@mycadet/cli 0.12.7 → 0.12.9

package/node_modules/@mycadet/local-mode/src/teleport-backup-policy.ts

@@ -4,7 +4,7 @@
  * A teleport ends with the source assistant being retired, so each surface
  * snapshots the source before any data leaves it. This module holds the
  * decisions those surfaces must agree on: how fresh an existing backup has to
- * be to stand in for a new one, and how a platform (PVC) snapshot is judged
+ * be to stand in for a new one, and how a cloud (PVC) snapshot is judged
  * restorable. Transport lives with each client; nothing here touches the
  * network or the filesystem.
  */
@@ -43,7 +43,7 @@ export function hasRecentBackup(
   return false;
 }
 
-/** The fields of a platform backup listing entry the policy reads. */
+/** The fields of a cloud backup listing entry the policy reads. */
 export interface ManagedBackupEntry {
   snapshot_name?: string;
   created_at?: string;

package/node_modules/@mycadet/local-mode/src/unpair.ts

@@ -16,7 +16,7 @@ import { withLockfileLock } from "./lockfile-lock";
  * `cadet unpair`: the remote assistant itself is never touched (host-side
  * device revocation is `cadet devices`). Only pairing records
  * (`cloud: "paired"`, created by `cadet connect import`) are forgettable this
- * way; local and managed assistants go through retire.
+ * way; local and cloud assistants go through retire.
  */
 export function unpairAssistant(
   lockfilePaths: string[],
@@ -53,7 +53,7 @@ function unpairAssistantLocked(
       ok: false,
       status: 400,
       error:
-        "Only paired assistants can be unpaired. Use retire for local or managed assistants.",
+        "Only paired assistants can be unpaired. Use retire for local or cloud assistants.",
     };
   }
 

package/node_modules/@mycadet/service-contracts/package.json

@@ -26,7 +26,7 @@
     "./error": "./src/error.ts",
     "./reactions": "./src/reactions.ts",
     "./guardian-requests": "./src/guardian-requests.ts",
-    "./platform-credential": "./src/platform-credential.ts",
+    "./cloud-credential": "./src/cloud-credential.ts",
     "./plan-credit": "./src/plan-credit.ts",
     "./integration-categories": "./src/integration-categories.ts",
     "./mcp-oauth": "./src/mcp-oauth.ts"
@@ -40,6 +40,6 @@
   },
   "devDependencies": {
     "@types/bun": "1.2.4",
-    "typescript": "5.7.3"
+    "typescript": "5.9.3"
   }
 }

package/node_modules/@mycadet/{local-mode/node_modules/@mycadet/service-contracts/src/platform-credential.ts → service-contracts/src/cloud-credential.ts}

@@ -1,10 +1,10 @@
 /**
- * Wire contract for asking an assistant whether its stored platform-managed
+ * Wire contract for asking an assistant whether its stored cloud-managed
  * credential still authenticates.
  *
  * The daemon route is the authoritative serving side:
  *   - `POST /v1/platform/verify-credential`
- *       (`assistant/src/runtime/routes/platform-routes.ts`)
+ *       (`assistant/src/runtime/routes/cloud-routes.ts`)
  *
  * The daemon's platform client produces the verdict, the route reports it,
  * and the `cadet` CLI reads it before deciding whether a stored key can be
@@ -15,26 +15,26 @@
 import { z } from "zod";
 
 /**
- * What the platform said about the stored credential, right now.
+ * What the cloud said about the stored credential, right now.
  *
- *   - `valid`: the platform accepted it.
- *   - `rejected`: the platform refused it (unauthorized or forbidden); the
+ *   - `valid`: the cloud accepted it.
+ *   - `rejected`: the cloud refused it (unauthorized or forbidden); the
  *     credential needs replacing.
  *   - `unknown`: the check itself could not run (no credential stored, the
  *     platform unreachable, a server error). Not evidence either way.
  */
-export const PlatformCredentialVerificationStatusSchema = z.enum([
+export const CloudCredentialVerificationStatusSchema = z.enum([
   "valid",
   "rejected",
   "unknown",
 ]);
-export type PlatformCredentialVerificationStatus = z.infer<
-  typeof PlatformCredentialVerificationStatusSchema
+export type CloudCredentialVerificationStatus = z.infer<
+  typeof CloudCredentialVerificationStatusSchema
 >;
 
