@mycadet/gateway 0.12.7 → 0.12.8

package/src/ipc/log-tail-handlers.test.ts

@@ -43,7 +43,6 @@ function makeConfig(): GatewayConfig {
     runtimeMaxRetries: 2,
     runtimeProxyRequireAuth: true,
     runtimeTimeoutMs: 30000,
-    shutdownDrainMs: 5000,
     trustProxy: false,
   } as GatewayConfig;
 }

package/src/ipc/risk-classification-handlers.test.ts

@@ -492,17 +492,17 @@ describe("skill classification", () => {
     expect(result.risk).toBe("low");
   });
 
-  test("scaffold_managed_skill is high risk", async () => {
+  test("scaffold_cloud_skill is high risk", async () => {
     const result = await classify({
-      tool: "scaffold_managed_skill",
+      tool: "scaffold_cloud_skill",
       skill: "new-skill",
     });
     expect(result.risk).toBe("high");
   });
 
-  test("delete_managed_skill is high risk", async () => {
+  test("delete_cloud_skill is high risk", async () => {
     const result = await classify({
-      tool: "delete_managed_skill",
+      tool: "delete_cloud_skill",
       skill: "old-skill",
     });
     expect(result.risk).toBe("high");

package/src/ipc/risk-classification-handlers.ts

@@ -471,8 +471,8 @@ export async function handleClassifyRisk(
 
     // ── Skill tools ───────────────────────────────────────────────────────
     case "skill_load":
-    case "scaffold_managed_skill":
-    case "delete_managed_skill": {
+    case "scaffold_cloud_skill":
+    case "delete_cloud_skill": {
       const assessment = await skillLoadRiskClassifier.classify({
         toolName: tool,
         skillSelector: params.skill,

package/src/remote-feature-flag-sync.ts

@@ -4,7 +4,7 @@ import { getDeviceId } from "./device-id.js";
 import { fetchImpl } from "./fetch.js";
 import { loadFeatureFlagDefaults } from "./feature-flag-defaults.js";
 import { writeRemoteFeatureFlags } from "./feature-flag-remote-store.js";
-import { arePlatformFeaturesEnabled } from "./feature-flag-resolver.js";
+import { areCloudFeaturesEnabled } from "./feature-flag-resolver.js";
 import { getLogger } from "./logger.js";
 
 const log = getLogger("remote-feature-flag-sync");
@@ -49,7 +49,7 @@ export type RemoteFeatureFlagSyncConfig = {
 };
 
 /**
- * Manages the lifecycle of syncing remote feature flags from the platform.
+ * Manages the lifecycle of syncing remote feature flags from the cloud.
  *
  * On start, fetches the current flag state and persists it to disk via the
  * remote feature flag store, then polls with adaptive back-off: starts at
@@ -328,7 +328,7 @@ export class RemoteFeatureFlagSync {
   }
 
   private async fetchRemoteFeatureFlags(): Promise<RemoteFetchResult> {
-    if (!arePlatformFeaturesEnabled()) {
+    if (!areCloudFeaturesEnabled()) {
       log.debug("Remote feature flag sync skipped: platform features disabled");
       return { status: "missing_credentials" };
     }
@@ -336,31 +336,29 @@ export class RemoteFeatureFlagSync {
     // Wrap credential reads so transient failures (CES unreachable, keychain
     // errors) are treated as retriable errors with backoff, not as "missing
     // credentials" which would pause polling indefinitely.
-    let platformUrlRaw: string | undefined;
     let assistantApiKeyRaw: string | undefined;
     try {
-      [platformUrlRaw, assistantApiKeyRaw] = await Promise.all([
-        this.credentials.get(credentialKey("cadet", "platform_base_url")),
-        this.credentials.get(credentialKey("cadet", "assistant_api_key")),
-      ]);
+      assistantApiKeyRaw = await this.credentials.get(
+        credentialKey("cadet", "assistant_api_key"),
+      );
     } catch (err) {
       log.warn({ err }, "Failed to read credentials — will retry on next poll");
       return { status: "error" };
     }
 
