@yalehwang/cloudpit 2.0.0 → 3.0.0

package/server/modules/providers/tests/provider-models.service.test.ts

@@ -40,6 +40,8 @@ const createSessionStore = (
       model,
       effort: efforts[sessionId] ?? null,
       permission_mode: permissionModes[sessionId] ?? null,
+      // The upstream provider a session is bound to; NULL until recorded.
+      model_provider_id: null as string | null,
     },
   ]));
   return {
@@ -52,6 +54,15 @@ const createSessionStore = (
         session.model = model;
       }
     },
+    // Write-once, like the column: a second call cannot move the binding.
+    setSessionModelProviderId: (sessionId: string, modelProviderId: string) => {
+      const session = sessions.get(sessionId);
+      if (!session || session.model_provider_id) {
+        return false;
+      }
+      session.model_provider_id = modelProviderId;
+      return true;
+    },
     setSessionEffort: (sessionId: string, effort: string) => {
       const session = sessions.get(sessionId);
       if (session) {
@@ -396,6 +407,10 @@ test('setSessionModel records the model on the session row', () => {
     model: 'opus',
     effort: null,
     permissionMode: null,
+    // The fixture installs no provider registry and binds no model entry, so
+    // no upstream provider is recorded and there is nothing to mark.
+    modelProviderId: null,
+    modelProviderProblem: null,
     source: 'session',
   });
   assert.equal(sessions.sessions.get('session-1')?.model, 'opus');

package/server/modules/providers/tests/provider.routes.test.ts

@@ -55,7 +55,7 @@ async function withProviderServer(
   }
 }
 
-test('session creation route names a CloudCLI session from the initial message', async () => {
+test('session creation route names a Cloudpit session from the initial message', async () => {
   await withProviderServer(async (baseUrl, workspacePath) => {
     const response = await fetch(`${baseUrl}/api/providers/sessions`, {
       method: 'POST',

package/server/modules/quay/index.ts

@@ -7,7 +7,7 @@
 // load-on-demand path the `quay_snapshot` tool's explicit refresh uses.
 // quayFleetRegistry: the fleet's per-project 「对人接口会话」 pin, read/written by the cockpit
 // hub's target resolver (injected at the composition root, so the cockpit module itself stays
-// a leaf). It maps a CloudCLI project id to the fleet registry id and answers failures as
+// a leaf). It maps a Cloudpit project id to the fleet registry id and answers failures as
 // values rather than throwing.
 // quayCapabilities / quayDispatchCarrier / quayTaskEvents: the event-driven refresh's three
 // composed pieces. `quayCapabilities` answers whether a project's pinned quay has `task log`;

package/server/modules/quay/quay-dispatch-carrier.ts

@@ -48,7 +48,7 @@ export type QuayDispatchSet =
 
 /** The injectable boundaries of the dispatch carrier reader. */
 export type QuayDispatchCarrierDependencies = {
-  /** CloudCLI project id → the project root the carrier path is joined under. */
+  /** Cloudpit project id → the project root the carrier path is joined under. */
   resolveProjectPathById(projectId: string): string | null;
   /** The service's read-only filesystem boundary (stat size + whole-file UTF-8 read). */
   readFile: QuayFileReader;

package/server/modules/quay/quay-fleet-cli.ts

@@ -118,7 +118,7 @@ export function parseFleetJsonObject(text: string): Record<string, unknown> | nu
 /**
  * A path canonicalized for root comparison: symlinks resolved, trailing separators dropped.
  * Consumers: the project-id join and the registry, both matching a registered root against a
- * CloudCLI project path. An unresolvable path falls back to a lexical absolute form so a
+ * Cloudpit project path. An unresolvable path falls back to a lexical absolute form so a
  * project that has been moved still compares as itself.
  */
 export function canonicalFleetPath(filePath: string): string {

package/server/modules/quay/quay-fleet-locator.ts

@@ -40,10 +40,10 @@ import {
  * because every consumer is a server surface that must keep answering when the fleet is absent.
  */
 
-/** The environment variable an operator uses to point CloudCLI at one exact binary. */
+/** The environment variable an operator uses to point Cloudpit at one exact binary. */
 export const QUAY_FLEET_BIN_ENV = 'QUAY_FLEET_BIN';
 
-/** The contract versions THIS build of CloudCLI speaks. */
+/** The contract versions THIS build of Cloudpit speaks. */
 export const QUAY_FLEET_SUPPORTED_CONTRACTS = {
   wallUri: 'v0',
   registry: 1,

package/server/modules/quay/quay-fleet-project-id.ts

@@ -14,19 +14,19 @@ import {
 } from './quay-fleet-locator.js';
 
