">,
   subpath: string,
 ): string {
-  if (isManagedCloud(entry.cloud)) {
+  if (isCloudHome(entry.cloud)) {
     return `${entry.runtimeUrl}/v1/assistants/${entry.assistantId}/migrations/${subpath}`;
   }
   return `${entry.runtimeUrl}/v1/migrations/${subpath}`;
@@ -39,9 +39,9 @@ export function resolveRuntimeMigrationUrl(
  *
  * - For local/docker assistants, `runtimeUrl` is the loopback gateway and
  *   the runtime serves `/v1/<subpath>` directly.
- * - For platform-managed (cloud="cadet") assistants the path is rewritten
+ * - For cloud-managed (cloud="cadet") assistants the path is rewritten
  *   to the wildcard runtime proxy:
- *   `{platformUrl}/v1/assistants/<assistantId>/<subpath>`.
+ *   `{cloudUrl}/v1/assistants/<assistantId>/<subpath>`.
  *
  * The `subpath` is appended verbatim (e.g. `"identity"`).
  */
@@ -49,7 +49,7 @@ export function resolveRuntimeUrl(
   entry: Pick<AssistantEntry, "cloud" | "runtimeUrl" | "assistantId">,
   subpath: string,
 ): string {
-  if (isManagedCloud(entry.cloud)) {
+  if (isCloudHome(entry.cloud)) {
     return `${entry.runtimeUrl}/v1/assistants/${entry.assistantId}/${subpath}`;
   }
   return `${entry.runtimeUrl}/v1/${subpath}`;

package/src/lib/statefulset.ts

@@ -199,7 +199,7 @@ export const DOCKER_STATEFUL_SET_SPEC: DockerStatefulSetSpec = {
           (v): HostEnv => ({ kind: "host", name: v }),
         ),
         { kind: "host", name: "CADET_ENVIRONMENT" },
-        { kind: "host", name: "CADET_PLATFORM_URL" },
+        { kind: "host", name: "CADET_CLOUD_URL" },
       ],
       volumeMounts: [
         { volumeName: "assistant-workspace",  mountPath: "/workspace" },
@@ -227,7 +227,7 @@ export const DOCKER_STATEFUL_SET_SPEC: DockerStatefulSetSpec = {
         { kind: "secret", name: "ACTOR_TOKEN_SIGNING_KEY",   secret: "signingKey" },
         { kind: "secret", name: "GUARDIAN_BOOTSTRAP_SECRET", secret: "bootstrapSecret" },
         { kind: "host",   name: "CADET_ENVIRONMENT" },
-        { kind: "host",   name: "CADET_PLATFORM_URL" },
+        { kind: "host",   name: "CADET_CLOUD_URL" },
         { kind: "host",   name: "TUNNEL_BASE_URL" },
       ],
       volumeMounts: [

package/src/lib/sync-cloud-assistants.ts

@@ -2,7 +2,7 @@
  * Sync cloud-managed (platform) assistants into the local lockfile.
  *
  * - Adds new platform assistants that aren't in the lockfile yet.
- * - Removes lockfile entries whose IDs are no longer returned by the platform
+ * - Removes lockfile entries whose IDs are no longer returned by the cloud
  *   (e.g. retired assistants).
  *
  * Used by both `cadet login` and `cadet ps` to keep the lockfile fresh.
@@ -10,10 +10,10 @@
  * **Contract:** callers must verify the user is logged in (i.e. a non-empty
  * platform token exists) before invoking this helper. The "is there a token?"
  * decision belongs at the command level so commands can render the right
- * "Platform: …" status without ever entering the platform fetch path.
+ * "Platform: …" status without ever entering the cloud fetch path.
  */
 
-import { isManagedCloud } from "./managed-cloud.js";
+import { isCloudHome } from "./cloud-values.js";
 import {
   loadAllAssistants,
   removeAssistantEntry,
@@ -21,9 +21,9 @@ import {
 } from "./assistant-config.js";
 import {
   fetchCurrentUser,
-  fetchPlatformAssistants,
-  getPlatformUrl,
-} from "./platform-client.js";
+  fetchCloudAssistants,
+  getCloudUrl,
+} from "./cloud-client.js";
 
 export type SyncLogger = (message: string) => void;
 
@@ -58,12 +58,12 @@ export async function syncCloudAssistants(
 ): Promise<SyncResult | null> {
   if (!token) {
     throw new Error(
-      "syncCloudAssistants called without a token. Callers must check `readPlatformToken()` first.",
+      "syncCloudAssistants called without a token. Callers must check `readCloudToken()` first.",
     );
   }
   const log = options?.log;
-  const platformUrl = getPlatformUrl();
-  log?.(`Platform URL: ${platformUrl}`);
+  const cloudUrl = getCloudUrl();
+  log?.(`Platform URL: ${cloudUrl}`);
   log?.(`Token found (${token.length} chars, prefix: ${token.slice(0, 6)}…)`);
 