-    // Fall back to env vars when managed pod credentials are not yet cached.
-    const platformUrl = (
-      platformUrlRaw?.trim() ||
-      process.env.CADET_PLATFORM_URL?.trim() ||
-      ""
-    ).replace(/\/+$/, "");
+    // The base URL resolves from the environment only — the credential store
+    // never carries it.
+    const cloudUrl = (process.env.CADET_CLOUD_URL?.trim() || "").replace(
+      /\/+$/,
+      "",
+    );
 
     const assistantCredential =
       assistantApiKeyRaw?.trim() ||
       process.env.ASSISTANT_API_KEY?.trim() ||
       undefined;
 
-    if (!platformUrl) {
+    if (!cloudUrl) {
       log.debug("Remote feature flag sync skipped: no platform URL configured");
       return { status: "missing_credentials" };
     }
@@ -376,7 +374,7 @@ export class RemoteFeatureFlagSync {
       return { status: "error" };
     }
 
-    const url = `${platformUrl}/v1/feature-flags/assistant-flag-values/`;
+    const url = `${cloudUrl}/v1/feature-flags/assistant-flag-values/`;
     const headers: Record<string, string> = { Accept: "application/json" };
     if (assistantCredential) {
       headers["Authorization"] = `Api-Key ${assistantCredential}`;
@@ -412,9 +410,9 @@ export class RemoteFeatureFlagSync {
       return { status: "error" };
     }
 
-    // Accept boolean and string values from the platform. Prevent the
+    // Accept boolean and string values from the cloud. Prevent the
     // platform from disabling boolean flags that are already GA
-    // (defaultEnabled: true in the registry). The platform uses a
+    // (defaultEnabled: true in the registry). The cloud uses a
     // blanket-deny posture, sending false for every flag it knows about.
     // GA normalization only applies to boolean false values; string flag
     // values pass through unchanged.

package/src/risk/command-registry/commands/assistant.ts

@@ -574,13 +574,13 @@ const riskOverrides: AssistantRiskOverride[] = [
     path: "inference profiles update",
     risk: "medium",
     reason:
-      "Mutates a custom profile in llm.profiles; daemon rejects managed profiles",
+      "Mutates a custom profile in llm.profiles; daemon rejects cloud profiles",
   },
   {
     path: "inference profiles delete",
     risk: "medium",
     reason:
-      "Deletes a custom profile from llm.profiles; daemon rejects managed profiles",
+      "Deletes a custom profile from llm.profiles; daemon rejects cloud profiles",
   },
   {
     path: "inference profiles active",

package/src/risk/skill-risk-classifier.test.ts

@@ -19,10 +19,10 @@ describe("SkillLoadRiskClassifier", () => {
     expect(result.matchType).toBe("registry");
   });
 
-  test("scaffold_managed_skill is always High risk", async () => {
+  test("scaffold_cloud_skill is always High risk", async () => {
     const classifier = new SkillLoadRiskClassifier();
     const result = await classifier.classify({
-      toolName: "scaffold_managed_skill",
+      toolName: "scaffold_cloud_skill",
     });
     expect(result.riskLevel).toBe("high");
     expect(result.reason).toBe(
@@ -32,10 +32,10 @@ describe("SkillLoadRiskClassifier", () => {
     expect(result.matchType).toBe("registry");
   });
 
-  test("delete_managed_skill is always High risk", async () => {
+  test("delete_cloud_skill is always High risk", async () => {
     const classifier = new SkillLoadRiskClassifier();
     const result = await classifier.classify({
-      toolName: "delete_managed_skill",
+      toolName: "delete_cloud_skill",
     });
     expect(result.riskLevel).toBe("high");
     expect(result.reason).toBe(
@@ -55,19 +55,19 @@ describe("SkillLoadRiskClassifier", () => {
     expect(result.reason).toBe("Skill load (default)");
   });
 