 /**
- * The CloudCLI project id → quay-fleet registry id mapping.
+ * The Cloudpit project id → quay-fleet registry id mapping.
  *
  * WHY THIS EXISTS. A `quay://` reference's project segment is spoken out loud and dereferenced
  * by quay-fleet, so it must be the fleet's own stable identity (`projects[].id` in
- * `~/.quay-fleet/registry.json`, e.g. `claudecodeui`), never CloudCLI's internal project UUID.
- * The fleet registers projects by their ROOT path; CloudCLI addresses them by a database id.
- * This module is the single place that joins the two: the CloudCLI project's path (canonicalized,
+ * `~/.quay-fleet/registry.json`, e.g. `claudecodeui`), never Cloudpit's internal project UUID.
+ * The fleet registers projects by their ROOT path; Cloudpit addresses them by a database id.
+ * This module is the single place that joins the two: the Cloudpit project's path (canonicalized,
  * so a trailing separator or a symlinked checkout still matches) is looked up in the registry's
  * project rows, and the registry id found there is the only project segment the wall may mint.
  *
  * The same join answers the other direction: given a registry id from an incoming reference,
- * it names the registered root (quay-fleet's `--root`) and, when CloudCLI knows that root, the
- * CloudCLI project whose snapshot can answer the read.
+ * it names the registered root (quay-fleet's `--root`) and, when Cloudpit knows that root, the
+ * Cloudpit project whose snapshot can answer the read.
  *
  * A FLEET THAT CANNOT ANSWER IS AN ANSWER. No binary, a non-zero exit, malformed output — every
  * failure reads `null`, never throws. `null` is the honest "this project is not registered"
@@ -60,9 +60,9 @@ export type QuayFleetRegisteredProject = {
 };
 
 /**
- * One registry id joined to the CloudCLI project it names.
+ * One registry id joined to the Cloudpit project it names.
  *
- * `projectId` is `null` when CloudCLI does not know the registered root (an archived project,
+ * `projectId` is `null` when Cloudpit does not know the registered root (an archived project,
  * or a fleet host whose registry lists a checkout this instance never added). The root is
  * still authoritative for the fleet read port; only the snapshot fallback needs `projectId`.
  */
@@ -90,9 +90,9 @@ export type QuayFleetAvailability = QuayFleetCliReading;
  * Both methods return `null` for "no such project" and never throw.
  */
 export type QuayFleetProjectIdResolver = {
-  /** CloudCLI project id → fleet registry id, or `null` when its root is not registered. */
+  /** Cloudpit project id → fleet registry id, or `null` when its root is not registered. */
   resolveFleetProjectId(projectId: string): Promise<string | null>;
-  /** Fleet registry id → registered root + the CloudCLI project at that root. */
+  /** Fleet registry id → registered root + the Cloudpit project at that root. */
   resolveFleetProject(projectSegment: string): Promise<QuayFleetProjectMatch | null>;
   /**
    * Whether the fleet CLI answered at all, and why not when it did not.
@@ -106,11 +106,11 @@ export type QuayFleetProjectIdResolver = {
 
 /** The seams the mapper reads through; every one of them is replaceable in a test. */
 export type QuayFleetProjectIdDependencies = {
-  /** CloudCLI project id → absolute project path; `null`/absent for an unknown project. */
+  /** Cloudpit project id → absolute project path; `null`/absent for an unknown project. */
   resolveProjectPathById: (projectId: string) => string | null | undefined;
   /**
-   * Every project this CloudCLI instance knows, used only for the reverse join
-   * (registry id → CloudCLI project). Absent leaves `projectId: null` on every match, which
+   * Every project this Cloudpit instance knows, used only for the reverse join
+   * (registry id → Cloudpit project). Absent leaves `projectId: null` on every match, which
    * still resolves references through the fleet read port but has no snapshot fallback.
    */
   listProjects?: () => readonly { projectId: string; projectPath: string }[];
@@ -152,7 +152,7 @@ function readProjectRow(value: unknown): { id: string; root: string } | null {
  * Builds the mapping service.
  *
  * The binary is resolved per call rather than captured at boot so an operator can install the
- * fleet CLI (or point `QUAY_FLEET_BIN` at a checkout) without restarting CloudCLI; a missing
+ * fleet CLI (or point `QUAY_FLEET_BIN` at a checkout) without restarting Cloudpit; a missing
  * binary is the ordinary "nothing is registered here" answer, not a boot failure.
  */
 export function createQuayFleetProjectIdResolver(

