@vellumai/assistant 0.7.1 → 0.7.2

package/src/cli/commands/domain.ts

@@ -1,6 +1,11 @@
 import type { Command } from "commander";
 
-import { getAssistantDomain } from "../../config/env.js";
+import { getApexDomain, getAssistantDomain } from "../../config/env.js";
+import {
+  loadRawConfig,
+  saveRawConfig,
+  setNestedValue,
+} from "../../config/loader.js";
 import { VellumPlatformClient } from "../../platform/client.js";
 import { getCliLogger } from "../logger.js";
 import { shouldOutputJson, writeOutput } from "../output.js";
@@ -8,6 +13,7 @@ import { shouldOutputJson, writeOutput } from "../output.js";
 const log = getCliLogger("domain");
 
 export function registerDomainCommand(program: Command): void {
+  const apexDomain = getApexDomain();
   const baseDomain = getAssistantDomain();
   const domain = program
     .command("domain")
@@ -97,17 +103,36 @@ Examples:
 
           const data = (await response.json()) as {
             id: string;
-            domain: string;
-            status: string;
-            verified: boolean;
-            created_at: string;
+            subdomain?: string;
+            domain?: string;
+            status?: string;
+            verified?: boolean;
+            created_at?: string;
+            created?: string;
           };
 
+          // Persist the subdomain to config so getAssistantDomain() can use it
+          const registeredSubdomain =
+            data.subdomain ??
+            data.domain?.replace(`.${apexDomain}`, "") ??
+            subdomain;
+          if (registeredSubdomain) {
+            const raw = loadRawConfig();
+            setNestedValue(raw, "platform.subdomain", registeredSubdomain);
+            saveRawConfig(raw);
+          }
+
+          const displayDomain =
+            data.domain ??
+            (registeredSubdomain
+              ? `${registeredSubdomain}.${apexDomain}`
+              : "unknown");
+
           if (shouldOutputJson(cmd)) {
             writeOutput(cmd, data);
           } else {
-            log.info(`✓ Registered ${data.domain}`);
-            if (!data.verified) {
+            log.info(`✓ Registered ${displayDomain}`);
+            if (data.verified === false) {
               log.info(
                 "  ⚠ Domain verification pending — this usually resolves within a few seconds.",
               );
@@ -174,15 +199,33 @@ Examples:
         const data = (await response.json()) as {
           results: {
             id: string;
-            domain: string;
-            status: string;
-            verified: boolean;
-            created_at: string;
+            subdomain?: string;
+            domain?: string;
+            status?: string;
+            verified?: boolean;
+            created_at?: string;
+            created?: string;
           }[];
         };
 
         const domains = data.results ?? [];
 
+        // Sync subdomain to config if not already cached
+        if (domains.length > 0) {
+          const first = domains[0];
+          const sub =
+            first.subdomain ?? first.domain?.replace(`.${apexDomain}`, "");
+          if (sub) {
+            const raw = loadRawConfig();
+            const existing = (raw as Record<string, Record<string, unknown>>)
+              .platform?.subdomain;
+            if (existing !== sub) {
+              setNestedValue(raw, "platform.subdomain", sub);
+              saveRawConfig(raw);
+            }
+          }
+        }
+
         if (shouldOutputJson(cmd)) {
           writeOutput(cmd, data);
         } else if (domains.length === 0) {
@@ -191,10 +234,18 @@ Examples:
           );
         } else {
           for (const d of domains) {
-            log.info(`Domain:   ${d.domain}`);
-            log.info(`Status:   ${d.status}`);
-            log.info(`Verified: ${d.verified ? "yes" : "no"}`);
-            log.info(`Created:  ${d.created_at.split("T")[0]}`);
+            const displayDomain =
+              d.domain ??
+              (d.subdomain ? `${d.subdomain}.${apexDomain}` : "unknown");
+            const createdRaw = d.created_at ?? d.created;
+            const createdDate = createdRaw
+              ? createdRaw.split("T")[0]
+              : "unknown";
+            log.info(`Domain:   ${displayDomain}`);
+            if (d.status != null) log.info(`Status:   ${d.status}`);
+            if (d.verified != null)
+              log.info(`Verified: ${d.verified ? "yes" : "no"}`);
+            log.info(`Created:  ${createdDate}`);
           }
         }
       } catch (err) {

