@vellumai/cli 0.10.0 → 0.10.1-dev.202606240206.7c2bca6

package/src/lib/assistant-config.ts

@@ -11,6 +11,11 @@ import { homedir } from "os";
 import { dirname, join } from "path";
 
 import { SEEDS, type EnvironmentDefinition } from "@vellumai/environments";
+import {
+  resolveCloud,
+  type LocalAssistantResources,
+  type LockfileAssistant,
+} from "@vellumai/local-mode/contract";
 
 import { DAEMON_INTERNAL_ASSISTANT_ID } from "./constants.js";
 import {
@@ -23,11 +28,17 @@ import { getCurrentEnvironment } from "./environments/resolve.js";
 import { probePort } from "./port-probe.js";
 
 /**
- * Per-instance resource paths and ports. Each local assistant instance gets
- * its own directory tree, ports, and socket so multiple instances can run
- * side-by-side without conflicts.
+ * Per-instance resource paths and ports. Each local assistant instance gets its
+ * own directory tree, ports, and socket so multiple instances can run
+ * side-by-side without conflicts. Extends the renderer-safe resources contract
+ * (`instanceDir`, `gatewayPort`, `daemonPort`) with the host-only ports and the
+ * signing key. Host-only and same-process, so it is a plain type — the
+ * renderer-facing shape is the one with a Zod contract.
  */
-export interface LocalInstanceResources {
+export type LocalInstanceResources = Omit<
+  LocalAssistantResources,
+  "instanceDir"
+> & {
   /**
    * Instance-specific data root. New local assistants are placed under
    * `$XDG_DATA_HOME/vellum{-env}/assistants/<name>/`. Legacy entries
@@ -36,10 +47,6 @@ export interface LocalInstanceResources {
    * lives inside it.
    */
   instanceDir: string;
-  /** HTTP port for the daemon runtime server */
-  daemonPort: number;
-  /** HTTP port for the gateway */
-  gatewayPort: number;
   /** HTTP port for the Qdrant vector store */
   qdrantPort: number;
   /** HTTP port for the CES (Claude Extension Server) */
@@ -47,8 +54,12 @@ export interface LocalInstanceResources {
   /** Persisted HMAC signing key (hex). Survives daemon/gateway restarts so
    *  client actor tokens remain valid across `wake` cycles. */
   signingKey?: string;
+  /** Version of the npm-backed local runtime this assistant should run. */
+  runtimeVersion?: string;
+  /** Install directory containing the npm-backed local runtime packages. */
+  runtimeInstallDir?: string;
   [key: string]: unknown;
-}
+};
 
 /** Docker image metadata for the service group. Enables rollback to known-good digests. */
 export interface ContainerInfo {
@@ -65,26 +76,32 @@ export interface ContainerInfo {
   networkName?: string;
 }
 
-export interface AssistantEntry {
-  assistantId: string;
-  /** Platform-provided display name, when available. */
-  name?: string;
+/**
+ * The CLI's full view of an assistant entry: the renderer-safe base
+ * (`LockfileAssistant`, the one canonical Zod contract) plus the host-only and
+ * sensitive fields the CLI reads and writes. Those extra fields never cross a
+ * validation boundary — the same toolchain writes and reads them — so they are
+ * modeled as plain types here rather than re-validated.
+ *
+ * `runtimeUrl` is required (`readAssistants` only returns entries that have one)
+ * and `resources` is the richer host shape. `cloud` is inherited from
+ * `LockfileAssistant` (always present; normalized at the read seam — see
+ * `readAssistants`). The index signature preserves unknown on-disk fields so a
+ * read→write round-trip never drops a newer writer's data.
+ */
+export type AssistantEntry = Omit<
+  LockfileAssistant,
+  "runtimeUrl" | "resources"
+> & {
+  runtimeUrl: string;
+  /** Per-instance resource config. Present for local entries in multi-instance setups. */
+  resources?: LocalInstanceResources;
   /** Older lockfile key for the display name, if present. */
   assistantName?: string;
-  runtimeUrl: string;
   /** Loopback URL for same-machine health checks (e.g. `http://127.0.0.1:7831`).
    *  Avoids mDNS resolution issues when the machine checks its own gateway. */
   localUrl?: string;
   bearerToken?: string;
-  /** Deployment topology / how the assistant is reached. Known values:
-   *  `"local"` (on-machine daemon), `"docker"` (local container),
-   *  `"apple-container"` (macOS-app-managed container), `"vellum"`
-   *  (platform-managed, uses the X-Session-Token auth path), `"gcp"` / `"aws"`
-   *  / `"custom"` (remote, SSH-managed), and `"paired"` (a remote assistant
-   *  paired from another machine — reached via a bearer guardian token at
-   *  `runtimeUrl`; has no local process, container, or `resources`).
-   *  Kept as a free `string` (not a union) for forward-compatibility. */
-  cloud: string;
   /** True when this entry was registered via `vellum connect import` (a remote
    *  pairing). Set alongside `cloud: "paired"`; also backs the re-import /
    *  overwrite guard in connect import. */
@@ -93,12 +110,8 @@ export interface AssistantEntry {
   namespace?: string;
   project?: string;
   region?: string;
-  species?: string;
   sshUser?: string;
   zone?: string;
-  hatchedAt?: string;
-  /** Per-instance resource config. Present for local entries in multi-instance setups. */
-  resources?: LocalInstanceResources;
   /** PID of the file watcher process for docker instances hatched with --watch. */
   watcherPid?: number;
   /** Local bootstrap secret used to lease guardian tokens for Docker assistants after detached hatch. */
@@ -119,7 +132,7 @@ export interface AssistantEntry {
   /** Pre-upgrade workspace migration ID — used by rollback to know how far back to revert. */
   previousWorkspaceMigrationId?: string;
   [key: string]: unknown;
-}
+};
 
