@vellumai/cli 0.10.11-dev.202607242127.a6bf2b2 → 0.10.11-staging.2

package/src/lib/local-hatch-lock.ts

@@ -1,322 +0,0 @@
-import { execFileSync } from "child_process";
-import { createHash, randomUUID } from "crypto";
-import {
-  closeSync,
-  mkdirSync,
-  openSync,
-  readFileSync,
-  statSync,
-  unlinkSync,
-  utimesSync,
-  writeFileSync,
-} from "fs";
-import { hostname, userInfo } from "os";
-import { dirname, join } from "path";
-
-const DEFAULT_TIMEOUT_MS = 240_000;
-const DEFAULT_RETRY_MS = 100;
-const MAX_LOCK_AGE_MS = DEFAULT_TIMEOUT_MS - 60_000;
-const HEARTBEAT_INTERVAL_MS = 30_000;
-const LIVE_OWNER_RECOVERY_GRACE_MS = 10_000;
-
-interface LocalHatchLockOptions {
-  lockPath?: string;
-  liveOwnerRecoveryGraceMs?: number;
-  timeoutMs?: number;
-  retryMs?: number;
-}
-
-interface LockOwner {
-  pid: number;
-  processStartedAt?: string;
-  token: string;
-}
-
-interface LockSnapshot {
-  owner?: LockOwner;
-  signature: string;
-}
-
-export function resolveLocalHatchLockPath(): string {
-  const machineKey = createHash("sha256")
-    .update(hostname())
-    .digest("hex")
-    .slice(0, 12);
-  return join(
-    userInfo().homedir,
-    ".cache",
-    "vellum",
-    "runtime",
-    machineKey,
-    "local-hatch.lock",
-  );
-}
-
-function processIsAlive(pid: number): boolean {
-  try {
-    process.kill(pid, 0);
-    return true;
-  } catch (error) {
-    return (error as NodeJS.ErrnoException).code === "EPERM";
-  }
-}
-
-function processStartedAt(pid: number): string | undefined {
-  try {
-    const value = execFileSync("ps", ["-o", "lstart=", "-p", String(pid)], {
-      encoding: "utf-8",
-      stdio: ["ignore", "pipe", "ignore"],
-      timeout: 1_000,
-    }).trim();
-    return value || undefined;
-  } catch {
-    return undefined;
-  }
-}
-
-function parseOwner(raw: string): LockOwner | undefined {
-  try {
-    const parsed = JSON.parse(raw) as {
-      pid?: unknown;
-      processStartedAt?: unknown;
-      token?: unknown;
-    };
-    if (
-      typeof parsed.pid === "number" &&
-      Number.isInteger(parsed.pid) &&
-      parsed.pid > 0 &&
-      typeof parsed.token === "string" &&
-      parsed.token.length > 0
-    ) {
-      return {
-        pid: parsed.pid,
-        processStartedAt:
-          typeof parsed.processStartedAt === "string" &&
-          parsed.processStartedAt.length > 0
-            ? parsed.processStartedAt
-            : undefined,
-        token: parsed.token,
-      };
-    }
-  } catch {}
-  return undefined;
-}
-
-function readSnapshot(path: string): LockSnapshot | undefined {
-  try {
-    const raw = readFileSync(path, "utf-8");
-    return {
-      owner: parseOwner(raw),
-      signature: createHash("sha256").update(raw).digest("hex"),
-    };
-  } catch {
-    return undefined;
-  }
-}
-
-function readOwner(path: string): LockOwner | undefined {
-  return readSnapshot(path)?.owner;
-}
-
-function fileAgeMs(path: string): number | undefined {
-  try {
-    return Date.now() - statSync(path).mtimeMs;
-  } catch {
-    return undefined;
-  }
-}
-
-const expiredLiveOwners = new Map<string, number>();
-
-function ownerIsActive(
-  path: string,
-  owner: LockOwner | undefined,
-  liveOwnerRecoveryGraceMs: number,
-): boolean {
-  const ageMs = fileAgeMs(path);
-  if (!owner) {
-    return ageMs !== undefined && ageMs < MAX_LOCK_AGE_MS;
-  }
-  if (!processIsAlive(owner.pid)) {
-    return false;
-  }
-  if (owner.processStartedAt) {
