@vellumai/cli 0.10.11-dev.202607242034.78fd032 → 0.10.11-staging.1

package/src/lib/local.ts

@@ -105,7 +105,7 @@ function hasLocalRuntimeComponents(installDir: string): boolean {
  * (`assistant`, `credential-executor`) collide with app-bundle binary names
  * and point at whatever version happens to be installed globally.
  */
-export function isCompiledCli(): boolean {
+function isCompiledCli(): boolean {
   const execBase = basename(process.execPath);
   return (
     execBase !== "bun" && execBase !== "bunx" && !execBase.startsWith("bun-")
@@ -548,7 +548,6 @@ export function generateLocalSigningKey(): string {
 type DaemonStartOptions = {
   foreground?: boolean;
   defaultWorkspaceConfigPath?: string;
-  requireReady?: boolean;
   signingKey?: string;
 };
 
@@ -598,10 +597,7 @@ function applyDaemonEnvOverrides(
   applyIpcSocketDirOverride(env);
 }
 
-function logDaemonReadiness(
-  readiness: DaemonReadiness,
-  requireReady = false,
-): void {
+function logDaemonReadiness(readiness: DaemonReadiness): void {
   switch (readiness) {
     case "ready":
       console.log("   Assistant ready\n");
@@ -617,11 +613,6 @@ function logDaemonReadiness(
       );
       break;
     default:
-      if (requireReady) {
-        throw new Error(
-          "Assistant did not bind its local port within 60 seconds.",
-        );
-      }
       console.log(
         "   ⚠️  Assistant did not become ready within 60s — continuing anyway\n",
       );
@@ -1329,7 +1320,6 @@ export async function startLocalDaemon(
           resources.daemonPort,
           Date.now() + 60000,
         ),
-        options?.requireReady,
       );
     }
     return;
@@ -1372,7 +1362,6 @@ export async function startLocalDaemon(
         // classifies it without blocking on an in-flight migration.
         logDaemonReadiness(
           await probeDaemonReadinessWithRetry(resources.daemonPort),
-          options?.requireReady,
         );
         return;
       }
@@ -1524,7 +1513,7 @@ export async function startLocalDaemon(
         readiness = await probeDaemonReadiness(resources.daemonPort);
       }
 
-      logDaemonReadiness(readiness, options?.requireReady);
+      logDaemonReadiness(readiness);
     }
   } else {
     console.log("🔨 Starting local assistant...");
@@ -1546,7 +1535,6 @@ export async function startLocalDaemon(
           resources.daemonPort,
           Date.now() + 60000,
         ),
-        options?.requireReady,
       );
     }
   }
@@ -1559,7 +1547,6 @@ export async function startGateway(
     signingKey?: string;
     bootstrapSecret?: string;
     envOverrides?: Record<string, string>;
-    requireReady?: boolean;
   },
 ): Promise<string> {
   const effectiveGatewayPort = resources?.gatewayPort ?? GATEWAY_PORT;
@@ -1689,11 +1676,6 @@ export async function startGateway(
   // connection-refused errors.
   const ready = await waitForDaemonReady(effectiveGatewayPort, 30000);
   if (!ready) {
-    if (options?.requireReady) {
-      throw new Error(
-        "Assistant gateway did not bind its local port within 30 seconds.",
-      );
-    }
     console.warn(
       "⚠ Gateway started but health check did not respond within 30s",
     );

package/src/lib/loopback-fetch.ts

@@ -6,7 +6,7 @@
  * connection per request; remote hosts are unaffected.
  */
 
-export function isLoopbackUrl(url: string): boolean {
+function isLoopbackUrl(url: string): boolean {
   try {
     // WHATWG URL canonicalizes hostnames, so IPv6 loopback is always "[::1]".
     const h = new URL(url).hostname;

package/src/lib/nginx-ingress.ts

@@ -17,8 +17,6 @@ import { createRequire } from "node:module";
 import { dirname, join } from "node:path";
 
 import { GATEWAY_PORT } from "./constants.js";
-import { waitForDaemonReady } from "./http-client.js";
-import { loadRawConfig, saveRawConfig } from "./ingress-config.js";
 