 export type AssistantLookupResult =
   | { status: "found"; entry: AssistantEntry }
@@ -300,10 +313,20 @@ function readAssistants(): AssistantEntry[] {
     writeLockfile(data);
   }
 
-  return entries.filter(
-    (e): e is AssistantEntry =>
-      typeof e.assistantId === "string" && typeof e.runtimeUrl === "string",
-  );
+  const result: AssistantEntry[] = [];
+  for (const entry of entries) {
+    if (
+      typeof entry.assistantId !== "string" ||
+      typeof entry.runtimeUrl !== "string"
+    ) {
+      continue;
+    }
+    // Normalize `cloud` once, at the read seam every reader shares, so
+    // downstream code reads `entry.cloud` instead of re-deriving the topology.
+    entry.cloud = resolveCloud(entry);
+    result.push(entry as AssistantEntry);
+  }
+  return result;
 }
 
 function writeAssistants(entries: AssistantEntry[]): void {
@@ -471,6 +494,7 @@ export function loadAllAssistantsAcrossEnvs(
       ) {
         continue;
       }
+      entry.cloud = resolveCloud(entry);
       all.push(entry);
     }
   }
@@ -555,22 +579,6 @@ export function resolveTargetAssistant(nameArg?: string): AssistantEntry {
   process.exit(1);
 }
 
-/**
- * Determine which cloud topology an assistant entry is running on.
- */
-export function resolveCloud(entry: AssistantEntry): string {
-  if (entry.cloud) {
-    return entry.cloud;
-  }
-  if (entry.project) {
-    return "gcp";
-  }
-  if (entry.sshUser) {
-    return "custom";
-  }
-  return "local";
-}
-
 /**
  * Extract the hostname from a URL string. Falls back to stripping the scheme
  * and taking the hostname portion if URL parsing fails.

package/src/lib/confirm-action.ts

@@ -18,6 +18,9 @@ export function canPromptForConfirmation(): boolean {
  * Show `prompt` and resolve true on Enter, false on Esc/q/Ctrl-C. Restores the
  * prior stdin raw/paused state on exit. Caller must gate on
  * {@link canPromptForConfirmation} first.
+ *
+ * `unref()`s stdin on cleanup so the resumed handle doesn't keep the process
+ * alive after the prompt resolves.
  */
 export async function confirmAction(prompt: string): Promise<boolean> {
   const stdin = process.stdin;
@@ -36,6 +39,7 @@ export async function confirmAction(prompt: string): Promise<boolean> {
       if (wasPaused) {
         stdin.pause();
       }
+      stdin.unref?.();
       stdout.write("\n");
     };
 

package/src/lib/local.ts

@@ -1,4 +1,4 @@
-import { execFileSync, execSync, spawn } from "child_process";
+import { execFileSync, execSync, spawn, spawnSync } from "child_process";
 import { createHash, randomBytes } from "crypto";
 import {
   existsSync,
@@ -9,7 +9,7 @@ import {
 } from "fs";
 import { createRequire } from "module";
 import { homedir, networkInterfaces, platform, tmpdir } from "os";
-import { dirname, join } from "path";
+import { basename, dirname, join } from "path";
 