package/server/modules/quay/quay-fleet-registry.ts

@@ -10,12 +10,12 @@ import { locateQuayFleetCli } from './quay-fleet-locator.js';
 /**
  * The fleet registry's per-project 「对人接口会话」, as the cockpit reads and writes it.
  *
- * THE FLEET IS THE AUTHORITY, and this module is the CloudCLI side of that contract. The registry
+ * THE FLEET IS THE AUTHORITY, and this module is the Cloudpit side of that contract. The registry
  * keeps the field as `projects[].interfaceSessionId` and exposes it through
  * `quay-fleet registry interface-session get|set|clear <project> --json`; the browser cannot spawn
  * that CLI, so the server is where the two calls live. Nothing here invents a project identity:
- * the CloudCLI project id is mapped to the fleet's own registry id by comparing the registered
- * ROOT with the project's path, because a CloudCLI UUID is not a fleet handle.
+ * the Cloudpit project id is mapped to the fleet's own registry id by comparing the registered
+ * ROOT with the project's path, because a Cloudpit UUID is not a fleet handle.
  *
  * A FLEET THAT CANNOT ANSWER IS AN ANSWER. Every failure — no binary, a non-zero exit, malformed
  * output — is reported as `{ok:false, reason}`, never thrown: the cockpit falls back to the
@@ -33,7 +33,7 @@ export type QuayFleetInterfaceSessionWrite =
   | { ok: true; project: string; interfaceSessionId: string | null }
   | { ok: false; reason: string; detail?: string };
 
-/** The two operations the cockpit needs, both addressed by the CloudCLI project id. */
+/** The two operations the cockpit needs, both addressed by the Cloudpit project id. */
 export type QuayFleetRegistryService = {
   /** Reads the project's pinned target conversation; `interfaceSessionId: null` means none. */
   readInterfaceSession(projectId: string): Promise<QuayFleetInterfaceSessionReading>;
@@ -45,7 +45,7 @@ export type QuayFleetRegistryService = {
 };
 
 export type QuayFleetRegistryDependencies = {
-  /** CloudCLI project id → absolute project path; `null` for an unknown project. */
+  /** Cloudpit project id → absolute project path; `null` for an unknown project. */
   resolveProjectPathById: (projectId: string) => string | null | undefined;
   /** The fleet CLI to spawn. Defaults to the shared locator, which owns the lookup order. */
   binPath?: string;
@@ -69,7 +69,7 @@ function isProjectRow(value: unknown): value is { id: string; root: string } {
  * Builds the fleet-registry service.
  *
  * The binary is resolved per call rather than captured at boot so an operator can install the
- * fleet CLI (or point `QUAY_FLEET_BIN` at a checkout) without restarting CloudCLI; a missing
+ * fleet CLI (or point `QUAY_FLEET_BIN` at a checkout) without restarting Cloudpit; a missing
  * binary is the ordinary `fleet-cli-unavailable` answer, not a boot failure.
  */
 export function createQuayFleetRegistry(
@@ -91,10 +91,10 @@ export function createQuayFleetRegistry(
   const run = createQuayFleetRunner({ resolveBinPath, exec: dependencies.exec });
 
   /**
-   * Resolves the CloudCLI project to the fleet's own registry id.
+   * Resolves the Cloudpit project to the fleet's own registry id.
    *
    * The path comes from the database, never from the request, and the fleet id is matched by root
-   * so a project CloudCLI knows but the fleet does not register is `unknown-project` rather than
+   * so a project Cloudpit knows but the fleet does not register is `unknown-project` rather than
    * being guessed from the display name.
    */
   const resolveFleetProject = async (

package/server/modules/quay/quay-suite-fanin-reader.ts

@@ -11,7 +11,7 @@ import { readNullableNumber, readNullableString } from '@/shared/utils.js';
 /**
  * The Tests and Fan-in readings, taken through quay's own read-only verbs.
  *
- * CloudCLI used to parse three `.quay/` carrier files itself (`full-suite-state.json`,
+ * Cloudpit used to parse three `.quay/` carrier files itself (`full-suite-state.json`,
  * `verification-round.jsonl`, `worker-outcome.jsonl`) — including a ~100 MB tail scan of the
  * rounds ledger. quay 0.24.0 publishes both readings as bounded JSON instead:
  *

