@yalehwang/cloudpit 2.0.0 → 3.0.0

package/server/modules/liaison/liaison-deliver.service.ts

@@ -3,18 +3,18 @@
  *
  * The mechanism this file implements is small on purpose: given an initiative and a target
  * project, ask the fleet registry which session is that pair's LIAISON session, and hand the
- * message to CloudCLI's existing session send service — or, when nobody is there to take it,
+ * message to Cloudpit's existing session send service — or, when nobody is there to take it,
  * queue it in the initiative's inbox until the session comes back.
  *
  * ## Why the resolution is a REGISTRY READ and never a name
  *
  * `fleet-liaison-stable-addressing-probe` (2026-10-24) measured what is stable across a
- * restart: the CloudCLI session id is the only identity a registry row can hold that survives
+ * restart: the Cloudpit session id is the only identity a registry row can hold that survives
  * the process, while `pid` changes every launch (and can be reused) and `name` is not an
  * address at all — three live sessions shared one name on the observed host. So this service
  * never looks a peer up by name: it reads the (initiative, project) two-key mapping
  * (`registry.json`'s `liaisonSessions`, written by `registry sessions add --role liaison`),
- * and the registry's `sessionId` is the CloudCLI session id. Liveness is then the ONE
+ * and the registry's `sessionId` is the Cloudpit session id. Liveness is then the ONE
  * question the host registry answers (`liveHostForSession`), which is authoritative in this
  * process in a way a local `~/.claude/sessions/<pid>.json` cross-check is not.
  *
@@ -299,7 +299,7 @@ export type LiaisonRecoveryOutcome = {
 export type LiaisonDeliverDeps = {
   /** The fleet CLI seam (production: a real `quay-fleet` child). */
   runFleet: LiaisonFleetRun;
-  /** Whether CloudCLI is currently serving this session (production: the host registry). */
+  /** Whether Cloudpit is currently serving this session (production: the host registry). */
   isSessionLive: (sessionId: string) => boolean;
   /** The existing session send service. */
   sendMessage: LiaisonSendMessage;

package/server/modules/liaison/liaison.module.ts

@@ -94,7 +94,7 @@ export type LiaisonModule = {
  * The real `quay-fleet` runner.
  *
  * The binary is looked up per call rather than captured at boot, so an operator can install
- * (or re-point `QUAY_FLEET_BIN` at) a fleet without restarting CloudCLI. A missing binary is
+ * (or re-point `QUAY_FLEET_BIN` at) a fleet without restarting Cloudpit. A missing binary is
  * the ordinary unavailable answer; the caller turns it into the explicit registry error AC2
  * requires rather than a silent drop.
  */

package/server/modules/mcp-gateway/mcp-gateway.auth.ts

@@ -167,8 +167,9 @@ function resolvePrincipal(
       userId: verified.userId,
       tokenId: verified.tokenId,
       clientId: null,
-      // Both spellings are accepted at issuance; every consumer compares the
-      // legacy `requiredScopes` literals, so the principal carries canonical names.
+      // 3.0 issues only `cloudpit:*`, but every consumer compares the canonical
+      // `requiredScopes` literals, so the principal carries canonical names. An old
+      // token whose row holds the legacy spelling passes through unchanged.
       scopes: verified.scopes.map(canonicalScope),
     };
   }

package/server/modules/mcp-gateway/mcp-self-target.ts

@@ -2,8 +2,8 @@
  * The MCP gateway's self-referential guard (AC-252; SPEC
  * `docs/proposals/mcp-gateway-SPEC.md` v3.1 §290–§300).
  *
- * A gateway client can itself be a CloudCLI session — the canonical nesting is
- * "a Claude Code session opened inside CloudCLI calling CloudCLI's own MCP
+ * A gateway client can itself be a Cloudpit session — the canonical nesting is
+ * "a Claude Code session opened inside Cloudpit calling Cloudpit's own MCP
  * server". When that session calls a WRITE tool against ITSELF it does not just
  * act on a stranger: `session_send` queues a message behind the round that is
  * waiting for this very tool result, and `session_interrupt` / `session_close`

package/server/modules/mcp-gateway/mcp-session-send.ts

@@ -95,12 +95,24 @@ import type { McpRunGetDeps, RunGetPayload } from './mcp-run-get.js';
  */
 export type { McpControlCaller };
 