 /**
  * CLI-managed nginx reverse proxy that fronts the gateway for remote web
@@ -60,6 +58,28 @@ export function getIngressPaths(workspaceDir: string): IngressPaths {
   };
 }
 
+function getConfigPath(workspaceDir: string): string {
+  return join(workspaceDir, "config.json");
+}
+
+function loadRawConfig(workspaceDir: string): Record<string, unknown> {
+  const configPath = getConfigPath(workspaceDir);
+  if (!existsSync(configPath)) return {};
+  return JSON.parse(readFileSync(configPath, "utf-8")) as Record<
+    string,
+    unknown
+  >;
+}
+
+function saveRawConfig(
+  workspaceDir: string,
+  config: Record<string, unknown>,
+): void {
+  const configPath = getConfigPath(workspaceDir);
+  mkdirSync(dirname(configPath), { recursive: true });
+  writeFileSync(configPath, JSON.stringify(config, null, 2) + "\n");
+}
+
 /**
  * Locate the pre-built @vellumai/web dist directory.
  *
@@ -210,13 +230,6 @@ http {
     listen 127.0.0.1:${opts.listenPort};
     client_max_body_size 512m;
 
-    # This edge sits behind a TLS-terminating front (tunnel or tailscale serve),
-    # so redirects must be relative: emit "Location: /assistant/" and let the
-    # client resolve it against the origin it used, rather than an absolute URL
-    # built from nginx's own loopback scheme and port.
-    absolute_redirect off;
-    port_in_redirect off;
-
 ${serverLocations}
   }
 }
@@ -541,95 +554,6 @@ export async function stopIngressNginx(workspaceDir: string): Promise<boolean> {
   return true;
 }
 
-/** Probe budget for confirming the freshly-spawned edge answers /healthz. */
-export const INGRESS_READY_TIMEOUT_MS = 5_000;
-
-/**
- * Outcome of an attempt to bring up the remote-web nginx ingress edge. Callers
- * render their own messaging per variant: `nginx-ingress up` prints
- * install/build guidance and exits non-zero, while the wake restore path warns
- * and continues.
- */
-export type StartRemoteWebIngressResult =
-  | {
-      status: "started";
-      listenPort: number;
-      webDistDir: string;
-      version: string;
-    }
-  | { status: "already-running"; listenPort: number }
-  | { status: "nginx-missing" }
-  | { status: "web-dist-missing" }
-  | { status: "unreachable"; listenPort: number; logPath: string };
-
-/**
- * Generate the nginx config and start the remote-web ingress edge, then probe
- * /healthz through it to prove the ingress → gateway path is live. A spawned
- * but unreachable nginx is rolled back so a failed attempt leaves no half-up
- * edge behind.
- *
- * Pure mechanism: it performs no console output and never exits the process, so
- * both the `nginx-ingress up` command and the wake restore path can share one
- * implementation and map the returned result to their own UX.
- */
-export async function startRemoteWebIngress(opts: {
-  workspaceDir: string;
-  gatewayPort: number;
-  listenPort?: number;
-  readyTimeoutMs?: number;
-  /**
-   * Invoked once, after every preflight check passes and immediately before
-   * nginx is spawned, so callers can emit their own "starting" progress line
-   * with the resolved version/dist/port. Never fires on a preflight bail-out
-   * (nginx-missing, already-running, web-dist-missing).
-   */
-  onStarting?: (info: {
-    version: string;
-    webDistDir: string;
-    listenPort: number;
-  }) => void;
-}): Promise<StartRemoteWebIngressResult> {
-  const listenPort = opts.listenPort ?? getNginxIngressPort();
-
-  const version = getNginxVersion();
-  if (!version) {
-    return { status: "nginx-missing" };
-  }
-
-  if (isIngressRunning(opts.workspaceDir)) {
-    return { status: "already-running", listenPort };
-  }
-
-  const webDistDir = findWebDistDir();
-  if (!webDistDir) {
-    return { status: "web-dist-missing" };
-  }
-
-  opts.onStarting?.({ version, webDistDir, listenPort });
-
-  const child = startIngressNginx({
-    workspaceDir: opts.workspaceDir,
-    gatewayPort: opts.gatewayPort,
-    listenPort,
-    remoteWebIngress: { webDistDir },
-  });
-  child.unref();
-
-  // /healthz proxies through nginx to the gateway, so a 200 proves the whole
-  // ingress → gateway path works.
-  const ready = await waitForDaemonReady(
-    listenPort,
-    opts.readyTimeoutMs ?? INGRESS_READY_TIMEOUT_MS,
-  );
-  if (!ready) {
-    const { logPath } = getIngressPaths(opts.workspaceDir);
-    await stopIngressNginx(opts.workspaceDir);
-    return { status: "unreachable", listenPort, logPath };
-  }
-
-  return { status: "started", listenPort, webDistDir, version };
-}
-
 /**
  * Resolve the local port a tunnel should target: the nginx ingress when it is
  * recorded AND its process is alive, otherwise the gateway port directly