package/server/modules/quay/quay-uri-resolve.ts

@@ -20,7 +20,7 @@ import { locateQuayFleetCli } from './quay-fleet-locator.js';
  *    `wall summary` to it VERBATIM — the same project-scoped address
  *    (`quay://<project>/…`) the wall mints, because that is the only form the fleet parses.
  *    When that read port is unavailable, a TASK reference
- *    falls back to the snapshot CloudCLI already reads for the Quay panel, which is honest
+ *    falls back to the snapshot Cloudpit already reads for the Quay panel, which is honest
  *    stored data — never a summary generated on the spot. `wall resolve` never consults the
  *    registry, so the fleet's `project-not-registered` refusal can only arrive from
  *    `wall summary`; it is read as its own fallback reason rather than as a broken reader.
@@ -78,7 +78,7 @@ function reject(reason: QuayUriRejection): QuayUriParseResult {
  * Parses one `quay://` reference into its L1 shape, or names why it is not one.
  *
  * The project segment is a quay-fleet REGISTRY ID (`claudecodeui`, `quay-fleet`), never
- * CloudCLI's internal project UUID — see `quay-fleet-project-id.ts` for the join.
+ * Cloudpit's internal project UUID — see `quay-fleet-project-id.ts` for the join.
  *
  * Accepted forms (project segment mandatory):
  *   quay://<fleet-project-id>/task/<id>
@@ -512,7 +512,7 @@ export type QuayUriSummaryResult = QuayUriSummarySuccess | QuayUriFailure;
  * `root` is the registered workspace root the segment joins to. It is passed to `wall
  * summary` as its OPTIONAL `--root` consistency override; a blank root means the segment
  * alone selects the workspace. `projectId`
- * is the CloudCLI project at that root, when this instance knows one; the snapshot fallback
+ * is the Cloudpit project at that root, when this instance knows one; the snapshot fallback
  * reads that project, and `null` means there is no snapshot to fall back to.
  */
 export type QuayUriFleetProject = {
@@ -526,7 +526,7 @@ export type QuayUriResolveDependencies = {
   fleetWallReader: QuayFleetWallReader | null;
   /**
    * Resolves a reference's project segment — a quay-fleet REGISTRY ID (`claudecodeui`), never
-   * a CloudCLI project id — to the registered root and the CloudCLI project at it. `null` when
+   * a Cloudpit project id — to the registered root and the Cloudpit project at it. `null` when
    * the registry does not know the segment.
    */
   resolveFleetProject(projectSegment: string): Promise<QuayUriFleetProject | null>;
@@ -591,7 +591,7 @@ export function createQuayUriResolver(dependencies: QuayUriResolveDependencies):
    * The optional `--root` consistency override for a summary read.
    *
    * The URI's PROJECT SEGMENT is authoritative: the fleet resolves it to a workspace root
-   * through its own registry. CloudCLI knows a root only through that same registry join
+   * through its own registry. Cloudpit knows a root only through that same registry join
    * ({@link QuayUriResolveDependencies.resolveFleetProject}), so the root passed here is by
    * construction the segment's own root — a consistency override, never a competing one. A
    * join without a root therefore sends no override (the segment alone selects the
@@ -625,7 +625,7 @@ export function createQuayUriResolver(dependencies: QuayUriResolveDependencies):
    * port answered (a summary miss keeps its type/actions/fragment); it is absent when the
    * port could not be read, in which case no action set is forwarded.
    *
-   * A registered fleet project CloudCLI has no project for still has an L1 reading; only the
+   * A registered fleet project Cloudpit has no project for still has an L1 reading; only the
    * fallback's CONTENT is missing, which is reported as `snapshot-unavailable`.
    */
   const resolveFromSnapshot = async (
@@ -639,7 +639,7 @@ export function createQuayUriResolver(dependencies: QuayUriResolveDependencies):
       return reference === undefined
         ? failure(
             'snapshot-unavailable',
-            `fleet project '${address.project}' is registered but no CloudCLI project is open at '${project.root}'`,
+            `fleet project '${address.project}' is registered but no Cloudpit project is open at '${project.root}'`,
           )
         : fleetAnswer(address, uri, reference);
     }
@@ -677,7 +677,7 @@ export function createQuayUriResolver(dependencies: QuayUriResolveDependencies):
     const { address } = parsed;
     const canonical = formatQuayAddress(address);
 
-    // The project segment is a fleet REGISTRY ID. An unresolvable segment (a CloudCLI UUID is
+    // The project segment is a fleet REGISTRY ID. An unresolvable segment (a Cloudpit UUID is
     // the usual shape) is named as such before any read is attempted.
     const project = await dependencies.resolveFleetProject(address.project);
     if (project === null) {

package/server/modules/quay/quay.module.ts

@@ -94,9 +94,9 @@ const probeWebService = async (host: string, port: number): Promise<boolean> =>
 };
 
 /**
- * The CloudCLI project id → quay-fleet registry id join behind every `quay://` project segment.
+ * The Cloudpit project id → quay-fleet registry id join behind every `quay://` project segment.
  * The fleet is the authority for project identity: a reference must say `quay://claudecodeui/…`,
- * never the CloudCLI UUID, so the registry id is looked up per registered root and cached for a
+ * never the Cloudpit UUID, so the registry id is looked up per registered root and cached for a
  * short TTL. A host without the fleet CLI reads every project as unregistered instead of failing.
  */
 export const quayFleetProjectIds = createQuayFleetProjectIdResolver({
@@ -294,7 +294,7 @@ taskIndexReadListener.current = quayTaskEvents.noteProjectRead;
 
 /**
  * The fleet registry seam the cockpit's pinned-target read/write goes through. It maps a
- * CloudCLI project id to the fleet's own registry id by comparing registered roots, and every
+ * Cloudpit project id to the fleet's own registry id by comparing registered roots, and every
  * failure is an answer (`{ok:false, reason}`) rather than a thrown error — a host without the
  * fleet CLI still renders and routes, falling back to the last-opened session.
  */

package/server/modules/quay/quay.routes.ts

@@ -2,7 +2,7 @@
  * QUAY DISPLAY ROUTES
  * ===================
  *
- * Endpoints that expose a project's quay state to the CloudCLI UI:
+ * Endpoints that expose a project's quay state to the Cloudpit UI:
  * - `GET  /api/quay/fleet-summary`                        — the eager cross-project reading.
  * - `GET  /api/quay/resolve`                              — dereference one `quay://` reference.
  * - `GET  /api/quay/summary`                              — a reference's summary reading.