-/** The refusals `session_send` translates. The vocabulary is the control service's own. */
+/**
+ * The refusals `session_send` translates. The vocabulary is the control
+ * service's own.
+ *
+ * The last two are the session's upstream-provider guard (AC-462): a model that
+ * would move the session to another provider, or one bound to a provider that
+ * no longer exists. The adapter does not pass them through verbatim — it maps
+ * both to the gateway's own `INVALID_ARGUMENT` so every tool keeps emitting a
+ * canonical `MCP_ERROR_CODES` value — but the seam has to state them, because
+ * the control service's result now carries them.
+ */
 export type McpControlRefusalCode =
   | 'SESSION_NOT_FOUND'
   | 'UNSUPPORTED_PROVIDER'
   | 'RUN_IN_PROGRESS'
-  | 'FORBIDDEN';
+  | 'FORBIDDEN'
+  | 'SESSION_PROVIDER_MISMATCH'
+  | 'SESSION_PROVIDER_UNKNOWN';
 
 /**
  * The control service result `session_send` reads, declared structurally.
@@ -595,6 +607,13 @@ export async function buildSessionSend(
         hint: RUN_IN_PROGRESS_HINT,
       });
     }
+    if (result.code === 'SESSION_PROVIDER_MISMATCH' || result.code === 'SESSION_PROVIDER_UNKNOWN') {
+      // The selection is unusable for THIS session (its thread is bound to the
+      // provider it started under, or the bound provider is gone). The message
+      // already names the fork/new-session action, so the envelope only has to
+      // state the class in the gateway's own vocabulary.
+      throw new McpToolError(MCP_ERROR_CODES.INVALID_ARGUMENT, result.message, true);
+    }
     throw new McpToolError(result.code, result.message, true);
   }
 

package/server/modules/mcp-gateway/mcp-tool-annotations.ts

@@ -27,7 +27,7 @@
  *    behaviour; otherwise left false (the spec default).
  *  - `openWorldHint` (spec default `true`): true when the tool's effect is
  *    delivered OUTSIDE this server's own store — it drives, starts, stops or
- *    authorizes a provider agent/process. False for tools confined to CloudCLI's
+ *    authorizes a provider agent/process. False for tools confined to Cloudpit's
  *    stored state (its database, its lease table, its queue, its cached
  *    snapshot).
  *
@@ -163,18 +163,18 @@ export const MCP_TOOL_ANNOTATIONS: Record<McpGatewayToolName, ToolAnnotations> =
   // asks the connected browsers what they are showing and reads their answers:
   // nothing is stored, and a repeat with no browser state change reads the same
   // fact. The question reaches the browsers, but it drives no provider agent and
-  // mutates no CloudCLI state, so the world stays closed.
+  // mutates no Cloudpit state, so the world stays closed.
   ui_visible_context: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false },
   // lists the connected browsers and status, reading their answers to one
   // round-trip question: nothing is stored, and a repeat with no browser state
   // change reads the same roster. The question reaches the browsers, but it
-  // drives no provider agent and mutates no CloudCLI state, so the world stays
+  // drives no provider agent and mutates no Cloudpit state, so the world stays
   // closed — the same reading `ui_visible_context` above carries.
   ui_clients_list: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false },
   // scans the stored provider transcripts and titles and reads nothing else:
   // nothing is stored, and a repeat over an unchanged store reads the same
   // matches. The scan touches files on disk, but it drives no provider agent and
-  // mutates no CloudCLI state, so the world stays closed.
+  // mutates no Cloudpit state, so the world stays closed.
   session_search: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false },
   // reads the user's transcript SELECTION through the same browser round trip as
   // `ui_visible_context`: nothing is stored, and a repeat with no browser state

package/server/modules/mcp-gateway/oauth-metadata.gate.ts

@@ -22,10 +22,7 @@
  * objects in one process, and a process-lifetime cache would collapse them.
  */
 
-import {
-  ACCESS_TOKEN_SCOPES,
-  CLOUDPIT_ACCESS_TOKEN_SCOPES,
-} from '@/shared/mcp-contract/index.js';
+import { CLOUDPIT_ACCESS_TOKEN_SCOPES } from '@/shared/mcp-contract/index.js';
 
 import { readMcpOauthEnabled } from './mcp-gateway.loopback.js';
 
@@ -183,7 +180,9 @@ export function buildAuthorizationServerMetadata(options: {
     code_challenge_methods_supported: ['S256'],
     grant_types_supported: ['authorization_code', 'refresh_token'],
     token_endpoint_auth_methods_supported: ['client_secret_post', 'none'],
-    scopes_supported: [...CLOUDPIT_ACCESS_TOKEN_SCOPES, ...ACCESS_TOKEN_SCOPES],
+    // 3.0 advertises exactly the one wire vocabulary. The canonical `cloudcli:*` names are
+    // internal (stored grants and `requiredScopes`), never an accepted request spelling.
+    scopes_supported: [...CLOUDPIT_ACCESS_TOKEN_SCOPES],
   };
 
   if (dcrMode !== 'off') {

package/server/modules/mcp-gateway/tests/knowledge-effective-config-proof.test.ts