package/src/cli/commands/gateway.ts

@@ -0,0 +1,183 @@
+/**
+ * `assistant gateway` CLI namespace.
+ *
+ * Subcommands:
+ *   logs tail — Show the last N gateway log entries via the daemon IPC proxy.
+ */
+
+import type { Command } from "commander";
+
+import { cliIpcCall } from "../../ipc/cli-client.js";
+import { log } from "../logger.js";
+
+// -- Types --------------------------------------------------------------------
+
+interface PinoEntry {
+  time: number; // Unix ms timestamp
+  level: number; // pino numeric level
+  module?: string;
+  msg?: string;
+  [key: string]: unknown;
+}
+
+// -- Helpers ------------------------------------------------------------------
+
+function formatTime(ms: number): string {
+  const d = new Date(ms);
+  const pad = (n: number, w = 2) => String(n).padStart(w, "0");
+  const centis = String(Math.floor((ms % 1000) / 10)).padStart(2, "0");
+  return (
+    `${d.getFullYear()}-${pad(d.getMonth() + 1)}-${pad(d.getDate())} ` +
+    `${pad(d.getHours())}:${pad(d.getMinutes())}:${pad(d.getSeconds())}.${centis}`
+  );
+}
+
+const LEVEL_NAMES: Record<number, string> = {
+  10: "TRACE",
+  20: "DEBUG",
+  30: "INFO",
+  40: "WARN",
+  50: "ERROR",
+  60: "FATAL",
+};
+
+function levelName(n: number): string {
+  return LEVEL_NAMES[n] ?? String(n);
+}
+
+function colorLevel(name: string, levelNum: number): string {
+  if (!process.stdout.isTTY) return name;
+  if (levelNum >= 50) return `\x1b[31m${name}\x1b[0m`; // red: error/fatal
+  if (levelNum === 40) return `\x1b[33m${name}\x1b[0m`; // yellow: warn
+  if (levelNum <= 20) return `\x1b[2m${name}\x1b[0m`; // dim: debug/trace
+  return name;
+}
+
+// -- Registration -------------------------------------------------------------
+
+export function registerGatewayCommand(program: Command): void {
+  const gateway = program.command("gateway").description("Gateway management");
+
+  gateway.addHelpText(
+    "after",
+    `
+The gateway is the channel ingress layer — it handles inbound HTTP requests,
+manages trust rules, routes traffic to the assistant, and records
+structured logs for all inbound activity.
+
+Examples:
+  $ assistant gateway logs tail
+  $ assistant gateway logs tail -n 50
+  $ assistant gateway logs tail --level warn
+  $ assistant gateway logs tail --module cors`,
+  );
+
+  const logs = gateway.command("logs").description("Gateway log operations");
+
+  logs.addHelpText(
+    "after",
+    `
+Gateway logs are structured JSON (ndjson) entries emitted by the gateway
+process. Each entry carries a timestamp, numeric pino log level, optional
+module tag, and a message. Use 'tail' to inspect recent entries.
+
+Examples:
+  $ assistant gateway logs tail
+  $ assistant gateway logs tail --level error --module cors`,
+  );
+
+  logs
+    .command("tail")
+    .description("Show last N gateway log entries")
+    .option("-n <number>", "Number of lines (default: 10)")
+    .option("-q, --quiet", "Suppress column headers")
+    .option(
+      "--level <level>",
+      "Minimum log level (trace|debug|info|warn|error|fatal)",
+      "info",
+    )
+    .option("--module <name>", "Filter to exact module name")
+    .option("--raw", "Output raw ndjson (one JSON object per line)")