 /** `POST /v1/platform/verify-credential` response body. */
 export const PlatformVerifyCredentialResponseSchema = z.object({
-  status: PlatformCredentialVerificationStatusSchema,
+  status: CloudCredentialVerificationStatusSchema,
 });
 export type PlatformVerifyCredentialResponse = z.infer<
   typeof PlatformVerifyCredentialResponseSchema

package/node_modules/@mycadet/service-contracts/src/handles.ts

@@ -15,9 +15,9 @@
  *    Format: `local_oauth:<providerKey>/<connectionId>` where providerKey
  *    is the bare provider name (e.g. `google`).
  *
- * 3. **Managed OAuth** — references an OAuth connection managed by the
+ * 3. **Cloud OAuth** — references an OAuth connection managed by the
  *    platform. Format: `platform_oauth:<connectionId>` where connectionId
- *    is the platform-assigned connection identifier.
+ *    is the cloud-assigned connection identifier.
  */
 
 import { z } from "zod";
@@ -96,7 +96,7 @@ export function localOAuthHandle(
 }
 
 /**
- * Build a managed (platform) OAuth credential handle from a connection ID.
+ * Build a cloud (platform) OAuth credential handle from a connection ID.
  */
 export function platformOAuthHandle(connectionId: string): string {
   return `${HandleType.PlatformOAuth}:${connectionId}`;

package/node_modules/@mycadet/service-contracts/src/index.ts

@@ -31,7 +31,7 @@ export * from "./no-response.js";
 export * from "./plan-credit.js";
 export * from "./integration-categories.js";
 export * from "./mcp-oauth.js";
-export * from "./platform-credential.js";
+export * from "./cloud-credential.js";
 export * from "./remote-web-pairing.js";
 export * from "./twilio-ingress.js";
 export * from "./url-normalization.js";

package/node_modules/@mycadet/service-contracts/src/ingress.ts

@@ -4,7 +4,7 @@
  * `{env}-cloud.mycadet.ai` → `tunnel-{env}.mycadet.ai`). Returns null for
  * hosts outside that convention (localhost, custom domains). Shared by the
  * gateway speech relay and the web live-voice client so the two ends of the
- * managed-speech transport can't drift.
+ * cloud-speech transport can't drift.
  */
 export function tunnelHostForPlatformHost(host: string): string | null {
   if (host === "cloud.mycadet.ai") {
@@ -100,11 +100,17 @@ export const INGRESS_PAIRING_TUNNEL_KEY = "pairingTunnel";
 export const INGRESS_ASSISTANT_ID_KEY = "assistantId";
 
 /**
- * The local tunnel providers the CLI can start, in the order they are offered.
- * `cadet tunnel`'s accepted `--provider` values and the persisted-record
- * validation below both derive from it.
+ * The tunnel providers the CLI offers, in the order they are presented —
+ * the managed `cadet` tunnel first (listed, not yet implemented), then the
+ * local ones. `cadet tunnel`'s accepted `--provider` values and the
+ * persisted-record validation below both derive from it.
  */
-export const TUNNEL_PROVIDERS = ["ngrok", "cloudflare", "tailscale"] as const;
+export const TUNNEL_PROVIDERS = [
+  "cadet",
+  "ngrok",
+  "cloudflare",
+  "tailscale",
+] as const;
 
 export type TunnelProviderName = (typeof TUNNEL_PROVIDERS)[number];
 

package/node_modules/@mycadet/service-contracts/src/remote-web-pairing.ts

@@ -152,7 +152,7 @@ export const DEFAULT_REMOTE_WEB_PAIRING_PLATFORM: RemoteWebPairingPlatform =
 