package/src/lib/ngrok.ts

@@ -1,17 +1,49 @@
 import { execFileSync, spawn, type ChildProcess } from "node:child_process";
-import { closeSync, existsSync, mkdirSync, openSync } from "node:fs";
+import {
+  closeSync,
+  existsSync,
+  mkdirSync,
+  openSync,
+  readFileSync,
+  writeFileSync,
+} from "node:fs";
+import { homedir } from "node:os";
 import { dirname, join } from "node:path";
 
 import { GATEWAY_PORT } from "./constants.js";
-import {
-  clearIngressUrl,
-  getDefaultWorkspaceDir,
-  loadRawConfig,
-  saveIngressUrl,
-} from "./ingress-config.js";
 import { loopbackSafeFetch } from "./loopback-fetch.js";
 import { resolveTunnelTargetPort } from "./nginx-ingress.js";
 
+function getDefaultWorkspaceDir(): string {
+  return (
+    process.env.VELLUM_WORKSPACE_DIR?.trim() ||
+    join(homedir(), ".vellum", "workspace")
+  );
+}
+
+function getConfigPath(workspaceDir: string): string {
+  return join(workspaceDir, "config.json");
+}
+
+function loadRawConfig(workspaceDir: string): Record<string, unknown> {
+  const configPath = getConfigPath(workspaceDir);
+  if (!existsSync(configPath)) return {};
+  return JSON.parse(readFileSync(configPath, "utf-8")) as Record<
+    string,
+    unknown
+  >;
+}
+
+function saveRawConfig(
+  workspaceDir: string,
+  config: Record<string, unknown>,
+): void {
+  const configPath = getConfigPath(workspaceDir);
+  const dir = dirname(configPath);
+  if (!existsSync(dir)) mkdirSync(dir, { recursive: true });
+  writeFileSync(configPath, JSON.stringify(config, null, 2) + "\n");
+}
+
 const NGROK_API_URL = "http://127.0.0.1:4040/api/tunnels";
 const NGROK_POLL_INTERVAL_MS = 500;
 const NGROK_POLL_TIMEOUT_MS = 15_000;
@@ -158,6 +190,29 @@ export async function waitForNgrokUrl(
   );
 }
 