+    .addHelpText(
+      "after",
+      `
+Arguments:
+  -n <number>        Number of entries to return, clamped to 1–1000 (default: 10).
+  --level <level>    Minimum log level to include. One of:
+                       trace | debug | info | warn | error | fatal
+                     Defaults to "info". Use "trace" or "debug" for verbose output.
+  --module <name>    Filter to entries whose module tag exactly matches <name>.
+                     Useful for isolating a specific subsystem (e.g. "cors", "trust").
+  --raw              Emit raw ndjson — one JSON object per line — instead of the
+                     formatted table. Useful for piping to jq or other JSON tools.
+  -q, --quiet        Suppress the column-header line in table output.
+
+Output format (default table):
+  TIME (24 chars)  LEVEL (5 chars)  MODULE (up to 12 chars)  MESSAGE (truncated at 120 chars)
+
+Truncation:
+  When more matching entries exist beyond the requested -n window, a dim
+  "(showing last N matching entries — earlier entries exist)" footer is printed.
+
+Examples:
+  $ assistant gateway logs tail
+  $ assistant gateway logs tail -n 50 --level warn
+  $ assistant gateway logs tail --module cors --raw | jq .msg`,
+    )
+    .action(async (opts) => {
+      const n = Math.max(1, Math.min(1000, parseInt(opts.n ?? "10", 10) || 10));
+      const params: Record<string, unknown> = { n };
+      if (opts.level && opts.level !== "info") params.level = opts.level;
+      if (opts.module) params.module = opts.module;
+
+      const result = await cliIpcCall<{ lines: PinoEntry[]; truncated: boolean }>(
+        "gateway_logs_tail",
+        { body: params },
+      );
+
+      if (!result.ok) {
+        log.error(result.error ?? "Failed to fetch gateway logs");
+        process.exitCode = 1;
+        return;
+      }
+
+      const { lines, truncated } = result.result!;
+
+      if (opts.raw) {
+        for (const entry of lines) process.stdout.write(JSON.stringify(entry) + "\n");
+        return;
+      }
+
+      if (lines.length === 0) {
+        if (!opts.quiet) process.stdout.write("No log entries found.\n");
+        return;
+      }
+
+      const moduleWidth = Math.min(
+        12,
+        Math.max(6, ...lines.map((l) => l.module?.length ?? 0)),
+      );
+
+      if (!opts.quiet) {
+        process.stdout.write(
+          `${"TIME".padEnd(24)}  ${"LEVEL".padEnd(5)}  ${"MODULE".padEnd(moduleWidth)}  MESSAGE\n`,
+        );
+      }
+
+      for (const entry of lines) {
+        const time = formatTime(entry.time).padEnd(24);
+        const lvlName = levelName(entry.level).padEnd(5);
+        const lvlColored = colorLevel(lvlName, entry.level);
+        const mod = (entry.module ?? "").padEnd(moduleWidth);
+        const msg = entry.msg ?? "";
+        const msgTrunc = msg.length > 120 ? msg.slice(0, 120) + "…" : msg;
+        process.stdout.write(`${time}  ${lvlColored}  ${mod}  ${msgTrunc}\n`);
+      }
+
+      if (truncated) {
+        const footer = `(showing last ${n} matching entries — earlier entries exist)`;
+        const dim = process.stdout.isTTY ? `\x1b[2m${footer}\x1b[0m` : footer;
+        process.stdout.write(dim + "\n");
+      }
+    });
+}