package/server/modules/quay/quay.service.ts

@@ -343,7 +343,7 @@ export type QuayFleetProjectSummary = {
   /**
    * The project's quay-fleet REGISTRY id — the only project segment a `quay://` reference may
    * mint. `null` means the root is not registered in the fleet, so this project declares no
-   * addressable objects (falling back to the CloudCLI UUID would mint a reference the fleet
+   * addressable objects (falling back to the Cloudpit UUID would mint a reference the fleet
    * cannot dereference).
    */
   fleetProjectId: string | null;
@@ -611,7 +611,7 @@ export const QUAY_READ_ONLY_COMMANDS: readonly (readonly string[])[] = [
   ['goal', 'list', '--json'],
   ['adr', 'list', '--json'],
   // The Tests and Fan-in cards' readings. quay 0.24.0 publishes both as bounded JSON from its
-  // own readers, so CloudCLI no longer parses `.quay/` carrier files itself. Exact-match entries
+  // own readers, so Cloudpit no longer parses `.quay/` carrier files itself. Exact-match entries
   // (no prefix rule): the window is part of the reading, and any other flag combination is
   // refused before a child is spawned.
   QUAY_SUITE_READ_COMMAND,
@@ -1109,7 +1109,7 @@ type QuayServiceDependencies = {
    */
   fleetWallReader?: QuayFleetWallReader | null;
   /**
-   * The CloudCLI project id → quay-fleet registry id join (`quay-fleet-project-id.ts`), behind
+   * The Cloudpit project id → quay-fleet registry id join (`quay-fleet-project-id.ts`), behind
    * the wall's project segment and the per-project `fleetProjectId` reading. OPTIONAL so a
    * composition that does not run a fleet still works: absent means every project is
    * unregistered (`fleetProjectId: null`), which the UI renders as 「未登记到 quay-fleet」
@@ -1936,7 +1936,7 @@ export function createQuayService(dependencies: QuayServiceDependencies) {
   };
 
   /**
-   * The CloudCLI project id → fleet registry id join. A composition without a fleet answers
+   * The Cloudpit project id → fleet registry id join. A composition without a fleet answers
    * `null` for every project — the honest "nothing is registered here" reading that makes the
    * UI render 「未登记到 quay-fleet」 instead of minting a UUID reference the fleet cannot read.
    */
@@ -2655,7 +2655,7 @@ export function createQuayService(dependencies: QuayServiceDependencies) {
    * The Tier-2 snapshot as `GET /api/quay/:projectId/snapshot` answers it: the stored reading
    * plus the project's `fleetProjectId`. The join is stamped here, on every branch, because it
    * is what the wall mints its project segment from — a cached snapshot body carrying a stale
-   * (or absent) join would let the renderer fall back to the CloudCLI id.
+   * (or absent) join would let the renderer fall back to the Cloudpit id.
    */
   const getQuaySnapshot = async (
     projectId: string,
@@ -2933,7 +2933,7 @@ export function createQuayService(dependencies: QuayServiceDependencies) {
   const quayUriResolver = createQuayUriResolver({
     fleetWallReader,
     // The project segment is a quay-fleet REGISTRY ID. The join names the registered root the
-    // fleet read port is called with, and the CloudCLI project (if any) whose snapshot can
+    // fleet read port is called with, and the Cloudpit project (if any) whose snapshot can
     // supplement a task reference.
     resolveFleetProject: (projectSegment) => fleetProjectIds.resolveFleetProject(projectSegment),
     // Cached first, so dereferencing a URI the panel just rendered spawns nothing. A cold

package/server/modules/quay/session-task-chain.service.ts

@@ -107,7 +107,7 @@ export type SessionTaskStoreRecord = {
  * production classification with stubs and no filesystem, git or deployment state.
  */
 export type SessionTaskChainDependencies = {
-  /** The CloudCLI project path for a project id, or `null` when the project is unknown. */
+  /** The Cloudpit project path for a project id, or `null` when the project is unknown. */
   resolveProjectPath(projectId: string): string | null;
   /** The session's transcript (JSONL) path, or `null` when it has none yet. */
   resolveTranscriptPath(input: { projectId: string; sessionId: string }): string | null;

package/server/modules/quay/tests/contracts/fleet-cli-contracts.test.ts

@@ -1,7 +1,7 @@
 /**
- * Cross-repository contract tests: CloudCLI against the INSTALLED quay-fleet.
+ * Cross-repository contract tests: Cloudpit against the INSTALLED quay-fleet.
  *
- * WHAT THIS FILE PROVES. Every `quay-fleet` invocation CloudCLI consumes is run against the real
+ * WHAT THIS FILE PROVES. Every `quay-fleet` invocation Cloudpit consumes is run against the real
  * binary on this host, and its JSON answer is checked against the declaration in `shapes.ts`.
  * The handshake goes first: if the fleet declares a contract this build does not speak, the run
  * reds and names the contract instead of exercising verbs whose output may have moved under us.
@@ -475,7 +475,7 @@ if (binPath === null) {
       );
       assertShape(contract.id, document, contract.shape);
 
