@vellumai/cli 0.10.11-dev.202607242127.a6bf2b2 → 0.10.11-staging.2

package/src/commands/wake.ts

@@ -30,15 +30,6 @@ import {
   startGateway,
 } from "../lib/local";
 import { maybeStartNgrokTunnel } from "../lib/ngrok";
-import {
-  isAssistantFeatureFlagEnabled,
-  WEB_REMOTE_INGRESS_FLAG,
-} from "../lib/feature-flags.js";
-import { loadRawConfig } from "../lib/ingress-config.js";
-import {
-  isIngressRunning,
-  startRemoteWebIngress,
-} from "../lib/nginx-ingress.js";
 
 export async function wake(): Promise<void> {
   const args = process.argv.slice(3);
@@ -388,17 +379,6 @@ export async function wake(): Promise<void> {
     writeFileSync(ngrokPidFile, String(ngrokChild.pid));
   }
 
-  // Restore the nginx web ingress edge when the workspace config still wants
-  // it. A TLS-terminating front (tailscale serve / tunnel) persists across
-  // restarts and keeps proxying to the edge's loopback port, but the edge has
-  // a manual lifecycle — so a routine restart otherwise leaves the self-hosted
-  // remote-web path dead (502 / blank page) until someone runs it back up.
-  await restoreWebIngressIfEnabled(
-    entry.assistantId,
-    resources.gatewayPort,
-    workspaceDir,
-  );
-
   if (daemonMigrationsFailed) {
     console.log(
       "Assistant database migrations FAILED — DB-backed routes will return 503 until the assistant is restarted. Check the daemon logs.",
@@ -424,101 +404,3 @@ export async function wake(): Promise<void> {
     });
   }
 }
-
-/**
- * Bring the nginx web ingress edge back up after a wake when the workspace
- * config still wants it. Only restores when ingress is explicitly enabled with
- * a saved public URL and the `web-remote-ingress` flag is on — the edge is
- * pointless without the flag, so a disabled flag skips quietly with a hint.
- *
- * Reads the same workspace config the edge serves. Any failure to restore
- * warns with the manual `vellum nginx-ingress up` command and never fails the
- * wake — a down edge is a degraded remote-web path, not a broken assistant.
- */
-async function restoreWebIngressIfEnabled(
-  assistantId: string,
-  gatewayPort: number,
-  workspaceDir: string,
-): Promise<void> {
-  const config = loadRawConfig(workspaceDir);
-  const ingress = config.ingress as
-    | { enabled?: unknown; publicBaseUrl?: unknown }
-    | undefined;
-  const enabled = ingress?.enabled === true;
-  const publicBaseUrl =
-    typeof ingress?.publicBaseUrl === "string"
-      ? ingress.publicBaseUrl.trim()
-      : "";
-  if (!enabled || !publicBaseUrl) {
-    return;
-  }
-
-  // The edge already survived (or was manually brought back) — nothing to do.
-  if (isIngressRunning(workspaceDir)) {
-    return;
-  }
-
-  let flagEnabled: boolean;
-  try {
-    flagEnabled = await isAssistantFeatureFlagEnabled(
-      assistantId,
-      WEB_REMOTE_INGRESS_FLAG,
-      { runtimeUrl: `http://127.0.0.1:${gatewayPort}` },
-    );
-  } catch (err) {
-    console.warn(
-      `   Could not verify the \`${WEB_REMOTE_INGRESS_FLAG}\` flag to restore the web ingress edge; leaving it down. Bring it up manually with \`vellum nginx-ingress up\`. ${
-        err instanceof Error ? err.message : String(err)
-      }`,
-    );
-    return;
-  }
-  if (!flagEnabled) {
-    console.log(
-      `   Web ingress edge not restored: the \`${WEB_REMOTE_INGRESS_FLAG}\` flag is off. Enable it and run \`vellum nginx-ingress up\` to serve remote web access.`,
-    );
-    return;
-  }
-
-  try {
-    const result = await startRemoteWebIngress({
-      workspaceDir,
-      gatewayPort,
-      onStarting: ({ listenPort }) => {
-        console.log(
-          `Restoring web ingress edge on 127.0.0.1:${listenPort} (ingress.enabled)...`,
-        );
-      },
-    });
-    switch (result.status) {
-      case "started":
-        console.log(
-          `   Web ingress edge running: http://127.0.0.1:${result.listenPort}`,
-        );
-        break;
-      case "already-running":
-        break;
-      case "nginx-missing":
-        console.warn(
-          "   Could not restore the web ingress edge: nginx is not installed. Bring it up manually with `vellum nginx-ingress up`.",
-        );
-        break;
-      case "web-dist-missing":
-        console.warn(
-          "   Could not restore the web ingress edge: built web assets were not found. Bring it up manually with `vellum nginx-ingress up`.",
-        );
-        break;
-      case "unreachable":
-        console.warn(
-          `   Web ingress edge did not become reachable on 127.0.0.1:${result.listenPort}; check ${result.logPath}. Bring it up manually with \`vellum nginx-ingress up\`.`,
-        );
-        break;
-    }
-  } catch (err) {
-    console.warn(
-      `   Failed to restore the web ingress edge: ${
-        err instanceof Error ? err.message : String(err)
-      }. Bring it up manually with \`vellum nginx-ingress up\`.`,
-    );
-  }
-}