-    const currentStartedAt = processStartedAt(owner.pid);
-    if (currentStartedAt) {
-      expiredLiveOwners.delete(owner.token);
-      return currentStartedAt === owner.processStartedAt;
-    }
-  }
-  if (ageMs !== undefined && ageMs < MAX_LOCK_AGE_MS) {
-    expiredLiveOwners.delete(owner.token);
-    return true;
-  }
-
-  const firstExpiredAt = expiredLiveOwners.get(owner.token) ?? Date.now();
-  expiredLiveOwners.set(owner.token, firstExpiredAt);
-  if (Date.now() - firstExpiredAt < liveOwnerRecoveryGraceMs) {
-    return true;
-  }
-  return false;
-}
-
-function writeOwnerFile(path: string, owner: LockOwner): void {
-  const fd = openSync(path, "wx", 0o600);
-  try {
-    writeFileSync(fd, JSON.stringify(owner) + "\n");
-  } finally {
-    closeSync(fd);
-  }
-}
-
-function acquireRecoveryClaim(
-  lockPath: string,
-  staleSignature: string,
-  owner: LockOwner,
-  liveOwnerRecoveryGraceMs: number,
-): (() => void) | undefined {
-  const recoveryKey = staleSignature.slice(0, 16);
-  for (let generation = 0; generation < 100; generation++) {
-    const claimPath = `${lockPath}.recovery-${recoveryKey}-${generation}`;
-    try {
-      writeOwnerFile(claimPath, owner);
-      return () => releaseLock(claimPath, owner.token);
-    } catch (error) {
-      if ((error as NodeJS.ErrnoException).code !== "EEXIST") {
-        throw error;
-      }
-      if (
-        ownerIsActive(claimPath, readOwner(claimPath), liveOwnerRecoveryGraceMs)
-      ) {
-        return undefined;
-      }
-    }
-  }
-  return undefined;
-}
-
-function removeStaleLock(
-  lockPath: string,
-  recoveryOwner: LockOwner,
-  liveOwnerRecoveryGraceMs: number,
-): boolean {
-  const staleSnapshot = readSnapshot(lockPath);
-  if (!staleSnapshot) {
-    return true;
-  }
-  if (ownerIsActive(lockPath, staleSnapshot.owner, liveOwnerRecoveryGraceMs)) {
-    return false;
-  }
-
-  const releaseRecoveryClaim = acquireRecoveryClaim(
-    lockPath,
-    staleSnapshot.signature,
-    recoveryOwner,
-    liveOwnerRecoveryGraceMs,
-  );
-  if (!releaseRecoveryClaim) {
-    return false;
-  }
-
-  try {
-    const currentSnapshot = readSnapshot(lockPath);
-    if (!currentSnapshot) {
-      return true;
-    }
-    if (currentSnapshot.signature !== staleSnapshot.signature) {
-      return false;
-    }
-    if (
-      ownerIsActive(lockPath, currentSnapshot.owner, liveOwnerRecoveryGraceMs)
-    ) {
-      return false;
-    }
-    try {
-      unlinkSync(lockPath);
-      return true;
-    } catch (error) {
-      return (error as NodeJS.ErrnoException).code === "ENOENT";
-    }
-  } finally {
-    releaseRecoveryClaim();
-  }
-}
-
-function releaseLock(lockPath: string, token: string): void {
-  if (readOwner(lockPath)?.token !== token) {
-    return;
-  }
-  try {
-    unlinkSync(lockPath);
-  } catch (error) {
-    if ((error as NodeJS.ErrnoException).code !== "ENOENT") {
-      throw error;
-    }
-  }
-}
-
-function refreshLock(lockPath: string, token: string): void {
-  if (readOwner(lockPath)?.token !== token) {
-    return;
-  }
-  try {
-    const now = new Date();
-    utimesSync(lockPath, now, now);
-  } catch {}
-}
-
-/**
- * Serialize local assistant startup across CLI processes. Port availability is
- * machine-wide even when callers use different lockfile or XDG directories,
- * so allocation must remain exclusive until the new services have bound their
- * ports and the assistant entry has been persisted.