 /**
  * A requested platform coerced to a known value. The pairing-token route is
- * publicly reachable and the platform renders verbatim in the host's
+ * publicly reachable and the cloud renders verbatim in the host's
  * paired-devices list, so an unrecognized value never reaches the DB.
  */
 export function resolveRemoteWebPairingPlatform(

package/node_modules/@mycadet/service-contracts/src/rpc.ts

@@ -34,7 +34,7 @@ import { RpcErrorSchema } from "./error.js";
 
 export const CesRpcMethod = {
   /** Push an updated assistant credential to CES after post-hatch provisioning. */
-  UpdateManagedCredential: "update_managed_credential",
+  UpdateCloudCredential: "update_managed_credential",
   /** Retrieve a single credential by account name. */
   GetCredential: "get_credential",
   /** Store or update a credential by account name. */
@@ -63,7 +63,7 @@ export type CesRpcMethod = (typeof CesRpcMethod)[keyof typeof CesRpcMethod];
 // update_managed_credential
 // ---------------------------------------------------------------------------
 
-export const UpdateManagedCredentialSchema = z.object({
+export const UpdateCloudCredentialSchema = z.object({
   /** The assistant API key to push to CES for platform credential materialization. */
   assistantApiKey: z.string(), // nosemgrep: not-a-secret
   /**
@@ -72,16 +72,16 @@ export const UpdateManagedCredentialSchema = z.object({
    */
   assistantId: z.string().optional(),
 });
-export type UpdateManagedCredential = z.infer<
-  typeof UpdateManagedCredentialSchema
+export type UpdateCloudCredential = z.infer<
+  typeof UpdateCloudCredentialSchema
 >;
 
-export const UpdateManagedCredentialResponseSchema = z.object({
-  /** Whether the managed credential was successfully updated. */
+export const UpdateCloudCredentialResponseSchema = z.object({
+  /** Whether the cloud credential was successfully updated. */
   updated: z.boolean(),
 });
-export type UpdateManagedCredentialResponse = z.infer<
-  typeof UpdateManagedCredentialResponseSchema
+export type UpdateCloudCredentialResponse = z.infer<
+  typeof UpdateCloudCredentialResponseSchema
 >;
 
 // ---------------------------------------------------------------------------
@@ -311,9 +311,9 @@ export type BulkSetCredentialRecordsResponse = z.infer<
  * schemas. Useful for building type-safe RPC dispatch layers.
  */
 export interface CesRpcContract {
-  [CesRpcMethod.UpdateManagedCredential]: {
-    request: UpdateManagedCredential;
-    response: UpdateManagedCredentialResponse;
+  [CesRpcMethod.UpdateCloudCredential]: {
+    request: UpdateCloudCredential;
+    response: UpdateCloudCredentialResponse;
   };
   [CesRpcMethod.GetCredential]: {
     request: GetCredential;
@@ -361,9 +361,9 @@ export interface CesRpcContract {
  * Schema lookup map for runtime validation of RPC payloads.
  */
 export const CesRpcSchemas = {
-  [CesRpcMethod.UpdateManagedCredential]: {
-    request: UpdateManagedCredentialSchema,
-    response: UpdateManagedCredentialResponseSchema,
+  [CesRpcMethod.UpdateCloudCredential]: {
+    request: UpdateCloudCredentialSchema,
+    response: UpdateCloudCredentialResponseSchema,
   },
   [CesRpcMethod.GetCredential]: {
     request: GetCredentialSchema,

package/node_modules/@mycadet/service-contracts/src/trust-rules.ts

@@ -15,7 +15,7 @@
  * - **URL**: tools whose candidates include a URL (`web_fetch`,
  *   `network_request`).
  * - **Managed skill**: tools that manage first-party skill packages
- *   (`scaffold_managed_skill`, `delete_managed_skill`).
+ *   (`scaffold_cloud_skill`, `delete_cloud_skill`).
  * - **Skill load**: the `skill_load` tool, which uses a distinct candidate
  *   namespace (`skill_load:selector` or `skill_load_dynamic:selector`).
  * - **Generic**: everything else (computer-use tools, UI surface tools,
@@ -58,8 +58,8 @@ export const URL_TOOLS = ["web_fetch", "network_request"] as const;
  * Tools that manage first-party skill packages (scaffold/delete).
  */
 export const MANAGED_SKILL_TOOLS = [
-  "scaffold_managed_skill",
-  "delete_managed_skill",
+  "scaffold_cloud_skill",
+  "delete_cloud_skill",
 ] as const;
 