 import {
   getDaemonPidPath,
@@ -23,6 +23,7 @@ import {
   stopProcess,
   stopProcessByPidFile,
 } from "./process.js";
+import { stripVersionPrefix } from "./version-compat.js";
 import { openLogFile, pipeToLogFile } from "./xdg-log.js";
 
 const _require = createRequire(import.meta.url);
@@ -33,6 +34,166 @@ const DARWIN_UNIX_SOCKET_MAX_PATH_BYTES = 103;
 // The longest socket filename we place in the workspace directory.
 // assistant-skill.sock = 20 chars, plus 1 for the "/" separator = 21 overhead.
 const LONGEST_SOCKET_FILENAME = "assistant-skill.sock";
+const LOCAL_RUNTIME_PACKAGE = "vellum";
+
+export interface LocalRuntimeInstall {
+  version: string;
+  installDir: string;
+}
+
+function normalizeRuntimeVersion(version: string): string {
+  return version === "latest" ? version : stripVersionPrefix(version);
+}
+
+export function getLocalRuntimeInstallDir(
+  resources: LocalInstanceResources,
+  version: string,
+): string {
+  return join(
+    resources.instanceDir,
+    ".vellum",
+    "runtime",
+    normalizeRuntimeVersion(version),
+  );
+}
+
+function packagePath(
+  installDir: string,
+  packageName: string,
+  relativePath: string,
+): string {
+  return join(
+    installDir,
+    "node_modules",
+    ...packageName.split("/"),
+    relativePath,
+  );
+}
+
+function hasLocalRuntimeComponents(installDir: string): boolean {
+  return (
+    existsSync(
+      packagePath(installDir, "@vellumai/assistant", "src/index.ts"),
+    ) &&
+    existsSync(
+      packagePath(installDir, "@vellumai/vellum-gateway", "src/index.ts"),
+    ) &&
+    existsSync(
+      packagePath(installDir, "@vellumai/credential-executor", "src/main.ts"),
+    )
+  );
+}
+
+function resolveBunExecutable(): string {
+  const execBase = basename(process.execPath);
+  if (execBase === "bun" || execBase.startsWith("bun-")) {
+    return process.execPath;
+  }
+
+  const envBun = process.env.VELLUM_BUN;
+  if (envBun && existsSync(envBun)) return envBun;
+
+  const siblingBun = join(dirname(process.execPath), "bun");
+  if (existsSync(siblingBun)) return siblingBun;
+
+  const bundledBun = join(dirname(process.execPath), "..", "Resources", "bun");
+  if (existsSync(bundledBun)) return bundledBun;
+
+  const homeBun = join(homedir(), ".bun", "bin", "bun");
+  if (existsSync(homeBun)) return homeBun;
+
+  return "bun";
+}
+
+function envWithBunPath(
+  env: Record<string, string | undefined>,
+): Record<string, string | undefined> {
+  const bunPath = resolveBunExecutable();
+  const basePath = env.PATH || "/usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin";
+  const extraDirs = [
+    bunPath.includes("/") ? dirname(bunPath) : "",
+    join(homedir(), ".bun", "bin"),
+    join(homedir(), ".local", "bin"),
+  ].filter((dir) => dir && !basePath.split(":").includes(dir));
+  return {
+    ...env,
+    PATH: [...extraDirs, basePath].filter(Boolean).join(":"),
+  };
+}
+
+function localRuntimeAssistantIndex(
+  resources: LocalInstanceResources,
+): string | undefined {
+  const installDir = resources.runtimeInstallDir;
+  if (!installDir) return undefined;
+  const candidate = packagePath(
+    installDir,
+    "@vellumai/assistant",
+    "src/index.ts",
+  );
+  return existsSync(candidate) ? candidate : undefined;
+}
+
+function localRuntimeGatewayDir(
+  resources: LocalInstanceResources | undefined,
+): string | undefined {
+  const installDir = resources?.runtimeInstallDir;
+  if (!installDir) return undefined;
+  const candidate = packagePath(installDir, "@vellumai/vellum-gateway", "");
+  return isGatewaySourceDir(candidate) ? candidate : undefined;
+}
+
+export function ensureLocalRuntime(
+  resources: LocalInstanceResources,
+  version: string,
+  options: { force?: boolean } = {},
+): LocalRuntimeInstall {
+  const normalizedVersion = normalizeRuntimeVersion(version);
+  const displayVersion =
+    normalizedVersion === "latest" ? "latest" : `v${normalizedVersion}`;
+  const installDir = getLocalRuntimeInstallDir(resources, normalizedVersion);
+
+  if (!options.force && hasLocalRuntimeComponents(installDir)) {
+    return { version: displayVersion, installDir };
+  }
+
+  ensureBunInstalled();
+  mkdirSync(installDir, { recursive: true });
+  writeFileSync(
+    join(installDir, "package.json"),
+    `${JSON.stringify(
+      {
+        private: true,
+        dependencies: {
+          [LOCAL_RUNTIME_PACKAGE]: normalizedVersion,
+        },
+      },
+      null,
+      2,
+    )}\n`,
+  );
+
+  const bunPath = resolveBunExecutable();
+  const result = spawnSync(bunPath, ["install", "--ignore-scripts"], {
+    cwd: installDir,
+    stdio: "inherit",
+    env: envWithBunPath(process.env),
+  });
+
+  if (result.error || result.status !== 0) {
+    const detail =
+      result.error?.message ?? `bun install exited with code ${result.status}`;
+    throw new Error(`Local runtime install failed: ${detail}`);
+  }
+
+  if (!hasLocalRuntimeComponents(installDir)) {
+    throw new Error(
+      `Local runtime install at ${installDir} is missing assistant, gateway, or credential-executor packages.`,
+    );
+  }
+
+  return { version: displayVersion, installDir };
+}
 