-      // `wall resolve` was asked for the `#ac-<n>` form; validate the branch CloudCLI renders,
+      // `wall resolve` was asked for the `#ac-<n>` form; validate the branch Cloudpit renders,
       // not merely its presence (the shape declaration already pins kind/index).
       if (contract.id === 'wall-resolve') {
         const fragment = document?.fragment as { kind?: unknown; index?: unknown } | undefined;

package/server/modules/quay/tests/contracts/shapes.ts

@@ -1,7 +1,7 @@
 /**
- * The JSON shape declarations for every `quay-fleet` CLI contract CloudCLI consumes.
+ * The JSON shape declarations for every `quay-fleet` CLI contract Cloudpit consumes.
  *
- * WHY THIS FILE EXISTS. CloudCLI talks to a separately versioned program — the installed
+ * WHY THIS FILE EXISTS. Cloudpit talks to a separately versioned program — the installed
  * `quay-fleet` — through plain JSON on stdout. Until this file, every consumer parsed that JSON
  * with its own hand-written reader and no test ever compared the READER against the REAL CLI:
  * the two sides were validated independently, so a rename in the fleet's output was discovered
@@ -9,19 +9,19 @@
  * project-segment disagreement (`quay://task/<id>` vs `quay://<project>/task/<id>`): each side's
  * own tests were green, and the breakage only appeared when the two real programs met.
  *
- * A contract here is therefore (a) the exact argv CloudCLI runs and (b) a declared shape for the
+ * A contract here is therefore (a) the exact argv Cloudpit runs and (b) a declared shape for the
  * JSON it must answer with. `fleet-cli-contracts.test.ts` invokes the INSTALLED fleet and checks
  * every answer against these declarations, so an incompatible change on either side reds before
  * merge instead of in production.
  *
  * THE LYING RISK THIS FILE MUST NOT HAVE. A shape that accepts everything protects nothing. The
- * declarations below therefore name the fields CloudCLI actually reads as REQUIRED, pin the
+ * declarations below therefore name the fields Cloudpit actually reads as REQUIRED, pin the
  * closed-vocabulary ones to their legal values (the trivalent readings the fleet uses throughout:
  * `ok` / `absent` / `invalid`, and `string | null`), and let UNDECLARED fields through on purpose
  * — a fleet that ADDS a field stays compatible, which is exactly the forward-compatibility rule
  * the contract must encode.
  *
- * ADDING A CONSUMER. Whenever CloudCLI starts invoking a new `quay-fleet` verb (or starts reading
+ * ADDING A CONSUMER. Whenever Cloudpit starts invoking a new `quay-fleet` verb (or starts reading
  * a new field from an existing one), add the invocation and its shape here AND a case to
  * `fleet-cli-contracts.test.ts`. The rule and its rationale are repeated in `README.md`, which is
  * where a human adding a consumer is expected to look first.
@@ -250,7 +250,7 @@ export type FleetCliContractContext = {
 export type FleetCliContract = {
   /** Stable id printed in every failure and per-contract report line. */
   id: string;
-  /** The CloudCLI reader that consumes this invocation. */
+  /** The Cloudpit reader that consumes this invocation. */
   consumer: string;
   /** True when the verb mutates the fleet home (must run against a temporary home). */
   writes: boolean;
@@ -293,7 +293,7 @@ export const HANDSHAKE_SHAPE: Shape = {
  * `quay-fleet wall resolve <uri> --json` — the L1 reference.
  *
  * The test always asks for the fragment form (`#ac-<n>`), so `fragment` is REQUIRED here rather
- * than optional: dropping it would silently stop exercising the branch CloudCLI renders.
+ * than optional: dropping it would silently stop exercising the branch Cloudpit renders.
  */
 export const WALL_RESOLVE_SHAPE: Shape = {
   type: 'object',
@@ -318,7 +318,7 @@ export const WALL_RESOLVE_SHAPE: Shape = {
  * `quay-fleet wall summary <uri> --root <dir> --json` — the L2 reading.
  *
  * Three-valued on purpose: `ok` carries the stored summary, `absent` is an honest reading of the
- * write path (no row stored yet), and `invalid` means the URI itself was rejected. CloudCLI's
+ * write path (no row stored yet), and `invalid` means the URI itself was rejected. Cloudpit's
  * `readFleetL2` treats `ok`/`absent` as readings and everything else as unreadable, so the three
  * states must stay distinguishable here.
  */
@@ -595,7 +595,7 @@ export const LIVENESS_SHAPE: Shape = {
   },
 };
 