+/**
+ * Persist a public ingress URL to the workspace config and enable ingress.
+ */
+function saveIngressUrl(workspaceDir: string, publicUrl: string): void {
+  const config = loadRawConfig(workspaceDir);
+  const ingress = (config.ingress ?? {}) as Record<string, unknown>;
+  ingress.publicBaseUrl = publicUrl;
+  ingress.enabled = true;
+  config.ingress = ingress;
+  saveRawConfig(workspaceDir, config);
+}
+
+/**
+ * Clear the ingress public base URL from the workspace config.
+ */
+function clearIngressUrl(workspaceDir: string): void {
+  const config = loadRawConfig(workspaceDir);
+  const ingress = (config.ingress ?? {}) as Record<string, unknown>;
+  delete ingress.publicBaseUrl;
+  config.ingress = ingress;
+  saveRawConfig(workspaceDir, config);
+}
+
 /**
  * Check whether any webhook-based integrations (e.g. Telegram, Twilio) are
  * configured that require a public ingress URL.
@@ -257,8 +312,6 @@ export interface RunNgrokTunnelOptions {
   workspaceDir?: string;
   /** Prefer nginx ingress over the gateway port when it is running. */
   preferNginxIngress?: boolean;
-  /** Lockfile entry to mirror the ingress URL onto (`ingressUrl`). */
-  assistantId?: string;
 }
 
 /**
@@ -302,7 +355,7 @@ export async function runNgrokTunnel(
   const existingUrl = await findExistingTunnel(port);
   if (existingUrl) {
     console.log(`Found existing ngrok tunnel: ${existingUrl}`);
-    saveIngressUrl(workspaceDir, existingUrl, opts.assistantId);
+    saveIngressUrl(workspaceDir, existingUrl);
     console.log("Ingress URL saved to config.");
     console.log("");
     console.log(
@@ -329,7 +382,7 @@ export async function runNgrokTunnel(
     }
     if (publicUrl) {
       console.log("\nClearing ingress URL from config...");
-      clearIngressUrl(workspaceDir, opts.assistantId);
+      clearIngressUrl(workspaceDir);
     }
   };
 
@@ -378,7 +431,7 @@ export async function runNgrokTunnel(
   console.log(`Tunnel established: ${publicUrl}`);
   console.log(`Forwarding to:     localhost:${port}`);
 
-  saveIngressUrl(workspaceDir, publicUrl, opts.assistantId);
+  saveIngressUrl(workspaceDir, publicUrl);
   console.log("Ingress URL saved to config.");
   console.log("");
   console.log("Press Ctrl+C to stop the tunnel and clear the ingress URL.");

package/src/lib/retire-apple-container.ts

@@ -13,9 +13,7 @@ export async function retireAppleContainer(
   name: string,
   entry: AssistantEntry,
 ): Promise<void> {
-  console.log(
-    `\u{1F5D1}\ufe0f  Retiring Apple Container assistant '${name}'...\n`,
-  );
+  console.log(`\u{1F5D1}\ufe0f  Retiring Apple Container assistant '${name}'...\n`);
 
   const mgmtSocket = entry.mgmtSocket as string | undefined;
   if (!mgmtSocket) {
@@ -48,9 +46,7 @@ export async function retireAppleContainer(
 
     socket.setTimeout(TIMEOUT_MS);
     socket.on("timeout", () => {
-      console.error(
-        "Timed out waiting for retire response from the macOS app.",
-      );
+      console.error("Timed out waiting for retire response from the macOS app.");
       socket.destroy();
       process.exit(1);
     });
@@ -81,7 +77,9 @@ export async function retireAppleContainer(
         resolve();
       } else {
         reject(
-          new Error(`Retire failed: ${response.message || "unknown error"}`),
+          new Error(
+            `Retire failed: ${response.message || "unknown error"}`,
+          ),
         );
       }
     });

package/src/lib/upgrade-preflight.ts

@@ -56,14 +56,16 @@ export function resolveUpgradeTarget(args: {
         isDowngrade: false,
       };
     }
-    target = (releases.find((r) => r.is_stable !== false) ?? releases[0])
-      .version;
+    target =
+      (releases.find((r) => r.is_stable !== false) ?? releases[0]).version;
   }
 
   const comparison = currentVersion
     ? compareVersions(target, currentVersion)
     : null;
-  const isNoOp = currentVersion ? versionsEqual(target, currentVersion) : false;
+  const isNoOp = currentVersion
+    ? versionsEqual(target, currentVersion)
+    : false;
 