 /**
  * Warn when an assistant appears to have legacy data in the global workspace.
@@ -190,7 +351,14 @@ function findGatewaySourceFromCwd(): string | undefined {
   }
 }
 
-function resolveAssistantIndexPath(): string | undefined {
+function resolveAssistantIndexPath(
+  resources?: LocalInstanceResources,
+): string | undefined {
+  if (resources) {
+    const runtimeIndex = localRuntimeAssistantIndex(resources);
+    if (runtimeIndex) return runtimeIndex;
+  }
+
   // Source tree layout: cli/src/lib/ -> ../../.. -> repo root -> assistant/src/index.ts
   const sourceTreeIndex = join(
     import.meta.dir,
@@ -246,16 +414,10 @@ function resolveAssistantIndexPath(): string | undefined {
 }
 
 function ensureBunInstalled(): void {
-  const bunBinDir = join(homedir(), ".bun", "bin");
-  const pathWithBun = [
-    bunBinDir,
-    process.env.PATH || "/usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin",
-  ].join(":");
-
   try {
-    execFileSync("bun", ["--version"], {
+    execFileSync(resolveBunExecutable(), ["--version"], {
       stdio: "pipe",
-      env: { ...process.env, PATH: pathWithBun },
+      env: envWithBunPath(process.env),
     });
     return;
   } catch {
@@ -418,17 +580,19 @@ async function startDaemonFromSource(
   // detect the in-progress spawn and wait instead of racing.
   writeFileSync(pidFile, "starting", "utf-8");
 
+  const bunPath = resolveBunExecutable();
+  const spawnEnv = envWithBunPath(env);
   const child = foreground
-    ? spawn(process.execPath, ["run", daemonMainPath], {
+    ? spawn(bunPath, ["run", daemonMainPath], {
         stdio: "inherit",
-        env,
+        env: spawnEnv,
       })
     : (() => {
         const daemonLogFd = openLogFile("hatch.log");
-        const c = spawn(process.execPath, ["run", daemonMainPath], {
+        const c = spawn(bunPath, ["run", daemonMainPath], {
           detached: true,
           stdio: ["ignore", "pipe", "pipe"],
-          env,
+          env: spawnEnv,
         });
         pipeToLogFile(c, daemonLogFd, "daemon");
         c.unref();
@@ -489,10 +653,10 @@ async function startDaemonWatchFromSource(
   writeFileSync(pidFile, "starting", "utf-8");
 
   const daemonLogFd = openLogFile("hatch.log");
-  const child = spawn(process.execPath, ["--watch", "run", mainPath], {
+  const child = spawn(resolveBunExecutable(), ["--watch", "run", mainPath], {
     detached: true,
     stdio: ["ignore", "pipe", "pipe"],
-    env,
+    env: envWithBunPath(env),
   });
   pipeToLogFile(child, daemonLogFd, "daemon");
   child.unref();
@@ -510,7 +674,10 @@ async function startDaemonWatchFromSource(
   console.log("   Assistant started in watch mode (bun --watch)");
 }
 
