@mycadet/gateway 0.12.7 → 0.12.9

package/src/http/routes/ingress-domains.ts

@@ -0,0 +1,73 @@
+/**
+ * Loopback-guarded recording of a tunnel's public URL.
+ *
+ *   POST /v1/ingress/domains — the CLI (its ngrok agent, today) tells the
+ *   gateway the public URL its tunnel published; the gateway writes
+ *   `ingress.publicBaseUrl` + `publicBaseUrlManagedBy: "tunnel"` in its own
+ *   config via the same machinery its own tunnel uses, so both publishers
+ *   record through one path and the gateway's existing loss handling clears
+ *   it uniformly. Write-only: reads keep flowing through the config the
+ *   gateway already serves. While we ship one bundle the gateway still hosts
+ *   the ngrok-related logic; once the bundle splits, the gateway manages its
+ *   own tunnel (mycadet.ai vs <assistant>.mycadet.bot) and this route is what
+ *   the CLI-side publishers migrate onto.
+ */
+
+import { z } from "zod";
+
+import { normalizeHttpPublicBaseUrlWithoutTrailingSlash } from "@mycadet/service-contracts/ingress";
+
+import type { ConfigFileCache } from "../../config-file-cache.js";
+import { writeManagedPublicBaseUrl } from "../../tunnel/client.js";
+import {
+  enforceLoopbackOnly,
+  errorResponse,
+  rejectBrowserOrigin,
+} from "../loopback-guard.js";
+
+const SaveIngressDomainRequestSchema = z.object({
+  publicBaseUrl: z.string(),
+});
+
+export async function handleSaveIngressDomain(
+  req: Request,
+  clientIp: string,
+  configFile: ConfigFileCache,
+): Promise<Response> {
+  if (req.method !== "POST") {
+    return new Response("method not allowed", {
+      status: 405,
+      headers: { Allow: "POST" },
+    });
+  }
+
+  const guardError = enforceLoopbackOnly(req, clientIp, "ingress-domains");
+  if (guardError) return guardError;
+  const originError = rejectBrowserOrigin(req, clientIp, "ingress-domains");
+  if (originError) return originError;
+
+  let body: unknown;
+  try {
+    body = await req.json();
+  } catch {
+    body = {};
+  }
+  const parsed = SaveIngressDomainRequestSchema.safeParse(body);
+  if (!parsed.success) {
+    return errorResponse("BAD_REQUEST", "publicBaseUrl is required", 400);
+  }
+  const publicUrl = normalizeHttpPublicBaseUrlWithoutTrailingSlash(
+    parsed.data.publicBaseUrl,
+  );
+  if (!publicUrl) {
+    return errorResponse(
+      "BAD_REQUEST",
+      "publicBaseUrl must be an absolute http(s) URL",
+      400,
+    );
+  }
+
+  // No-op (no write) when the URL is already recorded as tunnel-managed.
+  await writeManagedPublicBaseUrl(publicUrl, configFile);
+  return Response.json({ ok: true });
+}

package/src/http/routes/live-voice-websocket.ts

@@ -119,7 +119,7 @@ async function checkLiveVoiceAuth(
         // the caller is *a* platform user who traversed tunnel, not that they
         // are THIS assistant's guardian, so cross-check the tunnel user id
         // against the bound platform user id (the same guardian check the
-        // edge-auth middleware applies to guardian routes under the managed
+        // edge-auth middleware applies to guardian routes under the cloud
         // bypass). Without it, any tunnel-authorized org user reaching this
         // assistant would be stamped guardian downstream.
         const guardianError = await requireManagedGuardian(
@@ -127,7 +127,7 @@ async function checkLiveVoiceAuth(
           log,
         );
         if (guardianError) return { response: guardianError };
-        // Tunnel attests a platform user, not an actor principal, so the
+        // Tunnel attests a cloud user, not an actor principal, so the
         // principal comes from the gateway's own binding rather than from
         // anything the request carried.
         const guardian = await findCadetGuardian();

package/src/http/routes/log-export.test.ts

@@ -112,7 +112,6 @@ const baseConfig: GatewayConfig = {
   runtimeMaxRetries: 2,
   runtimeProxyRequireAuth: true,
   runtimeTimeoutMs: 30000,
-  shutdownDrainMs: 5000,
   trustProxy: false,
 };
 

package/src/http/routes/log-tail.test.ts

@@ -79,7 +79,6 @@ function makeConfig(dir: string | undefined): GatewayConfig {
     runtimeMaxRetries: 2,
     runtimeProxyRequireAuth: true,
     runtimeTimeoutMs: 30000,
-    shutdownDrainMs: 5000,
     trustProxy: false,
   } as GatewayConfig;
 }