-// The fleet's `status` document is the largest contract, but CloudCLI consumes it section by
+// The fleet's `status` document is the largest contract, but Cloudpit consumes it section by
 // section. Every field below is one a reader or the cockpit displays; nested extras (the outbox's
 // per-class attribution detail, for example) are deliberately not declared — they may grow.
 const DRIVER_READ_SHAPE: Shape = {
@@ -784,7 +784,7 @@ export const STATUS_SHAPE: Shape = {
 };
 
 /**
- * Every contract CloudCLI consumes. Order is the report order; the handshake is first because a
+ * Every contract Cloudpit consumes. Order is the report order; the handshake is first because a
  * listener reading the output needs the negotiated version before the verb results.
  */
 export const FLEET_CLI_CONTRACTS: readonly FleetCliContract[] = [

package/server/modules/quay/tests/quay-fleet-locator.test.ts

@@ -28,7 +28,7 @@ import {
  * include is `src/**` and would find no tests here.
  */
 
-/** The handshake this CloudCLI build speaks. */
+/** The handshake this Cloudpit build speaks. */
 const SUPPORTED = { wallUri: 'v0', registry: 1, interfaceSession: 'v0' } as const;
 
 /** A `quay-fleet --version --json` document. */

package/server/modules/quay/tests/quay-fleet-project-id.test.ts

@@ -12,10 +12,10 @@ import {
 import { createQuayService } from '../quay.service.js';
 
 /**
- * The CloudCLI project id → quay-fleet registry id join (quay-fleet-project-id).
+ * The Cloudpit project id → quay-fleet registry id join (quay-fleet-project-id).
  *
  * THE MATCH IS BY ROOT, NOT BY NAME. The fleet registry is the authority for project identity,
- * and it registers a project by its root path; CloudCLI knows projects by a database id. The
+ * and it registers a project by its root path; Cloudpit knows projects by a database id. The
  * join therefore canonicalizes BOTH sides — a trailing separator and a symlinked checkout are
  * the same project — and only an exact (canonical) root match yields a registry id.
  *
@@ -60,7 +60,7 @@ function staticExec(stdout: string, calls: ExecCall[] = []): QuayFleetProjectIdD
 
 /**
  * A temp workspace: `real/` is the checkout, `link/` a symlink to it. The registry registers
- * `real/` (with a trailing slash) while CloudCLI addresses the project through `link/` — the
+ * `real/` (with a trailing slash) while Cloudpit addresses the project through `link/` — the
  * two spellings must still join.
  */
 function createWorkspace(): {
@@ -86,7 +86,7 @@ test('AC3: a registered root matches through a trailing separator and a symlink'
     const resolver = createQuayFleetProjectIdResolver({
       resolveProjectPathById: (projectId) =>
         projectId === 'cloud-project'
-          // CloudCLI stored the SYMLINKED path, with a trailing separator of its own.
+          // Cloudpit stored the SYMLINKED path, with a trailing separator of its own.
           ? `${workspace.link}${path.sep}`
           : null,
       listProjects: () => [{ projectId: 'cloud-project', projectPath: workspace.link }],
@@ -127,9 +127,9 @@ test('AC3: an unregistered root and an unregistered segment are null, never a gu
     });
 
     assert.equal(await resolver.resolveFleetProjectId('elsewhere'), null);
-    // An unknown CloudCLI project is null without even reading the registry.
+    // An unknown Cloudpit project is null without even reading the registry.
     assert.equal(await resolver.resolveFleetProjectId('no-such-project'), null);
-    // A registry id nobody registered is null; CloudCLI ids are never accepted as segments.
+    // A registry id nobody registered is null; Cloudpit ids are never accepted as segments.
     assert.equal(await resolver.resolveFleetProject('cloud-uuid'), null);
   } finally {
     fs.rmSync(workspace.directory, { recursive: true, force: true });

