@mycadet/credential-executor 0.12.7 → 0.12.8

package/node_modules/@mycadet/credential-storage/src/oauth-runtime.ts

@@ -11,7 +11,7 @@
  *
  * It has NO dependency on the assistant daemon, SQLite, Drizzle, or any
  * service-specific module. The assistant's token-manager.ts and
- * token-persistence.ts wire in the platform-specific backends and
+ * token-persistence.ts wire in the cloud-specific backends and
  * delegate here for shared logic.
  */
 

package/node_modules/@mycadet/credential-storage/src/static-credentials.ts

@@ -6,7 +6,7 @@
  * platform helpers, or any service-specific code — callers supply the file
  * path and this module handles versioned JSON persistence with atomic writes.
  *
- * The assistant's `metadata-store.ts` wires in the platform-specific data
+ * The assistant's `metadata-store.ts` wires in the cloud-specific data
  * directory and re-exports convenience functions that delegate here.
  */
 

package/node_modules/@mycadet/service-contracts/package.json

@@ -26,7 +26,7 @@
     "./error": "./src/error.ts",
     "./reactions": "./src/reactions.ts",
     "./guardian-requests": "./src/guardian-requests.ts",
-    "./platform-credential": "./src/platform-credential.ts",
+    "./cloud-credential": "./src/cloud-credential.ts",
     "./plan-credit": "./src/plan-credit.ts",
     "./integration-categories": "./src/integration-categories.ts",
     "./mcp-oauth": "./src/mcp-oauth.ts"

package/node_modules/@mycadet/service-contracts/src/{platform-credential.ts → cloud-credential.ts}

@@ -1,10 +1,10 @@
 /**
- * Wire contract for asking an assistant whether its stored platform-managed
+ * Wire contract for asking an assistant whether its stored cloud-managed
  * credential still authenticates.
  *
  * The daemon route is the authoritative serving side:
  *   - `POST /v1/platform/verify-credential`
- *       (`assistant/src/runtime/routes/platform-routes.ts`)
+ *       (`assistant/src/runtime/routes/cloud-routes.ts`)
  *
  * The daemon's platform client produces the verdict, the route reports it,
  * and the `cadet` CLI reads it before deciding whether a stored key can be
@@ -15,26 +15,26 @@
 import { z } from "zod";
 
 /**
- * What the platform said about the stored credential, right now.
+ * What the cloud said about the stored credential, right now.
  *
- *   - `valid`: the platform accepted it.
- *   - `rejected`: the platform refused it (unauthorized or forbidden); the
+ *   - `valid`: the cloud accepted it.
+ *   - `rejected`: the cloud refused it (unauthorized or forbidden); the
  *     credential needs replacing.
  *   - `unknown`: the check itself could not run (no credential stored, the
  *     platform unreachable, a server error). Not evidence either way.
  */
-export const PlatformCredentialVerificationStatusSchema = z.enum([
+export const CloudCredentialVerificationStatusSchema = z.enum([
   "valid",
   "rejected",
   "unknown",
 ]);
-export type PlatformCredentialVerificationStatus = z.infer<
-  typeof PlatformCredentialVerificationStatusSchema
+export type CloudCredentialVerificationStatus = z.infer<
+  typeof CloudCredentialVerificationStatusSchema
 >;
 
 /** `POST /v1/platform/verify-credential` response body. */
 export const PlatformVerifyCredentialResponseSchema = z.object({
-  status: PlatformCredentialVerificationStatusSchema,
+  status: CloudCredentialVerificationStatusSchema,
 });
 export type PlatformVerifyCredentialResponse = z.infer<
   typeof PlatformVerifyCredentialResponseSchema

package/node_modules/@mycadet/service-contracts/src/handles.ts

@@ -15,9 +15,9 @@
  *    Format: `local_oauth:<providerKey>/<connectionId>` where providerKey
  *    is the bare provider name (e.g. `google`).
  *
- * 3. **Managed OAuth** — references an OAuth connection managed by the
+ * 3. **Cloud OAuth** — references an OAuth connection managed by the
  *    platform. Format: `platform_oauth:<connectionId>` where connectionId
- *    is the platform-assigned connection identifier.
+ *    is the cloud-assigned connection identifier.
  */
 