 /**
@@ -89,8 +89,8 @@ export function isUrlRule(rule: { tool: string }): boolean {
   return URL_TOOLS_SET.has(rule.tool);
 }
 
-/** Returns true when the rule's tool belongs to the managed-skill-tool family. */
-export function isManagedSkillRule(rule: { tool: string }): boolean {
+/** Returns true when the rule's tool belongs to the cloud-skill-tool family. */
+export function isCloudSkillRule(rule: { tool: string }): boolean {
   return MANAGED_SKILL_TOOLS_SET.has(rule.tool);
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mycadet/cli",
-  "version": "0.12.7",
+  "version": "0.12.9",
   "description": "CLI tools for mycadet",
   "type": "module",
   "exports": {
@@ -20,7 +20,7 @@
   "scripts": {
     "format": "prettier --write .",
     "format:check": "prettier --check .",
-    "lint": "eslint --max-warnings 519",
+    "lint": "eslint --max-warnings 322",
     "lint:unused": "knip --include files,dependencies,unlisted",
     "compile:check": "bun build --compile src/index.ts --outfile /dev/null",
     "test": "bun run scripts/run-tests.ts",
@@ -41,6 +41,7 @@
     "qrcode-terminal": "0.12.0",
     "react": "19.2.6",
     "react-devtools-core": "7.0.1",
+    "yaml": "2.8.2",
     "zod": "4.3.6"
   },
   "bundledDependencies": [

package/src/__tests__/assistant-api-key-resolution.test.ts

@@ -1,6 +1,6 @@
 import { beforeEach, describe, expect, mock, test } from "bun:test";
 
-import * as realPlatformClient from "../lib/platform-client.js";
+import * as realCloudClient from "../lib/cloud-client.js";
 
 const calls: string[] = [];
 let verifyResult: "valid" | "rejected" | "unknown" | null = "valid";
@@ -9,9 +9,9 @@ let readResult: { value: string | null; unreachable: boolean } = {
   unreachable: false,
 };
 
-mock.module("../lib/platform-client.js", () => ({
-  ...realPlatformClient,
-  verifyGatewayManagedCredential: mock(async () => {
+mock.module("../lib/cloud-client.js", () => ({
+  ...realCloudClient,
+  verifyGatewayCloudCredential: mock(async () => {
     calls.push("verify");
     return verifyResult;
   }),
@@ -61,13 +61,13 @@ describe("resolveAssistantApiKeyForInjection", () => {
   // The verdict comes first and the key is read after it, so the value
   // returned is the one the verdict covered, never one a concurrent repair
   // has since replaced.
-  test("a stored key the platform accepts is read after the verdict", async () => {
+  test("a stored key the cloud accepts is read after the verdict", async () => {
     const resolved = await resolveAssistantApiKeyForInjection(ARGS);
     expect(resolved).toEqual({ apiKey: "stored-key", source: "stored" });
     expect(calls).toEqual(["verify", "read"]);
   });
 
-  test("a stored key the platform rejects is replaced without being read", async () => {
+  test("a stored key the cloud rejects is replaced without being read", async () => {
     verifyResult = "rejected";
     const resolved = await resolveAssistantApiKeyForInjection(ARGS);
     expect(resolved).toEqual({ apiKey: "fresh-key", source: "reprovisioned" });

package/src/__tests__/{assistant-client-platform-auth.test.ts → assistant-client-cloud-auth.test.ts}