package/server/modules/quay/tests/quay-uri-resolve.test.ts

@@ -31,10 +31,10 @@ import { createQuayService } from '../quay.service.js';
  * of it. The fleet side is a stub whose payloads use quay-fleet's v0 enum
  * (`config/object-uri.types.v0.json`) verbatim.
  *
- * THE TWO IDENTITIES ARE DELIBERATELY DIFFERENT. `CLOUD_PROJECT_ID` is what CloudCLI's database
+ * THE TWO IDENTITIES ARE DELIBERATELY DIFFERENT. `CLOUD_PROJECT_ID` is what Cloudpit's database
  * keys the project by; `FLEET_PROJECT_ID` is the registry id a `quay://` reference carries. A
  * UUID-shaped project segment must NOT resolve (it is the shape this task removed), and the
- * snapshot fallback must still be read through the CloudCLI id — the join is what proves both.
+ * snapshot fallback must still be read through the Cloudpit id — the join is what proves both.
  *
  * RUNNER NOTE: this is a server test, so it runs under the repository's canonical server
  * runner (`tsx --test`, `scripts/test.sh`), not vitest — vitest's `include` is `src/**` only
@@ -48,7 +48,7 @@ const AC_URI = `quay://${FLEET_PROJECT_ID}/task/T-42#ac-3`;
 const GOAL_URI = `quay://${FLEET_PROJECT_ID}/goal/G-1`;
 const PROJECT_ROOT = '/workspace/claudecodeui';
 
-/** A project segment in the shape the removed mapping used to accept: CloudCLI's own UUID. */
+/** A project segment in the shape the removed mapping used to accept: Cloudpit's own UUID. */
 const UUID_URI = `quay://${CLOUD_PROJECT_ID}/task/T-42`;
 
 /** quay-fleet's v0 action enum, copied from its `config/object-uri.types.v0.json` fixture. */
@@ -146,9 +146,9 @@ function createStubFleet(available = true, calls: string[] = []): QuayFleetWallR
 }
 
 /**
- * Resolves the one fixture fleet project to its registered root and CloudCLI project.
+ * Resolves the one fixture fleet project to its registered root and Cloudpit project.
  *
- * Only the fleet REGISTRY id resolves; the CloudCLI project id (a UUID) is deliberately absent,
+ * Only the fleet REGISTRY id resolves; the Cloudpit project id (a UUID) is deliberately absent,
  * which is what makes a UUID-shaped project segment an `unknown-project`.
  */
 function resolveFleetProject(
@@ -162,8 +162,8 @@ function resolveFleetProject(
 }
 
 /**
- * The project-id seam the service composes: the CloudCLI id joins to the fleet registry id
- * only through the registry, and the fleet id joins back to this fixture's root + CloudCLI id.
+ * The project-id seam the service composes: the Cloudpit id joins to the fleet registry id
+ * only through the registry, and the fleet id joins back to this fixture's root + Cloudpit id.
  */
 const fleetProjectIdResolver: QuayFleetProjectIdResolver = {
   async resolveFleetProjectId(projectId) {
@@ -610,7 +610,7 @@ test('AC4: the project segment is a fleet registry id, and a UUID segment is unk
   assert.equal(resolved.uri, TASK_URI);
   assert.deepEqual(roots, [PROJECT_ROOT], 'the fleet summary must be called with the registered root');
 
-  // The removed shape: a CloudCLI UUID as the project segment. The registry does not know it,
+  // The removed shape: a Cloudpit UUID as the project segment. The registry does not know it,
   // so the reference is named `unknown-project` and no fleet read is attempted for it.
   const before = roots.length;
   for (const result of [await resolver.resolve(UUID_URI), await resolver.summary(UUID_URI)]) {
@@ -668,7 +668,7 @@ test('AC3: the routes answer invalid references with 4xx and no read port with 5
     const unavailableBody = (await unavailable.json()) as { error: { code: string } };
     assert.equal(unavailableBody.error.code, 'fleet-unavailable');
 
-    // A project segment the fleet does not register (CloudCLI's UUID, the removed shape) is
+    // A project segment the fleet does not register (Cloudpit's UUID, the removed shape) is
     // a 404 naming `unknown-project` — never a UUID-addressed read.
     const unknown = await fetch(`${base}/resolve?uri=${encodeURIComponent(UUID_URI)}`);
     assert.equal(unknown.status, 404);
@@ -709,7 +709,7 @@ test('AC1: the service composes the injected fleet reader into its dereference m
   assert.equal(resolved.source, 'fleet');
 
   // The Tier-2 snapshot carries the same join: its project segment is the registry id, never
-  // the CloudCLI id the request was keyed by.
+  // the Cloudpit id the request was keyed by.
   const snapshot = await service.getQuaySnapshot(CLOUD_PROJECT_ID);
   assert.equal(snapshot?.projectId, CLOUD_PROJECT_ID);
   assert.equal(snapshot?.fleetProjectId, FLEET_PROJECT_ID);

package/server/modules/session-hosts/tests/resident-server-restart.test.ts

@@ -129,7 +129,7 @@ const SCOPE_TIMEOUT_MS = 15_000;
  *
  * It used to be a bare 60_000, which the three boots alone (75_000) already
  * exceeded: on 2026-10-02 a run whose servers had each reached
- * `CloudCLI Server - Ready` was killed at the 60s boundary with `exit=3` because
+ * `Cloudpit Server - Ready` was killed at the 60s boundary with `exit=3` because
  * the budget, not the boot, was too small — and a process-level kill names no
  * `node:test` case, which is why that red could not be attributed.
  *