-  test("scaffold_managed_skill with skillSelector is still High risk", async () => {
+  test("scaffold_cloud_skill with skillSelector is still High risk", async () => {
     const classifier = new SkillLoadRiskClassifier();
     const result = await classifier.classify({
-      toolName: "scaffold_managed_skill",
+      toolName: "scaffold_cloud_skill",
       skillSelector: "new-skill",
     });
     expect(result.riskLevel).toBe("high");
   });
 
-  test("delete_managed_skill with skillSelector is still High risk", async () => {
+  test("delete_cloud_skill with skillSelector is still High risk", async () => {
     const classifier = new SkillLoadRiskClassifier();
     const result = await classifier.classify({
-      toolName: "delete_managed_skill",
+      toolName: "delete_cloud_skill",
       skillSelector: "old-skill",
     });
     expect(result.riskLevel).toBe("high");
@@ -163,56 +163,56 @@ describe("allowlistOptions", () => {
     ]);
   });
 
-  test("scaffold_managed_skill produces skill-specific + wildcard options", async () => {
+  test("scaffold_cloud_skill produces skill-specific + wildcard options", async () => {
     const classifier = new SkillLoadRiskClassifier();
     const result = await classifier.classify({
-      toolName: "scaffold_managed_skill",
+      toolName: "scaffold_cloud_skill",
       skillSelector: "new-skill",
     });
     expect(result.allowlistOptions).toEqual([
       {
         label: "new-skill",
         description: "This skill only",
-        pattern: "scaffold_managed_skill:new-skill",
+        pattern: "scaffold_cloud_skill:new-skill",
       },
       {
-        label: "scaffold_managed_skill:*",
+        label: "scaffold_cloud_skill:*",
         description: "All managed skill scaffolds",
-        pattern: "scaffold_managed_skill:*",
+        pattern: "scaffold_cloud_skill:*",
       },
     ]);
   });
 
-  test("delete_managed_skill produces skill-specific + wildcard options", async () => {
+  test("delete_cloud_skill produces skill-specific + wildcard options", async () => {
     const classifier = new SkillLoadRiskClassifier();
     const result = await classifier.classify({
-      toolName: "delete_managed_skill",
+      toolName: "delete_cloud_skill",
       skillSelector: "old-skill",
     });
     expect(result.allowlistOptions).toEqual([
       {
         label: "old-skill",
         description: "This skill only",
-        pattern: "delete_managed_skill:old-skill",
+        pattern: "delete_cloud_skill:old-skill",
       },
       {
-        label: "delete_managed_skill:*",
+        label: "delete_cloud_skill:*",
         description: "All managed skill deletes",
-        pattern: "delete_managed_skill:*",
+        pattern: "delete_cloud_skill:*",
       },
     ]);
   });
 
-  test("scaffold_managed_skill without selector produces only wildcard", async () => {
+  test("scaffold_cloud_skill without selector produces only wildcard", async () => {
     const classifier = new SkillLoadRiskClassifier();
     const result = await classifier.classify({
-      toolName: "scaffold_managed_skill",
+      toolName: "scaffold_cloud_skill",
     });
     expect(result.allowlistOptions).toEqual([
       {
-        label: "scaffold_managed_skill:*",
+        label: "scaffold_cloud_skill:*",
         description: "All managed skill scaffolds",
-        pattern: "scaffold_managed_skill:*",
+        pattern: "scaffold_cloud_skill:*",
       },
     ]);
   });
@@ -228,8 +228,8 @@ describe("singleton", () => {
   test("singleton produces same results as fresh instance", async () => {
     const inputs: SkillClassifierInput[] = [
       { toolName: "skill_load" },
-      { toolName: "scaffold_managed_skill" },
-      { toolName: "delete_managed_skill" },
+      { toolName: "scaffold_cloud_skill" },
+      { toolName: "delete_cloud_skill" },
     ];
 
     const fresh = new SkillLoadRiskClassifier();