-function resolveGatewayDir(): string {
+function resolveGatewayDir(resources?: LocalInstanceResources): string {
+  const runtimeGatewayDir = localRuntimeGatewayDir(resources);
+  if (runtimeGatewayDir) return runtimeGatewayDir;
+
   // Source tree: cli/src/lib/ → ../../.. → repo root → gateway/
   const sourceDir = join(import.meta.dir, "..", "..", "..", "gateway");
   if (isGatewaySourceDir(sourceDir)) {
@@ -883,6 +1050,16 @@ export async function startLocalDaemon(
   warnIfLegacyWorkspaceFallbackDetected(resources);
   writeAssistantWrapper(resources);
 
+  const runtimeAssistantIndex = !watch
+    ? localRuntimeAssistantIndex(resources)
+    : undefined;
+  if (runtimeAssistantIndex) {
+    console.log("🔨 Starting local assistant runtime...");
+    await startDaemonFromSource(runtimeAssistantIndex, resources, options);
+    logDaemonReadiness(await waitForDaemonReady(resources.daemonPort, 60000));
+    return;
+  }
+
   const foreground = options?.foreground ?? false;
   // Check for a compiled daemon binary adjacent to the CLI executable.
   // This covers both the desktop app (VELLUM_DESKTOP_APP) and the case where
@@ -1020,7 +1197,7 @@ export async function startLocalDaemon(
     // Dev fallback: if the bundled daemon did not become ready in time,
     // fall back to source daemon startup so local source runs still work.
     if (!daemonReady) {
-      const assistantIndex = resolveAssistantIndexPath();
+      const assistantIndex = resolveAssistantIndexPath(resources);
       if (assistantIndex) {
         console.log(
           "   Bundled assistant not ready after 60s — falling back to source assistant...",
@@ -1040,7 +1217,7 @@ export async function startLocalDaemon(
   } else {
     console.log("🔨 Starting local assistant...");
 
-    const assistantIndex = resolveAssistantIndexPath();
+    const assistantIndex = resolveAssistantIndexPath(resources);
     if (!assistantIndex) {
       throw new Error(
         "vellum-daemon binary not found and assistant source not available.\n" +
@@ -1137,8 +1314,11 @@ export async function startGateway(
 
   let gateway;
 
+  const runtimeGatewayDir = !watch
+    ? localRuntimeGatewayDir(resources)
+    : undefined;
   const gatewayBinary = join(dirname(process.execPath), "vellum-gateway");
-  if (existsSync(gatewayBinary) && !watch) {
+  if (!runtimeGatewayDir && existsSync(gatewayBinary) && !watch) {
     // Use the compiled gateway binary when available (desktop app or compiled
     // CLI invoked from the terminal). In watch mode, skip the bundled binary
     // and use source (bun --watch only works with source files).
@@ -1151,16 +1331,16 @@ export async function startGateway(
     pipeToLogFile(gateway, gatewayLogFd, "gateway");
   } else {
     // Source tree / bunx: resolve the gateway source directory and run via bun.
-    const gatewayDir = resolveGatewayDir();
+    const gatewayDir = runtimeGatewayDir ?? resolveGatewayDir(resources);
     const bunArgs = watch
       ? ["--watch", "run", "src/index.ts", "--vellum-gateway"]
       : ["run", "src/index.ts", "--vellum-gateway"];
     const gwLogFd = openLogFile("hatch.log");
-    gateway = spawn(process.execPath, bunArgs, {
+    gateway = spawn(resolveBunExecutable(), bunArgs, {
       cwd: gatewayDir,
       detached: true,
       stdio: ["ignore", "pipe", "pipe"],
-      env: gatewayEnv,
+      env: envWithBunPath(gatewayEnv),
     });
     pipeToLogFile(gateway, gwLogFd, "gateway");
     if (watch) {

package/src/lib/terminal-session.ts

@@ -6,7 +6,7 @@
  * resolver without cross-importing commands (per cli/CONTRIBUTING.md).
  */
 