- */
-export async function withLocalHatchLock<T>(
-  action: () => Promise<T>,
-  options: LocalHatchLockOptions = {},
-): Promise<T> {
-  const lockPath = options.lockPath ?? resolveLocalHatchLockPath();
-  const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;
-  const retryMs = options.retryMs ?? DEFAULT_RETRY_MS;
-  const liveOwnerRecoveryGraceMs =
-    options.liveOwnerRecoveryGraceMs ?? LIVE_OWNER_RECOVERY_GRACE_MS;
-  const deadline = Date.now() + timeoutMs;
-  const owner: LockOwner = {
-    pid: process.pid,
-    processStartedAt: processStartedAt(process.pid),
-    token: `${process.pid}-${randomUUID()}`,
-  };
-
-  mkdirSync(dirname(lockPath), { recursive: true, mode: 0o700 });
-
-  while (true) {
-    try {
-      writeOwnerFile(lockPath, owner);
-    } catch (error) {
-      if ((error as NodeJS.ErrnoException).code !== "EEXIST") {
-        throw error;
-      }
-      if (removeStaleLock(lockPath, owner, liveOwnerRecoveryGraceMs)) {
-        continue;
-      }
-      if (Date.now() >= deadline) {
-        throw new Error(
-          `Timed out waiting for another local assistant to finish starting (${lockPath})`,
-        );
-      }
-      await new Promise((resolve) => setTimeout(resolve, retryMs));
-      continue;
-    }
-
-    const heartbeat = setInterval(
-      () => refreshLock(lockPath, owner.token),
-      HEARTBEAT_INTERVAL_MS,
-    );
-    try {
-      return await action();
-    } finally {
-      clearInterval(heartbeat);
-      releaseLock(lockPath, owner.token);
-    }
-  }
-}

package/src/lib/stale-cli-hint.ts

@@ -1,11 +0,0 @@
-/**
- * Shared tail for errors where this CLI doesn't recognize an option or provider
- * the user named. The name may be valid in a newer release, so point the user
- * at the self-update path before they conclude the feature doesn't exist.
- *
- * `bun install -g vellum@latest` refreshes the `vellum` binary directly — the
- * mechanism the installer and the CLI's own self-update use. (`vellum upgrade`
- * targets the assistant runtime, not the CLI binary, for local assistants.)
- */
-export const STALE_CLI_UPDATE_HINT =
-  "your CLI may be out of date — update it with `bun install -g vellum@latest` and retry.";

package/src/lib/tailscale-tunnel.ts

@@ -1,321 +0,0 @@
-import { spawnSync } from "node:child_process";
-
-import { GATEWAY_PORT } from "./constants.js";
-import {
-  clearIngressUrl,
-  getDefaultWorkspaceDir,
-  saveIngressUrl,
-} from "./ingress-config.js";
-import { resolveTunnelTargetPort } from "./nginx-ingress.js";
-
-// ── Tailscale CLI discovery + invocation ────────────────────────────────────
-
-/**
- * Common macOS locations for the tailscale CLI when it is not on PATH: the
- * Homebrew bin and the CLI bundled inside the Mac App Store / standalone app.
- */
-const TAILSCALE_FALLBACK_PATHS = [
-  "/opt/homebrew/bin/tailscale",
-  "/Applications/Tailscale.app/Contents/MacOS/Tailscale",
-];
-
-const TAILSCALE_NOT_INSTALLED_MESSAGE = [
-  "Tailscale is not installed or could not be found.",
-  "",
-  "Install Tailscale:",
-  "  macOS:  brew install tailscale   (or install the Tailscale app)",
-  "  Linux:  https://tailscale.com/download/linux",
-  "",
-  "Then start it and sign in: `tailscale up`.",
-].join("\n");
-
-export interface TailscaleCommandResult {
-  status: number | null;
-  stdout: string;
-  stderr: string;
-}
-
-/**
- * Injectable seam for the tailscale binary. The real implementation shells out
- * via spawnSync; tests provide a fake to exercise the success and error paths
- * without a real tailscale install.
- */
-export interface TailscaleDeps {
-  /** Locate the tailscale CLI; returns the invocable path, null if absent. */
-  findBinary(): string | null;
-  /** Run `<bin> <args>` synchronously (spawnSync semantics). */
-  run(bin: string, args: string[]): TailscaleCommandResult;
-}
-
-function realFindBinary(): string | null {
-  for (const candidate of ["tailscale", ...TAILSCALE_FALLBACK_PATHS]) {
-    const res = spawnSync(candidate, ["version"], {
-      encoding: "utf-8",
-      timeout: 5_000,
-      stdio: ["ignore", "pipe", "ignore"],
-    });
-    if (!res.error && res.status === 0) {
-      return candidate;
-    }
-  }
-  return null;
-}
-
-function realRun(bin: string, args: string[]): TailscaleCommandResult {
-  const res = spawnSync(bin, args, { encoding: "utf-8", timeout: 15_000 });
-  if (res.error) {
-    throw res.error;
-  }
-  return {
-    status: res.status,
-    stdout: res.stdout ?? "",
-    stderr: res.stderr ?? "",
-  };
-}
-
-function realTailscaleDeps(): TailscaleDeps {
-  return { findBinary: realFindBinary, run: realRun };
-}
-
-// ── Status parsing ──────────────────────────────────────────────────────────
-
-interface TailscaleStatus {
-  BackendState?: string;
-  Self?: { DNSName?: string; Online?: boolean };
-}
-
-/** Trim the trailing dot tailscale appends to MagicDNS names. */
-export function normalizeDnsName(dnsName: string): string {
-  return dnsName.replace(/\.$/, "");
-}
-
-/**
- * Validate `tailscale status --json` output and return the MagicDNS hostname
- * (without trailing dot) this machine serves at. Throws a clear error when the
- * daemon is logged out or otherwise not ready to serve.