package/src/risk/skill-risk-classifier.ts

@@ -4,8 +4,8 @@
  * Implements RiskClassifier<SkillClassifierInput> with constant risk levels
  * for each skill tool type:
  * - skill_load: Low (read-only skill loading)
- * - scaffold_managed_skill: High (writes persistent skill source code)
- * - delete_managed_skill: High (removes persistent skill source code)
+ * - scaffold_cloud_skill: High (writes persistent skill source code)
+ * - delete_cloud_skill: High (removes persistent skill source code)
  *
  * Gateway adaptation: accepts pre-resolved skill metadata via
  * SkillClassifierInput.resolvedMetadata instead of importing the assistant's
@@ -50,7 +50,7 @@ export interface ResolvedSkillMetadata {
 /** Input to the skill risk classifier. */
 export interface SkillClassifierInput {
   /** Which skill tool is being invoked. */
-  toolName: "skill_load" | "scaffold_managed_skill" | "delete_managed_skill";
+  toolName: "skill_load" | "scaffold_cloud_skill" | "delete_cloud_skill";
   /** Optional skill selector (e.g. skill name or path). */
   skillSelector?: string;
   /**
@@ -134,12 +134,12 @@ function buildSkillLoadAllowlistOptions(
 /**
  * Build allowlist options for scaffold/delete managed skill tools.
  */
-function buildManagedSkillAllowlistOptions(
+function buildCloudSkillAllowlistOptions(
   toolName: string,
   skillId?: string,
 ): AllowlistOption[] {
   const toolLabel =
-    toolName === "scaffold_managed_skill" ? "scaffold" : "delete";
+    toolName === "scaffold_cloud_skill" ? "scaffold" : "delete";
   const options: AllowlistOption[] = [];
   if (skillId) {
     options.push({
@@ -200,25 +200,25 @@ export class SkillLoadRiskClassifier implements RiskClassifier<SkillClassifierIn
         };
         break;
       }
-      case "scaffold_managed_skill":
+      case "scaffold_cloud_skill":
         assessment = {
           riskLevel: "high",
           reason: "Skill scaffold — writes persistent skill source code",
           scopeOptions: [],
           matchType: "registry",
-          allowlistOptions: buildManagedSkillAllowlistOptions(
+          allowlistOptions: buildCloudSkillAllowlistOptions(
             toolName,
             skillSelector,
           ),
         };
         break;
-      case "delete_managed_skill":
+      case "delete_cloud_skill":
         assessment = {
           riskLevel: "high",
           reason: "Skill delete — removes persistent skill source code",
           scopeOptions: [],
           matchType: "registry",
-          allowlistOptions: buildManagedSkillAllowlistOptions(
+          allowlistOptions: buildCloudSkillAllowlistOptions(
             toolName,
             skillSelector,
           ),
@@ -227,7 +227,7 @@ export class SkillLoadRiskClassifier implements RiskClassifier<SkillClassifierIn
     }
 
     // User override is applied after normal classification. This means a user-defined
-    // rule CAN lower a security-escalated risk (e.g., scaffold_managed_skill).
+    // rule CAN lower a security-escalated risk (e.g., scaffold_cloud_skill).
     // This is intentional — user overrides are authoritative for users who explicitly
     // created them. Uses resolved skillId from metadata (when available), and
     // skill_load_dynamic as the tool key for dynamic skills.

package/src/runtime/client.ts

@@ -397,12 +397,12 @@ function extractPlatformCallbackAssistantId(
 
 function resolveTunnelBaseWssUrl(
   config: GatewayConfig,
-  platformAssistantId?: string,
+  cloudAssistantId?: string,
 ): string | undefined {
-  if (!config.tunnelBaseUrl || !platformAssistantId) return undefined;
+  if (!config.tunnelBaseUrl || !cloudAssistantId) return undefined;
 