   return {
     kind: "ok",
@@ -97,13 +99,8 @@ export interface UpgradePollState {
 export function evaluateUpgradePoll(
   state: UpgradePollState,
 ): "pending" | "complete" {
-  const {
-    targetVersion,
-    initialVersion,
-    observedVersion,
-    inProgress,
-    sawInProgress,
-  } = state;
+  const { targetVersion, initialVersion, observedVersion, inProgress, sawInProgress } =
+    state;
 
   if (targetVersion) {
     return observedVersion && versionsEqual(observedVersion, targetVersion)

package/node_modules/@vellumai/service-contracts/node_modules/zod/LICENSE

@@ -1,21 +0,0 @@
-MIT License
-
-Copyright (c) 2025 Colin McDonnell
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.

package/node_modules/@vellumai/service-contracts/node_modules/zod/README.md

@@ -1,208 +0,0 @@
-<p align="center">
-  <img src="logo.svg" width="200px" align="center" alt="Zod logo" />
-  <h1 align="center">Zod</h1>
-  <p align="center">
-    TypeScript-first schema validation with static type inference
-    <br/>
-    by <a href="https://x.com/colinhacks">@colinhacks</a>
-  </p>
-</p>
-<br/>
-
-<p align="center">
-<a href="https://github.com/colinhacks/zod/actions?query=branch%3Amain"><img src="https://github.com/colinhacks/zod/actions/workflows/test.yml/badge.svg?event=push&branch=main" alt="Zod CI status" /></a>
-<a href="https://opensource.org/licenses/MIT" rel="nofollow"><img src="https://img.shields.io/github/license/colinhacks/zod" alt="License"></a>
-<a href="https://www.npmjs.com/package/zod" rel="nofollow"><img src="https://img.shields.io/npm/dw/zod.svg" alt="npm"></a>
-<a href="https://discord.gg/KaSRdyX2vc" rel="nofollow"><img src="https://img.shields.io/discord/893487829802418277?label=Discord&logo=discord&logoColor=white" alt="discord server"></a>
-<a href="https://github.com/colinhacks/zod" rel="nofollow"><img src="https://img.shields.io/github/stars/colinhacks/zod" alt="stars"></a>
-</p>
-
-<div align="center">
-  <a href="https://zod.dev/api">Docs</a>
-  <span>&nbsp;&nbsp;•&nbsp;&nbsp;</span>
-  <a href="https://discord.gg/RcG33DQJdf">Discord</a>
-  <span>&nbsp;&nbsp;•&nbsp;&nbsp;</span>
-  <a href="https://twitter.com/colinhacks">𝕏</a>
-  <span>&nbsp;&nbsp;•&nbsp;&nbsp;</span>
-  <a href="https://bsky.app/profile/zod.dev">Bluesky</a>
-  <br />
-</div>
-
-<br/>
-<br/>
-
-<h2 align="center">Featured sponsor: Jazz</h2>
-
-<div align="center">
-  <a href="https://jazz.tools/?utm_source=zod">
-    <picture width="85%" >
-      <source media="(prefers-color-scheme: dark)" srcset="https://raw.githubusercontent.com/garden-co/jazz/938f6767e46cdfded60e50d99bf3b533f4809c68/homepage/homepage/public/Zod%20sponsor%20message.png">
-      <img alt="jazz logo" src="https://raw.githubusercontent.com/garden-co/jazz/938f6767e46cdfded60e50d99bf3b533f4809c68/homepage/homepage/public/Zod%20sponsor%20message.png" width="85%">
-    </picture>
-  </a>
-  <br/>
-  <p><sub>Learn more about <a target="_blank" rel="noopener noreferrer" href="mailto:sponsorship@colinhacks.com">featured sponsorships</a></sub></p>
-</div>
-
-<br/>
-<br/>
-<br/>
-
-### [Read the docs →](https://zod.dev/api)
-
-<br/>
-<br/>
-
-## What is Zod?
-
-Zod is a TypeScript-first validation library. Define a schema and parse some data with it. You'll get back a strongly typed, validated result.
-
-```ts
-import * as z from "zod";
-
-const User = z.object({
-  name: z.string(),
-});
-
-// some untrusted data...
-const input = {
-  /* stuff */
-};
-
-// the parsed result is validated and type safe!
-const data = User.parse(input);
-
-// so you can use it with confidence :)
-console.log(data.name);
-```
-
-<br/>
-
-## Features