package/src/cli/commands/keys.ts

@@ -102,10 +102,12 @@ Examples:
         process.exit(1);
       }
 
-      if (await setSecureKeyViaDaemon("api_key", provider, key)) {
+      const setResult = await setSecureKeyViaDaemon("api_key", provider, key);
+      if (setResult.ok) {
         log.info(`Stored API key for "${provider}"`);
       } else {
-        log.error(`Failed to store API key for "${provider}"`);
+        const detail = setResult.error ? `: ${setResult.error}` : "";
+        log.error(`Failed to store API key for "${provider}"${detail}`);
         process.exit(1);
       }
     });
@@ -133,11 +135,12 @@ Examples:
         process.exit(1);
       }
 
-      const result = await deleteSecureKeyViaDaemon("api_key", provider);
-      if (result === "deleted") {
+      const delResult = await deleteSecureKeyViaDaemon("api_key", provider);
+      if (delResult.result === "deleted") {
         log.info(`Deleted API key for "${provider}"`);
-      } else if (result === "error") {
-        log.error(`Failed to delete API key for "${provider}": storage error`);
+      } else if (delResult.result === "error") {
+        const detail = delResult.error ? `: ${delResult.error}` : "";
+        log.error(`Failed to delete API key for "${provider}"${detail}`);
         process.exit(1);
       } else {
         log.error(`No API key found for "${provider}"`);

package/src/cli/commands/mcp.ts

@@ -1,24 +1,59 @@
-import { mkdirSync, writeFileSync } from "node:fs";
-import { join } from "node:path";
-
-import { UnauthorizedError } from "@modelcontextprotocol/sdk/client/auth.js";
-import { Client } from "@modelcontextprotocol/sdk/client/index.js";
-import { SSEClientTransport } from "@modelcontextprotocol/sdk/client/sse.js";
-import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/streamableHttp.js";
 import type { Command } from "commander";
 
 import { loadRawConfig, saveRawConfig } from "../../config/loader.js";
 import type { McpConfig, McpServerConfig } from "../../config/schemas/mcp.js";
+import { cliIpcCall } from "../../ipc/cli-client.js";
 import { McpClient } from "../../mcp/client.js";
-import {
-  deleteMcpOAuthCredentials,
-  McpOAuthProvider,
-} from "../../mcp/mcp-oauth-provider.js";
-import { getSignalsDir } from "../../util/platform.js";
+import { deleteMcpOAuthCredentials } from "../../mcp/mcp-oauth-provider.js";
+import { openInHostBrowser } from "../../util/browser.js";
 import { log } from "../logger.js";
 
 const HEALTH_CHECK_TIMEOUT_MS = 10_000;
 
+async function pollMcpAuthStatus(
+  serverId: string,
+  options: { intervalMs: number; timeoutMs: number },
+): Promise<{ status: "complete" | "error"; error?: string }> {
+  const deadline = Date.now() + options.timeoutMs;
+  while (Date.now() < deadline) {
+    await new Promise<void>((resolve) =>
+      setTimeout(resolve, options.intervalMs),
+    );
+    const result = await cliIpcCall<{ status: string; error?: string }>(
+      "internal_mcp_auth_status",
+      { pathParams: { serverId } },
+    );
+    if (result.ok && result.result?.status === "complete") {
+      return { status: "complete" };
+    }
+    if (result.ok && result.result?.status === "error") {
+      return { status: "error", error: result.result.error };
+    }
+    // The daemon returned an IPC-level error (ok: false) indicating the flow
+    // was not found — most likely because the daemon restarted mid-poll and
+    // lost the in-memory state.  Surface this immediately instead of looping
+    // for the full 2.5 minutes and then reporting a generic timeout.
+    if (
+      !result.ok &&
+      result.error &&
+      result.error.includes("No active OAuth flow")
+    ) {
+      return {
+        status: "error",
+        error: `OAuth flow was lost (assistant may have restarted). Run 'assistant mcp auth ${serverId}' to retry.`,
+      };
+    }
+    // Fail fast on any other real IPC error instead of looping for 2.5 minutes
+    if (!result.ok && result.error) {
+      return { status: "error", error: result.error };
+    }
+  }
+  return {
+    status: "error",
+    error: "OAuth authorization timed out after 2.5 minutes",
+  };
+}
+
 export async function checkServerHealth(
   serverId: string,
   config: McpServerConfig,
@@ -66,21 +101,6 @@ export async function checkServerHealth(
   }
 }
 
-/**
- * Write a signal file so the daemon's ConfigWatcher triggers an MCP reload.
- * Used by `mcp reload`, `mcp auth`, and any operation that needs the daemon
- * to reconnect MCP servers.
- */
-function signalMcpReload(): void {
-  try {
-    const signalsDir = getSignalsDir();
-    mkdirSync(signalsDir, { recursive: true });
-    writeFileSync(join(signalsDir, "mcp-reload"), "");
-  } catch {
-    // Best-effort — the daemon may not be running or the directory may not exist.
-  }
-}
-
 export function registerMcpCommand(program: Command): void {
   const mcp = program
     .command("mcp")
@@ -290,11 +310,18 @@ Examples:
   $ vellum mcp reload   # after editing config.json to add a new server
   $ vellum mcp reload   # after running "vellum mcp auth <server>"`,
     )
-    .action(() => {
-      signalMcpReload();
-      log.info(
-        "MCP reload signal sent. The running assistant will reconnect servers shortly.",
-      );
+    .action(async () => {
+      const result = await cliIpcCall("internal_mcp_reload", { body: {} });
+      if (!result.ok) {
+        log.warn(
+          `Could not signal reload: ${result.error}. ` +
+            `Run 'assistant mcp reload' once the assistant is up.`,
+        );
+      } else {
+        log.info(
+          "MCP reload signal sent. The running assistant will reconnect servers shortly.",
+        );
+      }
     });
 