-import { resolveAssistant, resolveCloud } from "./assistant-config.js";
+import { resolveAssistant } from "./assistant-config.js";
 import { getPlatformUrl, readPlatformToken } from "./platform-client.js";
 import {
   closeTerminalSession,
@@ -49,7 +49,7 @@ export function resolveManagedAssistant(
     process.exit(1);
   }
 
-  const cloud = resolveCloud(entry);
+  const cloud = entry.cloud;
   if (cloud !== "vellum") {
     if (cloud === "local") {
       console.error(

package/src/lib/upgrade-lifecycle.ts

@@ -66,10 +66,14 @@ export async function captureUpgradeFailureLogs(
         // stream (docker logs writes container stdout→stdout, stderr→stderr)
         // are preserved in a single file. spawnSync avoids the execOutput
         // limitation of returning only stdout on success.
-        const result = spawnSync("docker", ["logs", "--tail", "500", container], {
-          encoding: "utf8",
-          maxBuffer: 10 * 1024 * 1024, // 10 MB
-        });
+        const result = spawnSync(
+          "docker",
+          ["logs", "--tail", "500", container],
+          {
+            encoding: "utf8",
+            maxBuffer: 10 * 1024 * 1024, // 10 MB
+          },
+        );
         const output = [result.stdout, result.stderr].filter(Boolean).join("");
         if (output) writeFileSync(join(logDir, filename), output);
       } catch {
@@ -127,7 +131,7 @@ export function buildUpgradeCommitMessage(options: {
   phase: "starting" | "complete";
   from: string;
   to: string;
-  topology: "docker" | "managed";
+  topology: "docker" | "local" | "managed";
   assistantId: string;
   result?: "success" | "failure";
 }): string {
@@ -300,10 +304,13 @@ export async function fetchAssistantIngressUrl(
 ): Promise<string | undefined> {
   if (!bearerToken) return undefined;
   try {
-    const resp = await loopbackSafeFetch(`${runtimeUrl}/integrations/ingress/config`, {
-      headers: { Authorization: `Bearer ${bearerToken}` },
-      signal: AbortSignal.timeout(5000),
-    });
+    const resp = await loopbackSafeFetch(
+      `${runtimeUrl}/integrations/ingress/config`,
+      {
+        headers: { Authorization: `Bearer ${bearerToken}` },
+        signal: AbortSignal.timeout(5000),
+      },
+    );
     if (resp.ok) {
       const body = (await resp.json()) as {
         publicBaseUrl?: string;
@@ -483,12 +490,15 @@ export async function rollbackMigrations(
       body.targetWorkspaceMigrationId = targetWorkspaceMigrationId;
     if (rollbackToRegistryCeiling) body.rollbackToRegistryCeiling = true;
 
-    const resp = await loopbackSafeFetch(`${gatewayUrl}/v1/admin/rollback-migrations`, {
-      method: "POST",
-      headers,
-      body: JSON.stringify(body),
-      signal: AbortSignal.timeout(120_000),
-    });
+    const resp = await loopbackSafeFetch(
+      `${gatewayUrl}/v1/admin/rollback-migrations`,
+      {
+        method: "POST",
+        headers,
+        body: JSON.stringify(body),
+        signal: AbortSignal.timeout(120_000),
+      },
+    );
     if (!resp.ok) {
       const text = await resp.text();
       console.warn(`⚠️  Migration rollback failed (${resp.status}): ${text}`);
@@ -812,7 +822,10 @@ export async function performDockerRollback(
     // Failure path — attempt auto-rollback to original version
     console.error(`\n❌ Containers failed to become ready within the timeout.`);
 
-    const logDir = await captureUpgradeFailureLogs(res, `${instanceName}-rollback-failure`);
+    const logDir = await captureUpgradeFailureLogs(
+      res,
+      `${instanceName}-rollback-failure`,
+    );
     if (logDir) {
       console.log(`📋 Container logs saved to: ${logDir}`);
     }

package/src/shared/provider-env-vars.ts

@@ -28,6 +28,7 @@ export const LLM_PROVIDER_ENV_VAR_NAMES: Record<string, string> = {
   openrouter: "OPENROUTER_API_KEY",
   minimax: "MINIMAX_API_KEY",
   atlascloud: "ATLASCLOUD_API_KEY",
+  together: "TOGETHER_API_KEY",
 };
 
 /** Search-provider env var names. Mirrors `SEARCH_PROVIDER_CATALOG` BYOK entries. */