   // Fetch user info for the login status line
@@ -83,12 +83,12 @@ export async function syncCloudAssistants(
     }
   }
 
-  let platformAssistants: { id: string; name: string; status: string }[];
+  let cloudAssistants: { id: string; name: string; status: string }[];
   try {
     log?.("Fetching Cadet Cloud assistants…");
-    platformAssistants = await fetchPlatformAssistants(token);
+    cloudAssistants = await fetchCloudAssistants(token);
     log?.(
-      `Cadet Cloud returned ${platformAssistants.length} assistant(s): ${platformAssistants.map((a) => a.name || a.id).join(", ") || "(none)"}`,
+      `Cadet Cloud returned ${cloudAssistants.length} ${cloudAssistants.length === 1 ? "assistant" : "assistants"}: ${cloudAssistants.map((a) => a.name || a.id).join(", ") || "(none)"}`,
     );
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
@@ -101,29 +101,29 @@ export async function syncCloudAssistants(
     return null;
   }
 
-  if (platformAssistants.length === 0) {
+  if (cloudAssistants.length === 0) {
     log?.(
       "Cadet Cloud returned 0 assistants — this may mean the API returned a non-ok status (check token validity)",
     );
   }
 
-  const platformIds = new Set(platformAssistants.map((a) => a.id));
+  const platformIds = new Set(cloudAssistants.map((a) => a.id));
 
   // Add new platform assistants not yet in the lockfile
   const existingCloudEntries = loadAllAssistants().filter((a) =>
-    isManagedCloud(a.cloud),
+    isCloudHome(a.cloud),
   );
   const existingCloudById = new Map(
     existingCloudEntries.map((a) => [a.assistantId, a]),
   );
   const existingCloudIds = new Set(existingCloudById.keys());
   log?.(
-    `Lockfile has ${existingCloudIds.size} cloud assistant(s): ${[...existingCloudIds].join(", ") || "(none)"}`,
+    `Lockfile has ${existingCloudIds.size} ${existingCloudIds.size === 1 ? "cloud assistant" : "cloud assistants"}: ${[...existingCloudIds].join(", ") || "(none)"}`,
   );
 
   let added = 0;
   let updated = 0;
-  for (const pa of platformAssistants) {
+  for (const pa of cloudAssistants) {
     const existing = existingCloudById.get(pa.id);
     const assistantName = pa.name.trim();
     const nameFields = assistantName ? { name: assistantName } : {};
@@ -132,7 +132,7 @@ export async function syncCloudAssistants(
       saveAssistantEntry({
         assistantId: pa.id,
         ...nameFields,
-        runtimeUrl: getPlatformUrl(),
+        runtimeUrl: getCloudUrl(),
         cloud: "cloud",
         hatchedAt: new Date().toISOString(),
       });
@@ -147,7 +147,7 @@ export async function syncCloudAssistants(
     }
   }
 
-  // Remove stale lockfile entries that the platform no longer knows about
+  // Remove stale lockfile entries that the cloud no longer knows about
   let removed = 0;
   for (const id of existingCloudIds) {
     if (!platformIds.has(id)) {

package/src/lib/teleport-backup.ts

@@ -23,7 +23,7 @@ import {
 
 import type { AssistantEntry } from "./assistant-config.js";
 import { loopbackSafeFetch } from "./loopback-fetch.js";
-import { authHeaders, invalidateOrgIdCache } from "./platform-client.js";
+import { authHeaders, invalidateOrgIdCache } from "./cloud-client.js";
 import { z } from "zod";
 
 const ManagedBackupEntrySchema = z.object({
@@ -53,7 +53,7 @@ async function errorSuffix(response: Response): Promise<string> {
 }
 
 /**
- * Send a platform backup request with user-session auth, refreshing the
+ * Send a cloud backup request with user-session auth, refreshing the
  * cached organization id once on 401 (the same recovery the runtime identity
  * probe applies).
  */
@@ -93,7 +93,7 @@ async function fetchPlatformBackups(
 }
 
 /**
- * `created_at` of every restorable PVC snapshot of a platform assistant:
+ * `created_at` of every restorable PVC snapshot of a cloud assistant:
  * `GET /v1/assistants/<id>/backups/`.
  */
 export async function listPlatformBackups(
@@ -109,7 +109,7 @@ export interface CreatePlatformBackupOptions {
 }
 