 import { z } from "zod";
@@ -96,7 +96,7 @@ export function localOAuthHandle(
 }
 
 /**
- * Build a managed (platform) OAuth credential handle from a connection ID.
+ * Build a cloud (platform) OAuth credential handle from a connection ID.
  */
 export function platformOAuthHandle(connectionId: string): string {
   return `${HandleType.PlatformOAuth}:${connectionId}`;

package/node_modules/@mycadet/service-contracts/src/index.ts

@@ -31,7 +31,7 @@ export * from "./no-response.js";
 export * from "./plan-credit.js";
 export * from "./integration-categories.js";
 export * from "./mcp-oauth.js";
-export * from "./platform-credential.js";
+export * from "./cloud-credential.js";
 export * from "./remote-web-pairing.js";
 export * from "./twilio-ingress.js";
 export * from "./url-normalization.js";

package/node_modules/@mycadet/service-contracts/src/ingress.ts

@@ -4,7 +4,7 @@
  * `{env}-cloud.mycadet.ai` → `tunnel-{env}.mycadet.ai`). Returns null for
  * hosts outside that convention (localhost, custom domains). Shared by the
  * gateway speech relay and the web live-voice client so the two ends of the
- * managed-speech transport can't drift.
+ * cloud-speech transport can't drift.
  */
 export function tunnelHostForPlatformHost(host: string): string | null {
   if (host === "cloud.mycadet.ai") {
@@ -100,11 +100,17 @@ export const INGRESS_PAIRING_TUNNEL_KEY = "pairingTunnel";
 export const INGRESS_ASSISTANT_ID_KEY = "assistantId";
 
 /**
- * The local tunnel providers the CLI can start, in the order they are offered.
- * `cadet tunnel`'s accepted `--provider` values and the persisted-record
- * validation below both derive from it.
+ * The tunnel providers the CLI offers, in the order they are presented —
+ * the managed `cadet` tunnel first (listed, not yet implemented), then the
+ * local ones. `cadet tunnel`'s accepted `--provider` values and the
+ * persisted-record validation below both derive from it.
  */
-export const TUNNEL_PROVIDERS = ["ngrok", "cloudflare", "tailscale"] as const;
+export const TUNNEL_PROVIDERS = [
+  "cadet",
+  "ngrok",
+  "cloudflare",
+  "tailscale",
+] as const;
 
 export type TunnelProviderName = (typeof TUNNEL_PROVIDERS)[number];
 

package/node_modules/@mycadet/service-contracts/src/remote-web-pairing.ts

@@ -152,7 +152,7 @@ export const DEFAULT_REMOTE_WEB_PAIRING_PLATFORM: RemoteWebPairingPlatform =
 
 /**
  * A requested platform coerced to a known value. The pairing-token route is
- * publicly reachable and the platform renders verbatim in the host's
+ * publicly reachable and the cloud renders verbatim in the host's
  * paired-devices list, so an unrecognized value never reaches the DB.
  */
 export function resolveRemoteWebPairingPlatform(

package/node_modules/@mycadet/service-contracts/src/rpc.ts

@@ -34,7 +34,7 @@ import { RpcErrorSchema } from "./error.js";
 
 export const CesRpcMethod = {
   /** Push an updated assistant credential to CES after post-hatch provisioning. */
-  UpdateManagedCredential: "update_managed_credential",
+  UpdateCloudCredential: "update_managed_credential",
   /** Retrieve a single credential by account name. */
   GetCredential: "get_credential",
   /** Store or update a credential by account name. */
@@ -63,7 +63,7 @@ export type CesRpcMethod = (typeof CesRpcMethod)[keyof typeof CesRpcMethod];
 // update_managed_credential
 // ---------------------------------------------------------------------------
 
-export const UpdateManagedCredentialSchema = z.object({
+export const UpdateCloudCredentialSchema = z.object({
   /** The assistant API key to push to CES for platform credential materialization. */
   assistantApiKey: z.string(), // nosemgrep: not-a-secret
   /**
@@ -72,16 +72,16 @@ export const UpdateManagedCredentialSchema = z.object({
    */
   assistantId: z.string().optional(),
 });
-export type UpdateManagedCredential = z.infer<
-  typeof UpdateManagedCredentialSchema
+export type UpdateCloudCredential = z.infer<
+  typeof UpdateCloudCredentialSchema
 >;
 