@@ -1,8 +1,8 @@
 /**
- * Tests for AssistantClient's platform-managed (`cloud: "cadet"`) auth path.
+ * Tests for AssistantClient's cloud-managed (`cloud: "cadet"`) auth path.
  * These entries have no guardian token on disk, so the client must authenticate
  * with the stored platform credential instead of sending an anonymous request
- * (which the platform answers with a bare 403).
+ * (which the cloud answers with a bare 403).
  */
 import {
   afterAll,
@@ -16,7 +16,7 @@ import { mkdtempSync, rmSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 
-const testDir = mkdtempSync(join(tmpdir(), "client-platform-auth-test-"));
+const testDir = mkdtempSync(join(tmpdir(), "client-cloud-auth-test-"));
 const ORIGINAL_LOCKFILE_DIR = process.env.CADET_LOCKFILE_DIR;
 const ORIGINAL_CONFIG_HOME = process.env.XDG_CONFIG_HOME;
 const ORIGINAL_FETCH = globalThis.fetch;
@@ -24,15 +24,15 @@ const ORIGINAL_FETCH = globalThis.fetch;
 import { AssistantClient } from "../lib/assistant-client.js";
 import { saveAssistantEntry } from "../lib/assistant-config.js";
 import {
-  clearPlatformToken,
-  savePlatformToken,
-} from "../lib/platform-client.js";
+  clearCloudToken,
+  saveCloudToken,
+} from "../lib/cloud-client.js";
 
 const PLATFORM_URL = "https://platform.example.com";
 const ASSISTANT_ID = "019d1e04-cb20-719a-b04b-310072904444";
 const ORG_ID = "org-abc";
 
-/** Seed a platform-managed lockfile entry, optionally with a stored token. */
+/** Seed a cloud-managed lockfile entry, optionally with a stored token. */
 function seedCloud(token?: string): void {
   saveAssistantEntry({
     assistantId: ASSISTANT_ID,
@@ -41,7 +41,7 @@ function seedCloud(token?: string): void {
     cloud: "cadet",
   });
   if (token) {
-    savePlatformToken(token);
+    saveCloudToken(token);
   }
 }
 
@@ -68,7 +68,7 @@ const isOrgFetch = (url: string) => url.includes("/v1/organizations/");
 const isRefresh = (url: string) => url.includes("/v1/guardian/refresh");
 
 function orgResponse(): Response {
-  return new Response(JSON.stringify({ results: [{ id: ORG_ID }] }), {
+  return new Response(JSON.stringify({ results: [{ id: ORG_ID, name: "My Cadet" }] }), {
     status: 200,
     headers: { "content-type": "application/json" },
   });
@@ -79,7 +79,7 @@ describe("AssistantClient cloud-managed auth", () => {
     process.env.CADET_LOCKFILE_DIR = testDir;
     process.env.XDG_CONFIG_HOME = testDir;
     // Tests share testDir, so a token saved by an earlier one must not leak.
-    clearPlatformToken();
+    clearCloudToken();
   });
 
   afterEach(() => {

package/src/__tests__/assistant-client-refresh.test.ts

@@ -2,7 +2,7 @@
  * Tests for AssistantClient's reactive 401 -> refresh -> retry: a paired/local
  * guardian access token that 401s is refreshed once via the stored refresh
  * credential and the request retried. Self-gating (no refresh token => no
- * retry) and never applied to the platform session-auth path.
+ * retry) and never applied to the cloud session-auth path.
  */
 import {
   afterAll,
@@ -148,7 +148,7 @@ describe("AssistantClient 401 -> refresh -> retry", () => {
     expect(calls.filter((c) => isRefresh(c.url))).toHaveLength(0);
   });
 
-  test("never refreshes on the platform session-auth path", async () => {
+  test("never refreshes on the cloud session-auth path", async () => {
     seedPaired("refresh-tok"); // entry must exist; session auth ignores it
     let assistantAttempts = 0;
     const calls = stubFetch((url) => {