@@ -284,7 +284,7 @@ async function withHarness(arms: Arms, run: HarnessRun): Promise<void> {
   const readToken = tokens.issueToken({
     userId: USER_ONE,
     name: 'knowledge-effective-config-proof',
-    scopes: ['cloudcli:read'],
+    scopes: ['cloudpit:read'],
     expiresInDays: 30,
   });
   if (!readToken.ok) throw new Error('the harness must mint a read token');

package/server/modules/mcp-gateway/tests/knowledge-peer-correlation-proof.test.ts

@@ -157,8 +157,8 @@ const CORRELATION = 'corr-peer-ask-1';
 const DELIVERY_ID = 'delivery-peer-ask-1';
 const REPLY_UUID = 'reply-assistant-1';
 const ASK_MESSAGE_ID = 'assistant-ask-1';
-const READ_SCOPE = 'cloudcli:read';
-const SEND_SCOPE = 'cloudcli:session:send';
+const READ_SCOPE = 'cloudpit:read';
+const SEND_SCOPE = 'cloudpit:session:send';
 
 function idsOf(tag: string) {
   return {

package/server/modules/mcp-gateway/tests/mcp-approvals.test.ts

@@ -86,6 +86,7 @@ type AnyRecord = Record<string, unknown>;
 // --------------------------- fixture identities ---------------------------
 
 const USER_ONE = 1;
+const wire = (scopes: string[]) => scopes.map((scope) => scope.replace('cloudcli:', 'cloudpit:'));
 const READ_SCOPE = 'cloudcli:read';
 const APPROVE_SCOPE = 'cloudcli:approve';
 /** The pinned "now" so `waitedMs` is exactly assertable. */
@@ -310,13 +311,13 @@ async function withHarness(options: HarnessOptions, run: (harness: Harness) => P
   const readToken = tokens.issueToken({
     userId: USER_ONE,
     name: 'ac274-read',
-    scopes: [READ_SCOPE],
+    scopes: wire([READ_SCOPE]),
     expiresInDays: 30,
   });
   const approveToken = tokens.issueToken({
     userId: USER_ONE,
     name: 'ac274-approve',
-    scopes: [READ_SCOPE, APPROVE_SCOPE],
+    scopes: wire([READ_SCOPE, APPROVE_SCOPE]),
     expiresInDays: 30,
   });
   if (!readToken.ok || !approveToken.ok) {

package/server/modules/mcp-gateway/tests/mcp-audit-route.test.ts

@@ -214,7 +214,7 @@ async function withAuditServer(run: (harness: Harness) => Promise<void>): Promis
   const address = server.address() as AddressInfo;
 
   const issue = (userId: number, name: string): { id: number; token: string } => {
-    const issued = tokens.issueToken({ userId, name, scopes: ['cloudcli:read'], expiresInDays: 30 });
+    const issued = tokens.issueToken({ userId, name, scopes: ['cloudpit:read'], expiresInDays: 30 });
     if (!issued.ok) {
       throw new Error('the harness issued a token with a lifetime the service rejects');
     }

package/server/modules/mcp-gateway/tests/mcp-audit.test.ts

@@ -293,8 +293,8 @@ function assertIdentity(row: ReturnType<typeof lastRow>, tokenId: number): void
 
 test('(a) every tool call writes exactly one row, for ok, denied and error', async () => {
   await withAuditServer(async (server) => {
-    const full = server.issue(['cloudcli:read', 'cloudcli:session:send']);
-    const readOnly = server.issue(['cloudcli:read']);
+    const full = server.issue(['cloudpit:read', 'cloudpit:session:send']);
+    const readOnly = server.issue(['cloudpit:read']);
     const authorization = `Bearer ${full.token}`;
 
     const readings: string[] = [];
@@ -383,7 +383,7 @@ test('(a) every tool call writes exactly one row, for ok, denied and error', asy
 
 test('(b) the digest keeps ids verbatim and reduces free text to length + 40 chars', async () => {
   await withAuditServer(async (server) => {
-    const full = server.issue(['cloudcli:session:send']);
+    const full = server.issue(['cloudpit:session:send']);
     const message = 'A'.repeat(500);
     const sessionId = 'sess-id-123';
     const projectId = 'proj-id-456';
@@ -421,7 +421,7 @@ test('(b) the digest keeps ids verbatim and reduces free text to length + 40 cha
 
 test('(c) unauthenticated calls answer 401, write no row, and leave the server alive', async () => {
   await withAuditServer(async (server) => {
-    const valid = server.issue(['cloudcli:read']);
+    const valid = server.issue(['cloudpit:read']);
     const before = mcpAuditLogDb.count();
 
     const cases: { label: string; authorization?: string }[] = [

package/server/modules/mcp-gateway/tests/mcp-auth.test.ts

@@ -55,6 +55,8 @@ const MCP_ACCEPT = 'application/json, text/event-stream';
 const USER_ONE = 1;
 const START = new Date('2026-01-01T00:00:00.000Z');
 const MS_PER_DAY = 24 * 60 * 60 * 1000;
+// The canonical spelling a stored token row and the principal carry; the harness
+// mints its wire equivalent (`cloudpit:read`) through the real issue path.
 const VALID_SCOPES = ['cloudcli:read'];
 