   const withPath =
-    config.tunnelBaseUrl.replace(/\/+$/, "") + "/" + platformAssistantId;
+    config.tunnelBaseUrl.replace(/\/+$/, "") + "/" + cloudAssistantId;
   const normalizedTunnelUrl = normalizePublicBaseUrl(withPath);
   return normalizedTunnelUrl
     ? toWebSocketBaseUrl(normalizedTunnelUrl)
@@ -418,7 +418,7 @@ function resolveTunnelBaseWssUrl(
  * 2. `ingress.publicBaseUrl` from the config file when it is a real public
  *    gateway base URL — written by Tunnel after tunnel registration, or set
  *    manually for self-hosted.
- * 3. `TUNNEL_BASE_URL` + the platform assistant ID from a configured callback
+ * 3. `TUNNEL_BASE_URL` + the cloud assistant ID from a configured callback
  *    URL or credential cache.
  *
  * Returns `undefined` when no source provides a value — the placeholder
@@ -428,7 +428,7 @@ function resolveTunnelBaseWssUrl(
 export function resolvePublicBaseWssUrl(
   config: GatewayConfig,
   configFile?: ConfigFileCache,
-  platformAssistantId?: string,
+  cloudAssistantId?: string,
   validatedPublicUrl?: string,
 ): string | undefined {
   const raw = configFile?.getString("ingress", "publicBaseUrl");
@@ -450,7 +450,7 @@ export function resolvePublicBaseWssUrl(
 
   return resolveTunnelBaseWssUrl(
     config,
-    configuredCallbackAssistantId ?? platformAssistantId,
+    configuredCallbackAssistantId ?? cloudAssistantId,
   );
 }
 
@@ -462,12 +462,12 @@ export function resolvePublicBaseWssUrl(
  * Sources (in priority order):
  * 1. `ingress.publicBaseUrl` from the config file — written by Tunnel after
  *    tunnel registration, or set manually for self-hosted.
- * 2. `TUNNEL_BASE_URL` + the platform assistant ID. This mirrors the Twilio
+ * 2. `TUNNEL_BASE_URL` + the cloud assistant ID. This mirrors the Twilio
  *    resolver's fallback and stays valid even while the tunnel is briefly
  *    disconnected (Tunnel clears the config value on every reconnect), so
  *    these links no longer break on a tunnel flap.
  *
- * The platform assistant ID is read through a lazy getter so callers that
+ * The cloud assistant ID is read through a lazy getter so callers that
  * resolve from the config value (self-hosted / manual URL) never load
  * identity. A transient credential-store outage must not fail those callers.
  *
@@ -476,14 +476,14 @@ export function resolvePublicBaseWssUrl(
 export async function resolvePublicHttpBaseUrl(
   config: GatewayConfig,
   configFile?: ConfigFileCache,
-  getPlatformAssistantId?: () => Promise<string | undefined>,
+  getCloudAssistantId?: () => Promise<string | undefined>,
 ): Promise<string | undefined> {
   const resolved =
     normalizeHttpPublicBaseUrl(
       configFile?.getString("ingress", "publicBaseUrl"),
     ) ??
     normalizeHttpPublicBaseUrl(
-      await resolveTunnelHttpFallback(config, getPlatformAssistantId),
+      await resolveTunnelHttpFallback(config, getCloudAssistantId),
     );
 
   // Drop a root-path trailing slash so callers can append `/…` without
@@ -492,18 +492,18 @@ export async function resolvePublicHttpBaseUrl(
 }
 
 /**
- * Build the `TUNNEL_BASE_URL/<platform-assistant-id>` fallback base URL. Only
- * reads the platform assistant ID (via the getter) when `tunnelBaseUrl` is
+ * Build the `TUNNEL_BASE_URL/<cloud-assistant-id>` fallback base URL. Only
+ * reads the cloud assistant ID (via the getter) when `tunnelBaseUrl` is
  * configured, so it's skipped entirely on self-hosted deployments.
  */
 async function resolveTunnelHttpFallback(
   config: GatewayConfig,
-  getPlatformAssistantId?: () => Promise<string | undefined>,
+  getCloudAssistantId?: () => Promise<string | undefined>,
 ): Promise<string | undefined> {
-  if (!config.tunnelBaseUrl || !getPlatformAssistantId) return undefined;
-  const platformAssistantId = await getPlatformAssistantId();
-  if (!platformAssistantId) return undefined;
-  return config.tunnelBaseUrl.replace(/\/+$/, "") + "/" + platformAssistantId;
+  if (!config.tunnelBaseUrl || !getCloudAssistantId) return undefined;
+  const cloudAssistantId = await getCloudAssistantId();
+  if (!cloudAssistantId) return undefined;
+  return config.tunnelBaseUrl.replace(/\/+$/, "") + "/" + cloudAssistantId;
 }
 