-
-- Zero external dependencies
-- Works in Node.js and all modern browsers
-- Tiny: `2kb` core bundle (gzipped)
-- Immutable API: methods return a new instance
-- Concise interface
-- Works with TypeScript and plain JS
-- Built-in JSON Schema conversion
-- Extensive ecosystem
-
-<br/>
-
-## Installation
-
-```sh
-npm install zod
-```
-
-<br/>
-
-## Basic usage
-
-Before you can do anything else, you need to define a schema. For the purposes of this guide, we'll use a simple object schema.
-
-```ts
-import * as z from "zod";
-
-const Player = z.object({
-  username: z.string(),
-  xp: z.number(),
-});
-```
-
-### Parsing data
-
-Given any Zod schema, use `.parse` to validate an input. If it's valid, Zod returns a strongly-typed _deep clone_ of the input.
-
-```ts
-Player.parse({ username: "billie", xp: 100 });
-// => returns { username: "billie", xp: 100 }
-```
-
-**Note** — If your schema uses certain asynchronous APIs like `async` [refinements](https://zod.dev/api#refinements) or [transforms](https://zod.dev/api#transforms), you'll need to use the `.parseAsync()` method instead.
-
-```ts
-const schema = z.string().refine(async (val) => val.length <= 8);
-
-await schema.parseAsync("hello");
-// => "hello"
-```
-
-### Handling errors
-
-When validation fails, the `.parse()` method will throw a `ZodError` instance with granular information about the validation issues.
-
-```ts
-try {
-  Player.parse({ username: 42, xp: "100" });
-} catch (err) {
-  if (err instanceof z.ZodError) {
-    err.issues;
-    /* [
-      {
-        expected: 'string',
-        code: 'invalid_type',
-        path: [ 'username' ],
-        message: 'Invalid input: expected string'
-      },
-      {
-        expected: 'number',
-        code: 'invalid_type',
-        path: [ 'xp' ],
-        message: 'Invalid input: expected number'
-      }
-    ] */
-  }
-}
-```
-
-To avoid a `try/catch` block, you can use the `.safeParse()` method to get back a plain result object containing either the successfully parsed data or a `ZodError`. The result type is a [discriminated union](https://www.typescriptlang.org/docs/handbook/2/narrowing.html#discriminated-unions), so you can handle both cases conveniently.
-
-```ts
-const result = Player.safeParse({ username: 42, xp: "100" });
-if (!result.success) {
-  result.error; // ZodError instance
-} else {
-  result.data; // { username: string; xp: number }
-}
-```
-
-**Note** — If your schema uses certain asynchronous APIs like `async` [refinements](#refine) or [transforms](#transform), you'll need to use the `.safeParseAsync()` method instead.
-
-```ts
-const schema = z.string().refine(async (val) => val.length <= 8);
-
-await schema.safeParseAsync("hello");
-// => { success: true; data: "hello" }
-```
-
-### Inferring types
-
-Zod infers a static type from your schema definitions. You can extract this type with the `z.infer<>` utility and use it however you like.
-
-```ts
-const Player = z.object({
-  username: z.string(),
-  xp: z.number(),
-});
-
-// extract the inferred type
-type Player = z.infer<typeof Player>;
-
-// use it in your code
-const player: Player = { username: "billie", xp: 100 };
-```
-
-In some cases, the input & output types of a schema can diverge. For instance, the `.transform()` API can convert the input from one type to another. In these cases, you can extract the input and output types independently:
-
-```ts
-const mySchema = z.string().transform((val) => val.length);
-
-type MySchemaIn = z.input<typeof mySchema>;
-// => string
-
-type MySchemaOut = z.output<typeof mySchema>; // equivalent to z.infer<typeof mySchema>
-// number
-```