 // --------------------------- HTTP ---------------------------
@@ -245,7 +247,7 @@ async function withMcpAuthServer(run: (harness: Harness) => Promise<void>): Prom
   const address = server.address() as AddressInfo;
 
   const issue = (expiresInDays: number): IssuedAccessToken => {
-    const issued = tokens.issueToken({ userId: USER_ONE, name: 'mcp', scopes: VALID_SCOPES, expiresInDays });
+    const issued = tokens.issueToken({ userId: USER_ONE, name: 'mcp', scopes: VALID_SCOPES.map((scope) => scope.replace('cloudcli:', 'cloudpit:')), expiresInDays });
     if (!issued.ok) {
       throw new Error('the harness issued a token with a lifetime the service rejects');
     }

package/server/modules/mcp-gateway/tests/mcp-cancel-queued.test.ts

@@ -130,6 +130,7 @@ type RuntimeService = ReturnType<typeof createProviderRuntimeService>;
 
 const USER_ONE = 1;
 const DEBUG_PROVIDER = DEBUG_AGENT_PROVIDER_ID as LLMProvider;
+const wire = (scopes: string[]) => scopes.map((scope) => scope.replace('cloudcli:', 'cloudpit:'));
 const READ_SCOPE = 'cloudcli:read';
 const SESSION_SEND_SCOPE = 'cloudcli:session:send';
 const SESSION_CONTROL_SCOPE = 'cloudcli:session:control';
@@ -410,13 +411,13 @@ async function withHarness(arm: ArmOptions, run: (harness: Harness) => Promise<v
   const mainToken = tokens.issueToken({
     userId: USER_ONE,
     name: 'ac271-main',
-    scopes: [READ_SCOPE, SESSION_SEND_SCOPE, SESSION_CONTROL_SCOPE],
+    scopes: wire([READ_SCOPE, SESSION_SEND_SCOPE, SESSION_CONTROL_SCOPE]),
     expiresInDays: 30,
   });
   const sendOnlyToken = tokens.issueToken({
     userId: USER_ONE,
     name: 'ac271-send-only',
-    scopes: [READ_SCOPE, SESSION_SEND_SCOPE],
+    scopes: wire([READ_SCOPE, SESSION_SEND_SCOPE]),
     expiresInDays: 30,
   });
   if (!mainToken.ok || !sendOnlyToken.ok) {

package/server/modules/mcp-gateway/tests/mcp-cockpit-tools.test.ts

@@ -291,9 +291,13 @@ async function withArm(run: (arm: Arm) => Promise<void>): Promise<void> {
 
   const tokens = createAccessTokensService({ now: () => new Date() });
   const issued = {
-    read: issue(tokens, 'cockpit-read', [MCP_COCKPIT_READ_SCOPE]),
-    act: issue(tokens, 'cockpit-act', [MCP_COCKPIT_READ_SCOPE, MCP_COCKPIT_ACT_SCOPE]),
-    navigate: issue(tokens, 'cockpit-navigate', ['cloudcli:navigate']),
+    // 3.0 issues the wire spelling; the tool declarations stay canonical `cloudcli:*`.
+    read: issue(tokens, 'cockpit-read', [MCP_COCKPIT_READ_SCOPE.replace('cloudcli:', 'cloudpit:')]),
+    act: issue(tokens, 'cockpit-act', [
+      MCP_COCKPIT_READ_SCOPE.replace('cloudcli:', 'cloudpit:'),
+      MCP_COCKPIT_ACT_SCOPE.replace('cloudcli:', 'cloudpit:'),
+    ]),
+    navigate: issue(tokens, 'cockpit-navigate', ['cloudpit:navigate']),
   };
 
   const app = express();

package/server/modules/mcp-gateway/tests/mcp-correlation-id.test.ts

@@ -94,11 +94,11 @@ const SESSION_ROWS = [
 ];
 
 /** The scope each probed tool requires, from the one `ACCESS_TOKEN_SCOPES` vocabulary. */
-const SEND_SCOPES = ['cloudcli:session:send'];
-const CREATE_SCOPES = ['cloudcli:session:create'];
-const READ_SCOPES = ['cloudcli:read'];
-const APPROVE_SCOPES = ['cloudcli:approve'];
-const NAVIGATE_SCOPES = ['cloudcli:navigate'];
+const SEND_SCOPES = ['cloudpit:session:send'];
+const CREATE_SCOPES = ['cloudpit:session:create'];
+const READ_SCOPES = ['cloudpit:read'];
+const APPROVE_SCOPES = ['cloudpit:approve'];
+const NAVIGATE_SCOPES = ['cloudpit:navigate'];
 
 type Registry = ReturnType<typeof createChatRunRegistry>;
 