   mcp
@@ -337,7 +364,7 @@ Examples:
   $ assistant mcp add legacy-sse -t sse -u https://old.example.com/events --disabled`,
     )
     .action(
-      (
+      async (
         name: string,
         opts: {
           transportType: string;
@@ -411,10 +438,15 @@ Examples:
 
         saveRawConfig(raw);
         log.info(`Added MCP server "${name}" (${opts.transportType})`);
-        log.info(
-          "The running assistant will pick up this change automatically. " +
-            "Or run 'vellum mcp reload' to apply now.",
-        );
+        const reloadResult = await cliIpcCall("internal_mcp_reload", { body: {} });
+        if (!reloadResult.ok) {
+          log.warn(
+            `Could not signal reload: ${reloadResult.error}. ` +
+              `Run 'assistant mcp reload' once the assistant is up.`,
+          );
+        } else {
+          log.info("The running assistant is reloading MCP servers now.");
+        }
       },
     );
 
@@ -428,8 +460,8 @@ Arguments:
   name   Name of a configured MCP server to authenticate with
 
 Only works with sse or streamable-http transports (stdio servers do not use
-OAuth). Opens a browser for OAuth authorization with the remote server and
-starts a local callback server to receive the authorization code.
+OAuth). Opens a browser for OAuth authorization with the remote server. The
+running assistant handles the OAuth callback and token exchange.
 
 The command waits up to 2.5 minutes for the user to complete the browser-based
 OAuth flow. If the server already has valid cached tokens, the command succeeds
@@ -466,141 +498,69 @@ Examples:
         return;
       }
 
-      // Validate URL early so we fail fast before starting the callback server
-      let serverUrl: URL;
-      try {
-        serverUrl = new URL(transport.url);
-      } catch {
-        log.error(`Invalid URL for MCP server "${name}": ${transport.url}`);
-        process.exitCode = 1;
-        return;
-      }
+      // IPC-first path — attempt daemon-orchestrated flow (works on hosted assistants)
+      const startResult = await cliIpcCall<{
+        auth_url: string;
+        state: string;
+        already_authenticated?: boolean;
+      }>("internal_mcp_auth_start", { body: { serverId: name } });
 
-      const provider = new McpOAuthProvider(
-        name,
-        transport.url,
-        /* interactive */ true,
-      );
-      // Clear stale client_info and discovery — the callback server uses a random port,
-      // so any previously cached client_info has a mismatched redirect_uri.
-      // Preserve tokens so they survive if this auth attempt fails.
-      await provider.invalidateCredentials("client");
-      await provider.invalidateCredentials("discovery");
-      const { codePromise } = await provider.startCallbackServer();
-
-      const OAUTH_TIMEOUT_MS = 150_000; // 2.5 min for browser interaction
-      const TransportClass =
-        transport.type === "sse"
-          ? SSEClientTransport
-          : StreamableHTTPClientTransport;
-      const mcpTransport = new TransportClass(serverUrl, {
-        authProvider: provider,
-        requestInit: transport.headers
-          ? { headers: transport.headers }
-          : undefined,
-      });
-
-      const client = new Client({ name: "vellum-assistant", version: "1.0.0" });
-
-      try {
-        // Try connecting — if tokens are already cached, this succeeds immediately
-        await client.connect(mcpTransport);
-        provider.stopCallbackServer();
-        await client.close();
+      if (startResult.ok && startResult.result?.already_authenticated) {
         log.info(`Server "${name}" is already authenticated.`);
+        process.exit(0);
         return;
-      } catch (err) {
-        if (!(err instanceof UnauthorizedError)) {
-          provider.stopCallbackServer();
-          try {
-            await client.close();
-          } catch {
-            /* ignore */
-          }
-          log.error(`Failed to connect to "${name}": ${err}`);
-          process.exitCode = 1;
-          return;
-        }
       }
 