package/src/http/routes/migration-proxy.ts

@@ -452,7 +452,7 @@ async function handleSyncBytesImport(
  *
  * Returns the job's current status on 200, or 404 if the jobId is unknown
  * (never issued, or pruned after the TTL). The response shape deliberately
- * mirrors the platform's existing `/v1/migrations/import/:jobId/status/`
+ * mirrors the cloud's existing `/v1/migrations/import/:jobId/status/`
  * endpoint so `PlatformMigrationClient.pollImportStatus` works against
  * either surface with no changes.
  */

package/src/http/routes/plugin-webhook-websocket.test.ts

@@ -176,7 +176,7 @@ describe("upgrade gate", () => {
   });
 
   it("upgrades a cadet-signed declaration nobody approved", async () => {
-    // Only a caller holding the platform secret can open it, and the user
+    // Only a caller holding the cloud secret can open it, and the user
     // extended that trust when they connected their account.
     const handle = makeHandler({
       resolve: () =>
@@ -203,7 +203,7 @@ describe("upgrade gate", () => {
     expect(upgrades).toHaveLength(1);
   });
 
-  it("still demands the platform signature on an unapproved cadet route", async () => {
+  it("still demands the cloud signature on an unapproved cadet route", async () => {
     // Skipping approval did not skip authentication.
     const handle = makeHandler({
       resolve: () =>
@@ -378,7 +378,7 @@ describe("handshake signature", () => {
     expect(upgrades).toEqual([]);
   });
 
-  it("verifies a cadet-signed route against the platform secret", async () => {
+  it("verifies a cadet-signed route against the cloud secret", async () => {
     const handle = makeHandler({
       resolve: () => approvedWith([{ ...ROUTE, signer: "cadet" as const }]),
     });

package/src/http/routes/plugin-webhook.test.ts

@@ -335,7 +335,7 @@ describe("the gate", () => {
   });
 
   it("serves a cadet-signed declaration nobody approved", async () => {
-    // Only a caller holding the platform secret can reach it, and the user
+    // Only a caller holding the cloud secret can reach it, and the user
     // extended that trust when they connected their account.
     const { calls, fetchImpl } = recordingFetch();
     const handle = createPluginWebhookHandler({
@@ -364,7 +364,7 @@ describe("the gate", () => {
     expect(calls).toHaveLength(1);
   });
 
-  it("still demands the platform signature on an unapproved cadet route", async () => {
+  it("still demands the cloud signature on an unapproved cadet route", async () => {
     // Skipping approval did not skip authentication.
     const { calls, fetchImpl } = recordingFetch();
     const handle = createPluginWebhookHandler({
@@ -605,7 +605,7 @@ describe("signature verification", () => {
     expect(calls).toEqual([]);
   });
 
-  it("verifies a cadet-signed route against the platform secret", async () => {
+  it("verifies a cadet-signed route against the cloud secret", async () => {
     const { calls, fetchImpl } = recordingFetch();
     const handle = createPluginWebhookHandler({
       config: CONFIG,
@@ -645,7 +645,7 @@ describe("signature verification", () => {
     expect(calls).toEqual([]);
   });
 
-  it("does not accept the platform secret on a plugin-signed route", async () => {
+  it("does not accept the cloud secret on a plugin-signed route", async () => {
     const { calls, fetchImpl } = recordingFetch();
     const handle = createPluginWebhookHandler({
       config: CONFIG,
@@ -826,7 +826,7 @@ describe("declared verification", () => {
     expect(calls).toEqual([]);
   });
 
-  it("stops accepting the platform scheme once a descriptor is declared", async () => {
+  it("stops accepting the cloud scheme once a descriptor is declared", async () => {
     // Otherwise a declared route would have two ways in, and the weaker one
     // would decide.
     const { calls, fetchImpl } = recordingFetch();
@@ -1807,7 +1807,7 @@ describe("HMAC URL and form-encoded inbound", () => {
     expect(gateCalls.events).toEqual([]);
   });
 
-  it("verifies against the platform-injected URL when the raw URL differs", async () => {
+  it("verifies against the cloud-injected URL when the raw URL differs", async () => {
     const { calls, fetchImpl } = recordingFetch();
     const handle = createPluginWebhookHandler({
       config: CONFIG,
@@ -1816,10 +1816,11 @@ describe("HMAC URL and form-encoded inbound", () => {
       fetchImpl,
     });
 