@@ -567,7 +567,7 @@ test('(b2) a labelled session_create stamps the run its first message opened', {
 
 test('(c) sessions_list narrows to the sessions whose live run carries the label', { concurrency: false }, async () => {
   await withHarness(async (harness) => {
-    const token = harness.issue(['cloudcli:read', 'cloudcli:session:send']).token;
+    const token = harness.issue(['cloudpit:read', 'cloudpit:session:send']).token;
     await labelSession(harness, token, 'sess-a', LABEL);
     await labelSession(harness, token, 'sess-b', LABEL);
     // A third running session under the OTHER label proves the filter is an
@@ -611,7 +611,7 @@ test('(c) sessions_list narrows to the sessions whose live run carries the label
 
 test('(c2) mcp_usage_stats aggregates exactly the audit rows carrying the label', { concurrency: false }, async () => {
   await withHarness(async (harness) => {
-    const token = harness.issue(['cloudcli:read', 'cloudcli:session:send']).token;
+    const token = harness.issue(['cloudpit:read', 'cloudpit:session:send']).token;
     await labelSession(harness, token, 'sess-a', LABEL);
     await labelSession(harness, token, 'sess-b', LABEL);
     await labelSession(harness, token, 'sess-c', OTHER_LABEL);
@@ -646,7 +646,7 @@ test('(c2) mcp_usage_stats aggregates exactly the audit rows carrying the label'
 
 test('(d) a labelled call opens no extra run, writes only its own row and changes no state', { concurrency: false }, async () => {
   await withHarness(async (harness) => {
-    const token = harness.issue(['cloudcli:read', 'cloudcli:session:send']).token;
+    const token = harness.issue(['cloudpit:read', 'cloudpit:session:send']).token;
 
     const runsBefore = harness.registry.listRecentRuns().length;
     const rowsBefore = mcpAuditLogDb.count();

package/server/modules/mcp-gateway/tests/mcp-draft.test.ts

@@ -109,6 +109,7 @@ type ChatControlService = ReturnType<typeof createChatControlService>;
 const USER_ONE = 1;
 const DEBUG_PROVIDER = DEBUG_AGENT_PROVIDER_ID as LLMProvider;
 const SESSION_SEND_SCOPE = 'cloudcli:session:send';
+const wire = (scopes: string[]) => scopes.map((scope) => scope.replace('cloudcli:', 'cloudpit:'));
 const READ_SCOPE = 'cloudcli:read';
 
 /** The seed turn the scenario opens with. Not what the draft tools submit. */
@@ -298,13 +299,13 @@ async function withHarness(options: HarnessOptions, run: (harness: Harness) => P
   const mainToken = tokens.issueToken({
     userId: USER_ONE,
     name: 'gap-mcp-draft-main',
-    scopes: [READ_SCOPE, SESSION_SEND_SCOPE],
+    scopes: wire([READ_SCOPE, SESSION_SEND_SCOPE]),
     expiresInDays: 30,
   });
   const readToken = tokens.issueToken({
     userId: USER_ONE,
     name: 'gap-mcp-draft-read',
-    scopes: [READ_SCOPE],
+    scopes: wire([READ_SCOPE]),
     expiresInDays: 30,
   });
   if (!mainToken.ok || !readToken.ok) {

package/server/modules/mcp-gateway/tests/mcp-english-only.test.ts

@@ -1167,7 +1167,7 @@ function extractStringLiterals(source: string): SourceLiteral[] {
  * router renders).
  *
  * `mcp-write-notification.ts` is DELIBERATELY excluded: it composes the
- * notification a write call raises for the CloudCLI USER (title / body of an
+ * notification a write call raises for the Cloudpit USER (title / body of an
  * in-app notification), not copy sent to the MCP caller, and it is outside
  * AC-289's field list. Translating it would change user-facing product copy in
  * a task that is about the caller-facing contract. `mcp-client-name.ts` carries

package/server/modules/mcp-gateway/tests/mcp-gateway-wiring.test.ts

@@ -616,8 +616,8 @@ test('(b) the three barrels export the GOAL-020 symbols and the gateway consumes
 
 const USER_ONE = 1;
 const DEBUG_PROVIDER = DEBUG_AGENT_PROVIDER_ID as LLMProvider;
-const WRITE_SCOPE = 'cloudcli:session:send';
-const READ_SCOPE = 'cloudcli:read';
+const WRITE_SCOPE = 'cloudpit:session:send';
+const READ_SCOPE = 'cloudpit:read';
 const RUN_ALIVE_MS = 1_200;
 