- */
-export function resolveServeHostname(statusJson: string): string {
-  let status: TailscaleStatus;
-  try {
-    status = JSON.parse(statusJson) as TailscaleStatus;
-  } catch {
-    throw new Error("Could not parse `tailscale status --json` output.");
-  }
-
-  const backendState = status.BackendState;
-  if (backendState === "NeedsLogin" || backendState === "NoState") {
-    throw new Error(
-      "Tailscale is not logged in. Run `tailscale up` and try again.",
-    );
-  }
-  if (backendState && backendState !== "Running") {
-    throw new Error(
-      `Tailscale is not ready (state: ${backendState}). ` +
-        "Start Tailscale and run `tailscale up`, then try again.",
-    );
-  }
-
-  const dnsName = status.Self?.DNSName;
-  if (!dnsName) {
-    throw new Error(
-      "Could not determine this machine's Tailscale DNS name from `tailscale status`. " +
-        "Ensure Tailscale is running and signed in (`tailscale up`).",
-    );
-  }
-  return normalizeDnsName(dnsName);
-}
-
-function joinOutput(result: TailscaleCommandResult): string {
-  return [result.stdout, result.stderr]
-    .map((s) => s.trim())
-    .filter(Boolean)
-    .join("\n");
-}
-
-/**
- * Compose an error for a failed `tailscale serve`, surfacing tailscale's own
- * guidance (it prints an enable URL when Serve/HTTPS certs are not enabled for
- * the tailnet) rather than swallowing it.
- */
-function serveFailureMessage(result: TailscaleCommandResult): string {
-  const detail = joinOutput(result);
-  const base =
-    "`tailscale serve` failed. This usually means HTTPS certificates or the " +
-    "Serve feature are not enabled for your tailnet — follow the link below to " +
-    "enable them, then retry.";
-  return detail ? `${base}\n\n${detail}` : base;
-}
-
-/**
- * The ingress URL may only be cleared once the serve mapping is confirmed
- * stopped. tailscaled maintains the mapping independently of this process, so
- * a failed or errored stop leaves the URL live — clearing the config then
- * would strand webhook configuration while the endpoint still answers.
- */
-export function shouldClearIngressUrl(
-  result: TailscaleCommandResult | null,
-): boolean {
-  return result !== null && result.status === 0;
-}
-
-// ── Tailscale serve lifecycle ───────────────────────────────────────────────
-
-export interface RunTailscaleTunnelOptions {
-  /** Gateway port to serve. Defaults to the global GATEWAY_PORT. */
-  port?: number;
-  /** Workspace directory for config read/write. Defaults to ~/.vellum/workspace. */
-  workspaceDir?: string;
-  /** Prefer nginx ingress over the gateway port when it is running. */
-  preferNginxIngress?: boolean;
-  /** Lockfile entry to mirror the ingress URL onto (`ingressUrl`). */
-  assistantId?: string;
-}
-
-export interface TailscaleServeInfo {
-  publicUrl: string;
-  port: number;
-  viaIngress: boolean;
-  binary: string;
-  workspaceDir: string;
-}
-
-/**
- * Preflight tailscale, front the local edge with `tailscale serve --bg`, and
- * persist the resulting tailnet URL as the ingress base URL.
- *
- * `serve --bg` registers the mapping in tailscaled and returns immediately;
- * there is no long-lived child process to supervise. Throws on any failure
- * (binary missing, logged out, serve not enabled) with actionable guidance.