-      // UnauthorizedError — browser was opened by redirectToAuthorization().
-      // Wait for the user to complete the OAuth flow.
-      log.info(
-        "Waiting for authorization in browser... (press Ctrl+C to cancel)",
-      );
+      if (startResult.ok && startResult.result?.auth_url) {
+        const authUrl = startResult.result.auth_url;
+        log.info(`Opening browser for "${name}" OAuth authorization...`);
+        await openInHostBrowser(authUrl);
+        log.info(`If the browser did not open, visit:\n${authUrl}`);
+        log.info(
+          "Waiting for authorization in browser... (press Ctrl+C to cancel)",
+        );
 
-      let code: string;
-      let oauthTimer: ReturnType<typeof setTimeout> | undefined;
-      try {
-        code = await Promise.race([
-          codePromise,
-          new Promise<never>((_, reject) => {
-            oauthTimer = setTimeout(
-              () =>
-                reject(
-                  new Error("OAuth authorization timed out after 2.5 minutes"),
-                ),
-              OAUTH_TIMEOUT_MS,
-            );
-            if (typeof oauthTimer === "object" && "unref" in oauthTimer)
-              oauthTimer.unref();
-          }),
-        ]);
-        clearTimeout(oauthTimer);
-      } catch (err) {
-        clearTimeout(oauthTimer);
-        provider.stopCallbackServer();
-        try {
-          await client.close();
-        } catch {
-          /* ignore */
+        const finalStatus = await pollMcpAuthStatus(name, {
+          intervalMs: 2_000,
+          timeoutMs: 150_000, // matches existing OAUTH_TIMEOUT_MS
+        });
+
+        if (finalStatus.status === "complete") {
+          log.info(`Authentication successful for "${name}".`);
+          log.info(
+            "The running assistant has picked up this change automatically.",
+          );
+          process.exit(0);
+          return;
         }
-        const message = err instanceof Error ? err.message : String(err);
-        if (message.includes("denied") || message.includes("cancelled")) {
+
+        const errMsg = finalStatus.error ?? "Unknown error";
+        if (errMsg.includes("denied") || errMsg.includes("cancelled")) {
           log.error(`Authorization cancelled for "${name}".`);
-        } else if (message.includes("timed out")) {
+        } else if (errMsg.includes("timed out")) {
           log.error(
             `Authorization timed out for "${name}". Try again with: assistant mcp auth ${name}`,
           );
         } else {
-          log.error(`Authorization failed for "${name}": ${message}`);
-        }
-        process.exitCode = 1;
-        return;
-      }
-
-      log.info("Authorization received. Exchanging token...");
-
-      // Exchange auth code for tokens
-      try {
-        await mcpTransport.finishAuth(code);
-      } catch (err) {
-        provider.stopCallbackServer();
-        try {
-          await client.close();
-        } catch {
-          /* ignore */
+          log.error(`OAuth failed for "${name}": ${errMsg}`);
         }
-        log.error(`Token exchange failed for "${name}": ${err}`);
         process.exitCode = 1;
         return;
       }
 
-      // Clean up transport/client so the process can exit
-      try {
-        await client.close();
-      } catch {
-        /* ignore */
+      // Any !startResult.ok case: surface error and exit 1
+      const ipcErrMsg = startResult.error ?? "Unknown error";
+      if (
+        ipcErrMsg.startsWith("Could not connect to assistant daemon") ||
+        ipcErrMsg.startsWith("Unknown method:")
+      ) {
+        log.error(
+          `MCP OAuth requires the assistant to be running. Is it running?`,
+        );
+      } else {
+        log.error(`MCP OAuth failed via assistant: ${ipcErrMsg}`);
       }
-      provider.stopCallbackServer();
-
-      log.info(`Authentication successful for "${name}".`);
-      log.info(
-        "The running assistant will pick up this change automatically. " +
-          "Or run 'vellum mcp reload' to apply now.",
-      );
-      signalMcpReload();
-      process.exit(0);
+      process.exitCode = 1;
     });
 
   mcp