 type SpyCaller = { userId: string | number | null; via: string };

package/server/modules/mcp-gateway/tests/mcp-insufficient-scope.test.ts

@@ -406,7 +406,7 @@ async function withGateway(run: (harness: Harness) => Promise<void>): Promise<vo
   const clients = new Set<Client>();
 
   const issue = (scopes: string[]): { id: number; token: string } => {
-    const issued = tokens.issueToken({ userId: USER_ONE, name: 'ac286', scopes, expiresInDays: 30 });
+    const issued = tokens.issueToken({ userId: USER_ONE, name: 'ac286', scopes: scopes.map((scope) => scope.replace('cloudcli:', 'cloudpit:')), expiresInDays: 30 });
     if (!issued.ok) {
       throw new Error('the harness issued a token with a lifetime the service rejects');
     }

package/server/modules/mcp-gateway/tests/mcp-knowledge-facts.test.ts

@@ -302,7 +302,7 @@ async function withKnowledgeFactsHarness(run: HarnessRun, options: HarnessOption
   const readToken = tokens.issueToken({
     userId: USER_ONE,
     name: 'mcp-knowledge-facts',
-    scopes: ['cloudcli:read'],
+    scopes: ['cloudpit:read'],
     expiresInDays: 30,
   });
   if (!readToken.ok) throw new Error('the harness must mint a read token');

package/server/modules/mcp-gateway/tests/mcp-not-found-semantics.test.ts

@@ -525,7 +525,7 @@ async function withHarness(run: (harness: Harness) => Promise<void>): Promise<vo
   const issued = tokens.issueToken({
     userId: USER_ONE,
     name: 'ac287-criterion',
-    scopes: ALL_SCOPES,
+    scopes: ALL_SCOPES.map((scope) => scope.replace('cloudcli:', 'cloudpit:')),
     expiresInDays: 30,
   });
   if (!issued.ok) {

package/server/modules/mcp-gateway/tests/mcp-oauth-challenge.test.ts

@@ -398,7 +398,8 @@ test('(b) a valid PAT and a valid OAuth token are both admitted and the audit ro
   await withOauthChallengeServer(async (h) => {
     h.env.MCP_OAUTH_ENABLED = 'true';
 
-    const pat = h.issuePat([PROBE_SCOPE]);
+    // 3.0 mints the wire spelling; the probe tool's declaration stays canonical.
+    const pat = h.issuePat(['cloudpit:read']);
     const oauthToken = h.issueOAuthToken([PROBE_SCOPE]);
 
     const before = mcpAuditLogDb.count();
@@ -477,7 +478,7 @@ test('(e) an OAuth token missing the tool scope is denied with one denied audit
   await withOauthChallengeServer(async (h) => {
     h.env.MCP_OAUTH_ENABLED = 'true';
 
-    const sendOnly = h.issueOAuthToken(['cloudcli:session:send']);
+    const sendOnly = h.issueOAuthToken(['cloudpit:session:send']);
     const readOk = h.issueOAuthToken([PROBE_SCOPE]);
 
     const before = mcpAuditLogDb.count();

package/server/modules/mcp-gateway/tests/mcp-overview.test.ts

@@ -474,7 +474,7 @@ async function withOverviewHarness(
 
   // ---- the tokens ----
   const tokens = createAccessTokensService({ now: () => new Date(HOST_NOW_MS) });
-  const readToken = tokens.issueToken({ userId: USER_ONE, name: 'mcp-overview', scopes: ['cloudcli:read'], expiresInDays: 30 });
+  const readToken = tokens.issueToken({ userId: USER_ONE, name: 'mcp-overview', scopes: ['cloudpit:read'], expiresInDays: 30 });
   if (!readToken.ok) {
     throw new Error('the harness must mint a read token');
   }
@@ -752,7 +752,7 @@ test('(f) quay_snapshot carries the in-flight reading and overview deliberately
     assert.equal(refreshed.isError, false, 'the refreshing read must not error');
     const snapshot = (refreshed.payload as AnyRecord).snapshot as AnyRecord;
     console.log(`[f] quay_snapshot.inFlight = ${JSON.stringify(snapshot.inFlight)}`);
-    // The in-flight task reaches the CloudCLI client verbatim, through the real mount.
+    // The in-flight task reaches the Cloudpit client verbatim, through the real mount.
     assert.deepEqual(snapshot.inFlight, IN_FLIGHT_READING, 'the in-flight reading must round-trip verbatim');
 