 /**
- * Take a PVC snapshot of a platform assistant and wait until it is
+ * Take a PVC snapshot of a cloud assistant and wait until it is
  * restorable: `POST /v1/assistants/<id>/backups/`, then re-list until the
  * returned `snapshot_name` reports `ready_to_use`. Throws if the POST fails
  * or the snapshot is not ready within `timeoutMs`.

package/src/lib/terminal-client.ts

@@ -2,12 +2,12 @@
  * Platform terminal API client.
  *
  * Wraps the Django terminal session endpoints that proxy through vembda to
- * open K8s exec streams into managed assistant containers. Same transport
+ * open K8s exec streams into cloud assistant containers. Same transport
  * the web UI's xterm.js terminal uses.
  */
 
 import { loopbackSafeFetch } from "./loopback-fetch.js";
-import { authHeaders, getPlatformUrl } from "./platform-client.js";
+import { authHeaders, getCloudUrl } from "./cloud-client.js";
 import { z } from "zod";
 
 const TerminalSessionResponseSchema = z.object({ session_id: z.string() });
@@ -29,10 +29,10 @@ export async function createTerminalSession(
   assistantId: string,
   cols: number,
   rows: number,
-  platformUrl?: string,
+  cloudUrl?: string,
   service?: string,
 ): Promise<{ session_id: string }> {
-  const baseUrl = platformUrl || getPlatformUrl();
+  const baseUrl = cloudUrl || getCloudUrl();
   const body: Record<string, unknown> = { cols, rows };
   if (service) {
     body.service = service;
@@ -41,7 +41,7 @@ export async function createTerminalSession(
     `${baseUrl}/v1/assistants/${assistantId}/terminal/sessions/`,
     {
       method: "POST",
-      headers: await authHeaders(token, platformUrl),
+      headers: await authHeaders(token, cloudUrl),
       body: JSON.stringify(body),
     },
   );
@@ -62,14 +62,14 @@ export async function closeTerminalSession(
   token: string,
   assistantId: string,
   sessionId: string,
-  platformUrl?: string,
+  cloudUrl?: string,
 ): Promise<void> {
-  const baseUrl = platformUrl || getPlatformUrl();
+  const baseUrl = cloudUrl || getCloudUrl();
   const response = await loopbackSafeFetch(
     `${baseUrl}/v1/assistants/${assistantId}/terminal/sessions/${sessionId}/`,
     {
       method: "DELETE",
-      headers: await authHeaders(token, platformUrl),
+      headers: await authHeaders(token, cloudUrl),
     },
   );
   // 404 = already closed, treat as success
@@ -89,14 +89,14 @@ export async function sendTerminalInput(
   assistantId: string,
   sessionId: string,
   data: string,
-  platformUrl?: string,
+  cloudUrl?: string,
 ): Promise<void> {
-  const baseUrl = platformUrl || getPlatformUrl();
+  const baseUrl = cloudUrl || getCloudUrl();
   const response = await loopbackSafeFetch(
     `${baseUrl}/v1/assistants/${assistantId}/terminal/sessions/${sessionId}/input/`,
     {
       method: "POST",
-      headers: await authHeaders(token, platformUrl),
+      headers: await authHeaders(token, cloudUrl),
       body: JSON.stringify({ data }),
     },
   );
@@ -113,14 +113,14 @@ export async function resizeTerminalSession(
   sessionId: string,
   cols: number,
   rows: number,
-  platformUrl?: string,
+  cloudUrl?: string,
 ): Promise<void> {
-  const baseUrl = platformUrl || getPlatformUrl();
+  const baseUrl = cloudUrl || getCloudUrl();
   const response = await loopbackSafeFetch(
     `${baseUrl}/v1/assistants/${assistantId}/terminal/sessions/${sessionId}/resize/`,
     {
       method: "POST",
-      headers: await authHeaders(token, platformUrl),
+      headers: await authHeaders(token, cloudUrl),
       body: JSON.stringify({ cols, rows }),
     },
   );
@@ -143,14 +143,14 @@ export async function* subscribeTerminalEvents(
   token: string,
   assistantId: string,
   sessionId: string,
-  platformUrl?: string,
+  cloudUrl?: string,
   signal?: AbortSignal,
 ): AsyncGenerator<TerminalOutputEvent> {
-  const baseUrl = platformUrl || getPlatformUrl();
+  const baseUrl = cloudUrl || getCloudUrl();
   const response = await loopbackSafeFetch(
     `${baseUrl}/v1/assistants/${assistantId}/terminal/sessions/${sessionId}/events/`,
     {
-      headers: await authHeaders(token, platformUrl),
+      headers: await authHeaders(token, cloudUrl),
       signal,
     },
   );