package/src/lib/__tests__/step-runner.test.ts

@@ -33,12 +33,7 @@ describe("buildExecErrorMessage", () => {
   });
 
   it("appends both streams joined by newline when both present", () => {
-    const msg = buildExecErrorMessage(
-      "docker",
-      1,
-      "stderr-line",
-      "stdout-line",
-    );
+    const msg = buildExecErrorMessage("docker", 1, "stderr-line", "stdout-line");
     expect(msg).toBe("docker exited with code 1\nstderr-line\nstdout-line");
   });
 

package/src/lib/__tests__/terminal-session.test.ts

@@ -1,6 +1,9 @@
 import { describe, expect, test } from "bun:test";
 
-import { parseSentinelOutput, stripAnsi } from "../terminal-session.js";
+import {
+  parseSentinelOutput,
+  stripAnsi,
+} from "../terminal-session.js";
 
 const START = "__VELLUM_EXEC_START_1234__";
 const END = "__VELLUM_EXEC_END_1234__";
@@ -129,7 +132,7 @@ describe("parseSentinelOutput", () => {
       START,
       "📤 Resend Email Setup [installed]",
       "  ID: resend-setup",
-      "  Set up and send emails via a user-provided Resend account (BYO email provider)",
+      '  Set up and send emails via a user-provided Resend account (BYO email provider)',
       "",
       "Community registry (1):",
       "",
@@ -148,12 +151,18 @@ describe("parseSentinelOutput", () => {
     const cleaned = "just some random output\nwith no sentinels\n";
     const result = parseSentinelOutput(cleaned, START, END);
     // Falls back to entire output (trimmed)
-    expect(result.output).toBe("just some random output\nwith no sentinels");
+    expect(result.output).toBe(
+      "just some random output\nwith no sentinels",
+    );
     expect(result.exitCode).toBe(0);
   });
 
   test("handles output with only start sentinel (no end)", () => {
-    const cleaned = [START, "partial output", "more output"].join("\n");
+    const cleaned = [
+      START,
+      "partial output",
+      "more output",
+    ].join("\n");
 
     const result = parseSentinelOutput(cleaned, START, END);
     expect(result.output).toBe("partial output\nmore output");
@@ -168,7 +177,7 @@ describe("parseSentinelOutput", () => {
         ` '${END}'; echo '__VELLUM_EXIT_'$__ec; exit $__ec`,
       START,
       "[13:06:38.851] INFO (761 on pod-0): [clawhub] Running clawhub command",
-      "    args: [",
+      '    args: [',
       '      "search",',
       '      "resend-setup",',
       '      "--limit",',

package/src/lib/assistant-config.ts

@@ -18,7 +18,6 @@ import {
 } from "@vellumai/local-mode/contract";
 
 import { DAEMON_INTERNAL_ASSISTANT_ID } from "./constants.js";
-import { crossEnvironmentAssistantHint } from "./environments/detect.js";
 import {
   getDefaultPorts,
   getLockfilePath,
@@ -110,9 +109,6 @@ export type AssistantEntry = Omit<
   /** Loopback URL for same-machine health checks (e.g. `http://127.0.0.1:7831`).
    *  Avoids mDNS resolution issues when the machine checks its own gateway. */
   localUrl?: string;
-  /** Public https ingress URL recorded by `vellum tunnel` providers for this
-   *  instance. The advertised-URL default for remote-web pairing. */
-  ingressUrl?: string;
   bearerToken?: string;
   /** True when this entry was registered via `vellum connect import` (a remote
    *  pairing). Set alongside `cloud: "paired"`; also backs the re-import /
@@ -424,7 +420,7 @@ export function formatAssistantLookupError(
     return `Multiple assistants match '${identifier}': ${matches}. Use the assistant ID to disambiguate.`;
   }
 