     // Scope guard: `overview`'s per-project summary is AC-247's and this task must not

package/server/modules/mcp-gateway/tests/mcp-pending-interaction.test.ts

@@ -111,8 +111,8 @@ type AnyRecord = Record<string, unknown>;
 // --------------------------- fixture identities ---------------------------
 
 const USER_ONE = 1;
-const READ_SCOPE = 'cloudcli:read';
-const APPROVE_SCOPE = 'cloudcli:approve';
+const READ_SCOPE = 'cloudpit:read';
+const APPROVE_SCOPE = 'cloudpit:approve';
 /** The deadline leg (b) asserts was INJECTED, not the 55000 default. */
 const INJECTED_TIMEOUT_MS = 4321;
 /** The instant every relative reading is measured against. */

package/server/modules/mcp-gateway/tests/mcp-read-tools.test.ts

@@ -450,9 +450,9 @@ async function withMcpReadTools(
 
   // ---- the tokens ----
   const tokens = createAccessTokensService({ now: () => new Date(NOW_MS) });
-  const readToken = tokens.issueToken({ userId: USER_ONE, name: 'mcp-read', scopes: ['cloudcli:read'], expiresInDays: 30 });
+  const readToken = tokens.issueToken({ userId: USER_ONE, name: 'mcp-read', scopes: ['cloudpit:read'], expiresInDays: 30 });
   const scopedToken = tokens.issueToken({
-    userId: USER_ONE, name: 'mcp-other', scopes: ['cloudcli:session:send'], expiresInDays: 30,
+    userId: USER_ONE, name: 'mcp-other', scopes: ['cloudpit:session:send'], expiresInDays: 30,
   });
   if (!readToken.ok || !scopedToken.ok) {
     throw new Error('the harness must mint both tokens');
@@ -580,7 +580,7 @@ test('(a) tools/list is exactly the stage-3 read tools, none of them a write too
     }
 
     for (const tool of MCP_STAGE3_READ_TOOLS) {
-      assert.equal(tool.requiredScope, 'cloudcli:read', `${tool.name} must require cloudcli:read`);
+      assert.equal(tool.requiredScope, 'cloudcli:read', `${tool.name} must require the canonical read scope`);
     }
     for (const tool of listed.tools) {
       assert.ok(tool.description && tool.description.length > 0, `${tool.name} must carry a description`);

package/server/modules/mcp-gateway/tests/mcp-run-get.test.ts

@@ -321,7 +321,7 @@ async function withRunGetHarness(run: (harness: Harness) => Promise<void>): Prom
   }
 
   const tokens = createAccessTokensService({ now: () => new Date(BASE_MS) });
-  const readToken = tokens.issueToken({ userId: USER_ONE, name: 'mcp-run-get', scopes: ['cloudcli:read'], expiresInDays: 30 });
+  const readToken = tokens.issueToken({ userId: USER_ONE, name: 'mcp-run-get', scopes: ['cloudpit:read'], expiresInDays: 30 });
   if (!readToken.ok) {
     throw new Error('the harness must mint a read token');
   }

package/server/modules/mcp-gateway/tests/mcp-self-target.test.ts

@@ -341,7 +341,7 @@ async function withHarness(run: (harness: Harness) => Promise<void>): Promise<vo
   const issued = tokens.issueToken({
     userId: USER_ONE,
     name: 'ac252-criterion',
-    scopes: [READ_SCOPE, SEND_SCOPE, CONTROL_SCOPE],
+    scopes: [READ_SCOPE, SEND_SCOPE, CONTROL_SCOPE].map((scope) => scope.replace('cloudcli:', 'cloudpit:')),
     expiresInDays: 30,
   });
   if (!issued.ok) {

package/server/modules/mcp-gateway/tests/mcp-session-background.test.ts

@@ -353,13 +353,13 @@ async function withHarness(options: HarnessOptions, run: (harness: Harness) => P
   const readToken = tokens.issueToken({
     userId: USER_ONE,
     name: 'ac273-read',
-    scopes: [READ_SCOPE],
+    scopes: [READ_SCOPE].map((scope) => scope.replace('cloudcli:', 'cloudpit:')),
     expiresInDays: 30,
   });
   const controlToken = tokens.issueToken({
     userId: USER_ONE,
     name: 'ac273-control',
-    scopes: [READ_SCOPE, SESSION_CONTROL_SCOPE],
+    scopes: [READ_SCOPE, SESSION_CONTROL_SCOPE].map((scope) => scope.replace('cloudcli:', 'cloudpit:')),
     expiresInDays: 30,
   });
   if (!readToken.ok || !controlToken.ok) {

package/server/modules/mcp-gateway/tests/mcp-session-host-control.test.ts

@@ -376,7 +376,7 @@ async function withHarness(run: (harness: Harness) => Promise<void>): Promise<vo
 