- */
-export async function startTailscaleServe(
-  opts: RunTailscaleTunnelOptions = {},
-  deps: TailscaleDeps = realTailscaleDeps(),
-): Promise<TailscaleServeInfo> {
-  const binary = deps.findBinary();
-  if (!binary) {
-    throw new Error(TAILSCALE_NOT_INSTALLED_MESSAGE);
-  }
-
-  const statusResult = deps.run(binary, ["status", "--json"]);
-  if (statusResult.status !== 0 || !statusResult.stdout.trim()) {
-    const detail = joinOutput(statusResult);
-    throw new Error(
-      "Could not query Tailscale — is the Tailscale app running? " +
-        "Start Tailscale and run `tailscale up`, then try again." +
-        (detail ? `\n\n${detail}` : ""),
-    );
-  }
-
-  const hostname = resolveServeHostname(statusResult.stdout);
-  const publicUrl = `https://${hostname}`;
-
-  const workspaceDir = opts.workspaceDir ?? getDefaultWorkspaceDir();
-  const gatewayPort = opts.port ?? GATEWAY_PORT;
-  const { port, viaIngress } = resolveTunnelTargetPort(
-    workspaceDir,
-    gatewayPort,
-    { preferNginxIngress: opts.preferNginxIngress === true },
-  );
-
-  const serveResult = deps.run(binary, ["serve", "--bg", String(port)]);
-  if (serveResult.status !== 0) {
-    throw new Error(serveFailureMessage(serveResult));
-  }
-
-  saveIngressUrl(workspaceDir, publicUrl, opts.assistantId);
-
-  return { publicUrl, port, viaIngress, binary, workspaceDir };
-}
-
-/**
- * Turn off the HTTPS serve on 443 (the narrow form — leaves any other serve
- * config intact). Returns the command result so callers can report failures.
- */
-export function stopTailscaleServe(
-  binary: string,
-  deps: TailscaleDeps = realTailscaleDeps(),
-): TailscaleCommandResult {
-  return deps.run(binary, ["serve", "--https=443", "off"]);
-}
-
-/**
- * Run the tailscale tunnel workflow: preflight, serve the local edge over the
- * tailnet, persist the URL, then hold until Ctrl+C to tear the serve down and
- * clear the ingress URL.
- *
- * The tailnet URL carries a real LetsEncrypt certificate but is reachable only
- * from devices signed in to the same tailnet — no public exposure.
- */
-export async function runTailscaleTunnel(
-  opts: RunTailscaleTunnelOptions = {},
-): Promise<void> {
-  const deps = realTailscaleDeps();
-
-  console.log("Setting up tailscale serve...");
-  const { publicUrl, port, viaIngress, binary, workspaceDir } =
-    await startTailscaleServe(opts, deps);
-
-  if (viaIngress) {
-    console.log(`nginx ingress detected — serving it on 127.0.0.1:${port}.`);
-  }
-
-  console.log("");
-  console.log(`Tunnel established: ${publicUrl}`);
-  console.log(`Serving:            localhost:${port}`);
-  console.log("");
-  console.log("Ingress URL saved to config.");
-  console.log(
-    "This URL is reachable only from devices signed in to your tailnet.",
-  );
-  console.log("");
-  console.log(
-    "The serve runs in the background (tailscaled) and persists after this",
-  );
-  console.log(
-    "command exits. Press Ctrl+C to stop serving and clear the ingress URL,",
-  );
-  console.log("or stop it later with: tailscale serve --https=443 off");
-
-  const teardown = (): void => {
-    console.log("\nStopping tailscale serve and clearing the ingress URL...");
-    let result: TailscaleCommandResult | null = null;
-    try {
-      result = stopTailscaleServe(binary, deps);
-    } catch (err) {
-      console.error(
-        `Could not stop tailscale serve automatically (${
-          err instanceof Error ? err.message : String(err)
-        }). Run \`tailscale serve --https=443 off\` manually.`,
-      );
-    }
-    if (result && result.status !== 0) {
-      const detail = joinOutput(result);
-      console.error(
-        "Could not stop tailscale serve automatically. Run " +
-          "`tailscale serve --https=443 off` manually." +
-          (detail ? `\n${detail}` : ""),
-      );
-    }
-    if (shouldClearIngressUrl(result)) {
-      clearIngressUrl(workspaceDir, opts.assistantId);
-    } else {
-      console.error(
-        "Keeping the saved ingress URL since serve may still be active. " +
-          "After stopping serve manually, clear it with another Ctrl+C run " +
-          "or by re-running the tunnel command.",
-      );
-    }
-  };
-
-  const shutdown = (): void => {
-    teardown();
-    process.exit(0);
-  };
-  process.on("SIGINT", shutdown);
-  process.on("SIGTERM", shutdown);
-
-  // Hold the process open until a signal fires. The serve itself lives in
-  // tailscaled, so there is no child process to await — the registered signal
-  // listeners keep the event loop alive.
-  await new Promise<void>(() => {});
-}