-export const UpdateManagedCredentialResponseSchema = z.object({
-  /** Whether the managed credential was successfully updated. */
+export const UpdateCloudCredentialResponseSchema = z.object({
+  /** Whether the cloud credential was successfully updated. */
   updated: z.boolean(),
 });
-export type UpdateManagedCredentialResponse = z.infer<
-  typeof UpdateManagedCredentialResponseSchema
+export type UpdateCloudCredentialResponse = z.infer<
+  typeof UpdateCloudCredentialResponseSchema
 >;
 
 // ---------------------------------------------------------------------------
@@ -311,9 +311,9 @@ export type BulkSetCredentialRecordsResponse = z.infer<
  * schemas. Useful for building type-safe RPC dispatch layers.
  */
 export interface CesRpcContract {
-  [CesRpcMethod.UpdateManagedCredential]: {
-    request: UpdateManagedCredential;
-    response: UpdateManagedCredentialResponse;
+  [CesRpcMethod.UpdateCloudCredential]: {
+    request: UpdateCloudCredential;
+    response: UpdateCloudCredentialResponse;
   };
   [CesRpcMethod.GetCredential]: {
     request: GetCredential;
@@ -361,9 +361,9 @@ export interface CesRpcContract {
  * Schema lookup map for runtime validation of RPC payloads.
  */
 export const CesRpcSchemas = {
-  [CesRpcMethod.UpdateManagedCredential]: {
-    request: UpdateManagedCredentialSchema,
-    response: UpdateManagedCredentialResponseSchema,
+  [CesRpcMethod.UpdateCloudCredential]: {
+    request: UpdateCloudCredentialSchema,
+    response: UpdateCloudCredentialResponseSchema,
   },
   [CesRpcMethod.GetCredential]: {
     request: GetCredentialSchema,

package/node_modules/@mycadet/service-contracts/src/trust-rules.ts

@@ -15,7 +15,7 @@
  * - **URL**: tools whose candidates include a URL (`web_fetch`,
  *   `network_request`).
  * - **Managed skill**: tools that manage first-party skill packages
- *   (`scaffold_managed_skill`, `delete_managed_skill`).
+ *   (`scaffold_cloud_skill`, `delete_cloud_skill`).
  * - **Skill load**: the `skill_load` tool, which uses a distinct candidate
  *   namespace (`skill_load:selector` or `skill_load_dynamic:selector`).
  * - **Generic**: everything else (computer-use tools, UI surface tools,
@@ -58,8 +58,8 @@ export const URL_TOOLS = ["web_fetch", "network_request"] as const;
  * Tools that manage first-party skill packages (scaffold/delete).
  */
 export const MANAGED_SKILL_TOOLS = [
-  "scaffold_managed_skill",
-  "delete_managed_skill",
+  "scaffold_cloud_skill",
+  "delete_cloud_skill",
 ] as const;
 
 /**
@@ -89,8 +89,8 @@ export function isUrlRule(rule: { tool: string }): boolean {
   return URL_TOOLS_SET.has(rule.tool);
 }
 
-/** Returns true when the rule's tool belongs to the managed-skill-tool family. */
-export function isManagedSkillRule(rule: { tool: string }): boolean {
+/** Returns true when the rule's tool belongs to the cloud-skill-tool family. */
+export function isCloudSkillRule(rule: { tool: string }): boolean {
   return MANAGED_SKILL_TOOLS_SET.has(rule.tool);
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mycadet/credential-executor",
-  "version": "0.12.7",
+  "version": "0.12.8",
   "license": "MIT",
   "type": "module",
   "exports": {

package/src/__tests__/managed-integration.test.ts

@@ -4,7 +4,7 @@
  * Exercises the full CES RPC transport stack over a real Unix socket
  * without mocks, Docker, K8s, or real OAuth credentials:
  *
- * 1. Starts the managed CES server on a temporary Unix socket
+ * 1. Starts the cloud CES server on a temporary Unix socket
  * 2. Connects as a client via the real socket
  * 3. Performs the RPC handshake (protocol version negotiation)
  * 4. Sends an RPC request (`list_grants`) and verifies the response