   const tokens = createAccessTokensService({ now: () => new Date() });
   const mint = (name: string, scopes: string[]): string => {
-    const issued = tokens.issueToken({ userId: USER_ONE, name, scopes, expiresInDays: 30 });
+    const issued = tokens.issueToken({ userId: USER_ONE, name, scopes: scopes.map((scope) => scope.replace('cloudcli:', 'cloudpit:')), expiresInDays: 30 });
     if (!issued.ok) {
       throw new Error(`the harness must mint the ${name} token`);
     }

package/server/modules/mcp-gateway/tests/mcp-session-lifecycle.test.ts

@@ -629,7 +629,7 @@ async function withHarness(options: HarnessOptions, run: (harness: Harness) => P
 
   const tokens = createAccessTokensService({ now: () => new Date() });
   const mint = (name: string, scopes: string[]): string => {
-    const issued = tokens.issueToken({ userId: USER_ONE, name, scopes, expiresInDays: 30 });
+    const issued = tokens.issueToken({ userId: USER_ONE, name, scopes: scopes.map((scope) => scope.replace('cloudcli:', 'cloudpit:')), expiresInDays: 30 });
     if (!issued.ok) {
       throw new Error(`the harness must mint the ${name} token`);
     }

package/server/modules/mcp-gateway/tests/mcp-session-reconfigure.test.ts

@@ -434,13 +434,13 @@ async function withHarness(options: HarnessOptions, run: (harness: Harness) => P
   const mainToken = tokens.issueToken({
     userId: USER_ONE,
     name: 'ac272-main',
-    scopes: [READ_SCOPE, SESSION_SEND_SCOPE, SESSION_CONTROL_SCOPE],
+    scopes: [READ_SCOPE, SESSION_SEND_SCOPE, SESSION_CONTROL_SCOPE].map((scope) => scope.replace('cloudcli:', 'cloudpit:')),
     expiresInDays: 30,
   });
   const sendOnlyToken = tokens.issueToken({
     userId: USER_ONE,
     name: 'ac272-send-only',
-    scopes: [READ_SCOPE, SESSION_SEND_SCOPE],
+    scopes: [READ_SCOPE, SESSION_SEND_SCOPE].map((scope) => scope.replace('cloudcli:', 'cloudpit:')),
     expiresInDays: 30,
   });
   if (!mainToken.ok || !sendOnlyToken.ok) {

package/server/modules/mcp-gateway/tests/mcp-session-search-pruning.test.ts

@@ -278,7 +278,7 @@ async function withPruningSearch(run: (harness: Harness, fixture: Fixture) => Pr
   assert.ok(projectId, 'the fixture project must be registered');
 
   const tokens = createAccessTokensService({ now: () => new Date(NOW_MS) });
-  const readToken = tokens.issueToken({ userId: USER_ONE, name: 'mcp-search-pruning', scopes: ['cloudcli:read'], expiresInDays: 30 });
+  const readToken = tokens.issueToken({ userId: USER_ONE, name: 'mcp-search-pruning', scopes: ['cloudpit:read'], expiresInDays: 30 });
   if (!readToken.ok) {
     throw new Error('the harness must mint a cloudcli:read token');
   }

package/server/modules/mcp-gateway/tests/mcp-session-search.test.ts

@@ -363,7 +363,7 @@ async function withSessionSearch(
 
   // ---- the tokens ----
   const tokens = createAccessTokensService({ now: () => new Date(NOW_MS) });
-  const readToken = tokens.issueToken({ userId: USER_ONE, name: 'mcp-search', scopes: ['cloudcli:read'], expiresInDays: 30 });
+  const readToken = tokens.issueToken({ userId: USER_ONE, name: 'mcp-search', scopes: ['cloudpit:read'], expiresInDays: 30 });
   if (!readToken.ok) {
     throw new Error('the harness must mint a cloudcli:read token');
   }

package/server/modules/mcp-gateway/tests/mcp-session-send.test.ts

@@ -427,13 +427,13 @@ async function withHarness(options: HarnessOptions, run: (harness: Harness) => P
   const mainToken = tokens.issueToken({
     userId: USER_ONE,
     name: 'ac249-main',
-    scopes: [READ_SCOPE, SESSION_SEND_SCOPE, APPROVE_SCOPE],
+    scopes: [READ_SCOPE, SESSION_SEND_SCOPE, APPROVE_SCOPE].map((scope) => scope.replace('cloudcli:', 'cloudpit:')),
     expiresInDays: 30,
   });
   const readToken = tokens.issueToken({
     userId: USER_ONE,
     name: 'ac249-read',
-    scopes: [READ_SCOPE],
+    scopes: [READ_SCOPE].map((scope) => scope.replace('cloudcli:', 'cloudpit:')),
     expiresInDays: 30,
   });
   if (!mainToken.ok || !readToken.ok) {