 /**

package/src/schema.ts

@@ -1751,7 +1751,7 @@ export function buildSchema(): Record<string, unknown> {
         post: {
           summary: "Mark a contact channel as verified by guardian attestation",
           description:
-            "Guardian-only endpoint that attests a contact channel as verified without exchanging a challenge code. The caller must be the bound guardian — verified either by JWT actor principal (laptop / docker) or by `X-Cadet-User-Id` matching the stored platform user id (platform-managed). Idempotent: an already-verified channel returns 200 without re-writing. Mutation is gateway-DB primary with a best-effort dual-write to the assistant daemon DB for sync during the gateway-security-migration transition.",
+            "Guardian-only endpoint that attests a contact channel as verified without exchanging a challenge code. The caller must be the bound guardian — verified either by JWT actor principal (laptop / docker) or by `X-Cadet-User-Id` matching the stored platform user id (cloud-managed). Idempotent: an already-verified channel returns 200 without re-writing. Mutation is gateway-DB primary with a best-effort dual-write to the assistant daemon DB for sync during the gateway-security-migration transition.",
           operationId: "contactsChannelVerify",
           security: [{ BearerAuth: [] }],
           parameters: [
@@ -2407,7 +2407,7 @@ export function buildSchema(): Record<string, unknown> {
           operationId: "oauthProvidersList",
           parameters: [
             {
-              name: "supports_managed_mode",
+              name: "supports_cloud_mode",
               in: "query",
               required: false,
               schema: { type: "boolean" },
@@ -2509,7 +2509,7 @@ export function buildSchema(): Record<string, unknown> {
         post: {
           summary: "Create OAuth app",
           description:
-            "Authenticated gateway endpoint that creates or updates a user-managed OAuth app by proxying to the assistant runtime.",
+            "Authenticated gateway endpoint that creates or updates a user-cloud OAuth app by proxying to the assistant runtime.",
           operationId: "oauthAppsCreate",
           security: [{ BearerAuth: [] }],
           requestBody: {
@@ -2546,7 +2546,7 @@ export function buildSchema(): Record<string, unknown> {
         delete: {
           summary: "Delete OAuth app",
           description:
-            "Authenticated gateway endpoint that deletes a user-managed OAuth app and disconnects its linked accounts by proxying to the assistant runtime.",
+            "Authenticated gateway endpoint that deletes a user-cloud OAuth app and disconnects its linked accounts by proxying to the assistant runtime.",
           operationId: "oauthAppsDelete",
           parameters: [
             {
@@ -4346,7 +4346,7 @@ export function buildSchema(): Record<string, unknown> {
         post: {
           summary: "Auto-verify guardian email",
           description:
-            "Called by the platform to auto-verify the guardian's email channel. For BYO providers (resend, mailgun), validates the provider API key. For platform-managed email (cadet), the route's auth is sufficient. Creates a guardian email channel binding.",
+            "Called by the cloud to auto-verify the guardian's email channel. For BYO providers (resend, mailgun), validates the provider API key. For cloud-managed email (cadet), the route's auth is sufficient. Creates a guardian email channel binding.",
           operationId: "inboundRegister",
           security: [{ BearerAuth: [] }],
           requestBody: {

package/src/telegram/send.test.ts

@@ -39,7 +39,6 @@ const baseConfig: GatewayConfig = {
   runtimeMaxRetries: 2,
   runtimeProxyRequireAuth: true,
   runtimeTimeoutMs: 30000,
-  shutdownDrainMs: 5000,
   trustProxy: false,
 };