package/src/__tests__/transport.test.ts

@@ -2,7 +2,7 @@
  * CES transport tests.
  *
  * Verifies:
- * 1. The managed entrypoint never opens a general localhost command API —
+ * 1. The cloud entrypoint never opens a general localhost command API —
  *    the only command transport is via the accepted Unix socket stream.
  * 2. Health probes are served on a dedicated HTTP port, separate from
  *    the command transport.
@@ -197,7 +197,7 @@ describe("local entrypoint transport isolation", () => {
     // Socket transport only — no stdio-child transport.
     expect(src).not.toMatch(/process\.stdin/);
     expect(src).not.toMatch(/process\.stdout/);
-    // Bun.serve is only used inside the managed-mode health server block
+    // Bun.serve is only used inside the cloud-mode health server block
     // (startHealthServer), never for RPC transport. The RPC transport uses
     // node:net createServer listening on a Unix socket path.
     const bunServeMatches = src.match(/Bun\.serve\(/g);

package/src/http/credential-routes.ts

@@ -1,5 +1,5 @@
 /**
- * Credential CRUD HTTP endpoints for the CES managed service.
+ * Credential CRUD HTTP endpoints for the CES cloud service.
  *
  * Exposes credential management over HTTP so the assistant and gateway
  * can access credentials via the network instead of reading keys.enc

package/src/http/log-export-routes.ts

@@ -1,5 +1,5 @@
 /**
- * Log export HTTP endpoint for the CES managed service.
+ * Log export HTTP endpoint for the CES cloud service.
  *
  * Exposes a single `GET /v1/logs/export` endpoint that collects CES log
  * files, archives them as a tar.gz, and returns the archive. The gateway

package/src/index.ts

@@ -5,7 +5,7 @@
  * Credential Execution Service (CES) — an isolated runtime that stores and
  * serves credentials on behalf of the assistant daemon over RPC. The CES owns
  * the credential store and exposes credential CRUD operations (get, set,
- * delete, list, bulk-set) plus the managed-credential update handshake.
+ * delete, list, bulk-set) plus the cloud-credential update handshake.
  *
  * This module re-exports the public API surface. For the entrypoint see
  * `main.ts` — unified for both local (bare-metal sibling) and managed

package/src/paths.ts

@@ -14,7 +14,7 @@
  * - `CREDENTIAL_SECURITY_DIR` → `./ces-security`
  * - `CES_DATA_DIR` → `./ces-data`
  *
- * Managed containers set both explicitly (the platform template provisions
+ * Managed containers set both explicitly (the cloud template provisions
  * `/ces-security` and `/ces-data` volumes); local mode sets them per
  * instance dir via the CLI. The assistant-visible data root (where
  * workspace, embeddings, etc. live) is a separate path and must never be
@@ -49,7 +49,7 @@ export function getCesMode(): CesMode {
  * Resolve the CES security directory (contains `keys.enc` + `store.key`).
  *
  * Priority:
- * 1. `CREDENTIAL_SECURITY_DIR` env var (set by the platform template for the
+ * 1. `CREDENTIAL_SECURITY_DIR` env var (set by the cloud template for the
  *    CES container — `/ces-security` in managed mode; per-instance
  *    `<instanceDir>/ces-security` in local mode)
  * 2. Default: `./ces-security` (cwd fallback convention)
@@ -65,7 +65,7 @@ export function getSecurityDir(): string {
  * Return the CES-private data root (grants, audit logs, tool store).
  *
  * Priority:
- * 1. `CES_DATA_DIR` env var (set by the platform template — `/ces-data` in
+ * 1. `CES_DATA_DIR` env var (set by the cloud template — `/ces-data` in
  *    managed mode; per-instance `<instanceDir>/ces-data` in local mode)
  * 2. Default: `./ces-data` (cwd fallback convention)
  */

package/src/server.ts

@@ -124,7 +124,7 @@ export class CesRpcServer {
     // Auto-register the update_managed_credential handler if a callback is provided.
     if (options.onApiKeyUpdate) {
       const onUpdate = options.onApiKeyUpdate;
-      this.handlers[CesRpcMethod.UpdateManagedCredential] = (
+      this.handlers[CesRpcMethod.UpdateCloudCredential] = (
         request: unknown,
       ) => {
         const { assistantApiKey, assistantId } = request as {