-    // Twilio signed the platform callback URL; the gateway sees localhost.
+    // Twilio signed the cloud callback URL; the gateway sees localhost.
     // The proxy injects the original URL it handed the vendor, and the
     // signature covers that spelling rather than the one on the wire here.
-    const injected = "https://platform.example.test/v1/gateway/callbacks/cb-1";
+    const injected =
+      "https://test-cloud.mycadet.ai.test/v1/gateway/callbacks/cb-1";
     const params: Record<string, string> = {
       MessageSid: "SM9004",
       From: "+15555550101",

package/src/http/routes/plugin-webhook.ts

@@ -76,7 +76,7 @@ const log = getLogger("plugin-webhook");
 /**
  * Credential holding the secret that signs this route.
  *
- * `cadet` routes verify against the platform's own webhook secret — the
+ * `cadet` routes verify against the cloud's own webhook secret — the
  * same credential the email webhook uses — so a plugin that only ever hears
  * from Cadet needs no secret of its own. Everything else verifies against
  * the plugin's, stored under its own service name.

package/src/http/routes/speech-relay-websocket.ts

@@ -30,7 +30,7 @@ import type { GatewayConfig } from "../../config.js";
 import type { CredentialCache } from "../../credential-cache.js";
 import { credentialKey } from "../../credential-key.js";
 import { getLogger } from "../../logger.js";
-import { getPlatformBaseUrl } from "../../platform-url.js";
+import { getCloudBaseUrl } from "../../cloud-url.js";
 import { TUNNEL_FORWARDED_HEADER } from "../../tunnel/bridge-utils.js";
 import { requestHasTunnelBridgeAuth } from "../../tunnel/bridge-auth.js";
 
@@ -172,18 +172,15 @@ export function tunnelOriginForPlatformHost(host: string): string | null {
  * assistant's key is presented to its own environment's tunnel rather than
  * prod (which would reject it with `invalid_key`).
  */
-async function resolveTunnelBaseUrl(
-  config: GatewayConfig,
-  deps: SpeechRelayDeps,
-): Promise<string> {
+async function resolveTunnelBaseUrl(config: GatewayConfig): Promise<string> {
   if (config.tunnelBaseUrl) {
     return config.tunnelBaseUrl;
   }
-  const platformBaseUrl = await getPlatformBaseUrl(deps.credentials);
-  if (platformBaseUrl) {
+  const cloudBaseUrl = getCloudBaseUrl();
+  if (cloudBaseUrl) {
     try {
       const derived = tunnelOriginForPlatformHost(
-        new URL(platformBaseUrl).hostname,
+        new URL(cloudBaseUrl).hostname,
       );
       if (derived) {
         return derived;
@@ -320,7 +317,7 @@ export function createSpeechRelayUpgradeHandler(
       }
     }
     const { wsUrl, httpUrl } = tunnelSpeechUrls(
-      await resolveTunnelBaseUrl(config, deps),
+      await resolveTunnelBaseUrl(config),
       operation,
       params,
       version,
@@ -334,7 +331,7 @@ export function createSpeechRelayUpgradeHandler(
         return jsonError(
           401,
           "missing_platform_connection",
-          "no Cadet assistant API key is stored — connect the platform account",
+          "no Cadet assistant API key is stored — connect the cloud account",
         );
       }
       const rejection = await probeTunnel(
@@ -408,7 +405,7 @@ export function getSpeechRelayWebsocketHandlers() {
         sendRelayError(
           ws,
           "missing_platform_connection",
-          "no Cadet assistant API key is stored — connect the platform account",
+          "no Cadet assistant API key is stored — connect the cloud account",
         );
         ws.close(1011, "missing_platform_connection");
         return;

package/src/http/routes/stt-stream-websocket.ts

@@ -9,7 +9,7 @@
  * the binding, and dictation takes any valid actor, which is why that pin is a
  * route opt-in rather than part of the shared gate.
  *
- * A managed assistant is reached through tunnel, which validates the browser's
+ * A cloud assistant is reached through tunnel, which validates the browser's
  * own token and attests the caller to the bridge; there is no edge JWT on that
  * path to validate. So a tunnel-attested caller with the bridge proof is
  * admitted here the way live voice and watch admit one, minus their guardian

package/src/http/routes/telegram-webhook.test.ts

@@ -72,7 +72,6 @@ const baseConfig: GatewayConfig = {
   runtimeMaxRetries: 2,
   runtimeProxyRequireAuth: true,
   runtimeTimeoutMs: 30000,
-  shutdownDrainMs: 5000,
   trustProxy: false,
 };
 

package/src/http/routes/trust-rules-routes.ts

@@ -47,7 +47,7 @@ const CreateTrustRuleRequestSchema = z.object({
     .literal("everywhere")
     .optional()
     .describe(
-      'Compatibility field. Trust rules apply workspace-wide: the engine matches on (tool, pattern) only, so a narrower scope cannot be honored and any value other than "everywhere" is rejected rather than stored broader than the consent it records.',
+      'Compatibility field. Trust rules apply workspace-wide: the engine matches on tool and pattern only, so a narrower scope cannot be honored and any value other than "everywhere" is rejected rather than stored broader than the consent it records.',
     ),
 });
 
@@ -116,7 +116,7 @@ export const ROUTES: GatewayRouteDefinition[] = [
     queryParameters: [
       {
         name: "origin",
-        description: "Filter by origin (default | user_defined)",
+        description: "Filter by origin: default or user_defined",
       },
       { name: "tool", description: "Filter by tool name" },
       {

package/src/http/routes/twilio-voice-verify-callback.ts

@@ -14,7 +14,7 @@
 
 import type { GatewayConfig } from "../../config.js";
 import { getLogger } from "../../logger.js";
-import { resolvePlatformAssistantIdOrUndefined } from "../../platform-identity.js";
+import { resolveCloudAssistantIdOrUndefined } from "../../cloud-identity.js";
 import {
   CircuitBreakerOpenError,
   forwardTwilioVoiceWebhook,
@@ -239,7 +239,7 @@ async function forwardToAssistant(
   caches?: TwilioValidationCaches,
 ): Promise<Response> {
   try {
-    const platformAssistantId = await resolvePlatformAssistantIdOrUndefined();
+    const cloudAssistantId = await resolveCloudAssistantIdOrUndefined();
     const runtimeResponse = await forwardTwilioVoiceWebhook(
       config,
       params,
@@ -247,7 +247,7 @@ async function forwardToAssistant(
       resolvePublicBaseWssUrl(
         config,
         caches?.configFile,
-        platformAssistantId,
+        cloudAssistantId,
         validatedPublicUrl,
       ),
     );

package/src/http/routes/twilio-voice-webhook.test.ts

@@ -112,7 +112,6 @@ const baseConfig: GatewayConfig = {
   runtimeMaxRetries: 2,
   runtimeProxyRequireAuth: true,
   runtimeTimeoutMs: 30000,
-  shutdownDrainMs: 5000,
   trustProxy: false,
 };
 
@@ -392,7 +391,7 @@ describe("resolvePublicBaseWssUrl", () => {
     expect(resolvePublicBaseWssUrl(baseConfig)).toBeUndefined();
   });
 
-  test("uses tunnelBaseUrl + platformAssistantId when both are present", () => {
+  test("uses tunnelBaseUrl + cloudAssistantId when both are present", () => {
     const config = {
       ...baseConfig,
       tunnelBaseUrl: "https://tunnel-dev.mycadet.ai",
@@ -428,7 +427,7 @@ describe("resolvePublicBaseWssUrl", () => {
     );
   });
 
-  test("falls back to configFile publicBaseUrl when platformAssistantId is missing", () => {
+  test("falls back to configFile publicBaseUrl when cloudAssistantId is missing", () => {
     const config = {
       ...baseConfig,
       tunnelBaseUrl: "https://tunnel-dev.mycadet.ai",
@@ -483,7 +482,7 @@ describe("resolvePublicBaseWssUrl", () => {
     );
   });
 
-  test("does not use a platform callback URL as the websocket base", () => {
+  test("does not use a cloud callback URL as the websocket base", () => {
     const config = {
       ...baseConfig,
       tunnelBaseUrl: "https://tunnel-staging.mycadet.ai",

package/src/http/routes/twilio-voice-webhook.ts

@@ -2,7 +2,7 @@ import { LOCAL_ASSISTANT_ID } from "../../assistant-id.js";
 import type { ConfigFileCache } from "../../config-file-cache.js";
 import type { GatewayConfig } from "../../config.js";
 import { getLogger } from "../../logger.js";
-import { resolvePlatformAssistantIdOrUndefined } from "../../platform-identity.js";
+import { resolveCloudAssistantIdOrUndefined } from "../../cloud-identity.js";
 import { resolveAdmissionPolicy } from "../../risk/admission-policy-cache.js";
 import {
   CircuitBreakerOpenError,
@@ -204,7 +204,7 @@ export function createTwilioVoiceWebhookHandler(
     }
 
     try {
-      const platformAssistantId = await resolvePlatformAssistantIdOrUndefined();
+      const platformCloudId = await resolveCloudAssistantIdOrUndefined();
       const runtimeResponse = await forwardTwilioVoiceWebhook(
         config,
         params,
@@ -212,7 +212,7 @@ export function createTwilioVoiceWebhookHandler(
         resolvePublicBaseWssUrl(
           config,
           caches?.configFile,
-          platformAssistantId,
+          platformCloudId,
           validation.validatedCandidateUrl,
         ),
       );

package/src/http/routes/whatsapp-webhook.test.ts

@@ -91,7 +91,6 @@ const baseConfig: GatewayConfig = {
   runtimeMaxRetries: 2,
   runtimeProxyRequireAuth: true,
   runtimeTimeoutMs: 30000,
-  shutdownDrainMs: 5000,
   trustProxy: false,
 };