-  return `No assistant found with name or ID '${identifier}'.${crossEnvironmentAssistantHint() ?? ""}`;
+  return `No assistant found with name or ID '${identifier}'.`;
 }
 
 export function removeAssistantEntry(assistantId: string): void {
@@ -581,9 +577,7 @@ export function resolveTargetAssistant(nameArg?: string): AssistantEntry {
     if (all.length === 1) return all[0];
 
     if (all.length === 0) {
-      console.error(
-        `No assistant found. Run 'vellum hatch' first.${crossEnvironmentAssistantHint() ?? ""}`,
-      );
+      console.error("No assistant found. Run 'vellum hatch' first.");
     } else {
       console.error(
         `Multiple assistants found. Set an active assistant with 'vellum use <name>'.`,

package/src/lib/cloudflare-tunnel.ts

@@ -1,13 +1,60 @@
 import { execFileSync, spawn, type ChildProcess } from "node:child_process";
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { dirname, join } from "node:path";
 
 import { GATEWAY_PORT } from "./constants.js";
-import {
-  clearIngressUrl,
-  getDefaultWorkspaceDir,
-  saveIngressUrl,
-} from "./ingress-config.js";
 import { resolveTunnelTargetPort } from "./nginx-ingress.js";
 
+// ── Workspace config helpers (mirrors the pattern in ngrok.ts) ───────────────
+
+function getDefaultWorkspaceDir(): string {
+  return (
+    process.env.VELLUM_WORKSPACE_DIR?.trim() ||
+    join(homedir(), ".vellum", "workspace")
+  );
+}
+
+function getConfigPath(workspaceDir: string): string {
+  return join(workspaceDir, "config.json");
+}
+
+function loadRawConfig(workspaceDir: string): Record<string, unknown> {
+  const configPath = getConfigPath(workspaceDir);
+  if (!existsSync(configPath)) return {};
+  return JSON.parse(readFileSync(configPath, "utf-8")) as Record<
+    string,
+    unknown
+  >;
+}
+
+function saveRawConfig(
+  workspaceDir: string,
+  config: Record<string, unknown>,
+): void {
+  const configPath = getConfigPath(workspaceDir);
+  const dir = dirname(configPath);
+  if (!existsSync(dir)) mkdirSync(dir, { recursive: true });
+  writeFileSync(configPath, JSON.stringify(config, null, 2) + "\n");
+}
+
+function saveIngressUrl(workspaceDir: string, publicUrl: string): void {
+  const config = loadRawConfig(workspaceDir);
+  const ingress = (config.ingress ?? {}) as Record<string, unknown>;
+  ingress.publicBaseUrl = publicUrl;
+  ingress.enabled = true;
+  config.ingress = ingress;
+  saveRawConfig(workspaceDir, config);
+}
+
+function clearIngressUrl(workspaceDir: string): void {
+  const config = loadRawConfig(workspaceDir);
+  const ingress = (config.ingress ?? {}) as Record<string, unknown>;
+  delete ingress.publicBaseUrl;
+  config.ingress = ingress;
+  saveRawConfig(workspaceDir, config);
+}
+
 // ── Cloudflare Tunnel ─────────────────────────────────────────────────────────
 
 const CLOUDFLARED_TIMEOUT_MS = 30_000;
@@ -131,8 +178,6 @@ export interface RunCloudflareTunnelOptions {
   workspaceDir?: string;
   /** Prefer nginx ingress over the gateway port when it is running. */
   preferNginxIngress?: boolean;
-  /** Lockfile entry to mirror the ingress URL onto (`ingressUrl`). */
-  assistantId?: string;
 }
 
 export async function runCloudflareTunnel(
@@ -179,7 +224,7 @@ export async function runCloudflareTunnel(
     if (!child.killed) child.kill("SIGTERM");
     if (publicUrl) {
       console.log("\nClearing ingress URL from config...");
-      clearIngressUrl(workspaceDir, opts.assistantId);
+      clearIngressUrl(workspaceDir);
     }
   };
 
@@ -201,7 +246,7 @@ export async function runCloudflareTunnel(
     // Always clear the saved ingress URL when the tunnel process ends so
     // webhook integrations don't keep hitting a dead endpoint.
     if (publicUrl !== undefined) {
-      clearIngressUrl(workspaceDir, opts.assistantId);
+      clearIngressUrl(workspaceDir);
     }
     if (code !== null && code !== 0) {
       console.error(`\ncloudflared exited with code ${code}.`);
@@ -232,7 +277,7 @@ export async function runCloudflareTunnel(
   console.log(`Forwarding to:     localhost:${port}`);
   console.log("");
 
-  saveIngressUrl(workspaceDir, publicUrl, opts.assistantId);
+  saveIngressUrl(workspaceDir, publicUrl);
   console.log("Ingress URL saved to config.");
   console.log("");
   console.log("Press Ctrl+C to stop the tunnel and clear the ingress URL.");

package/src/lib/device-id.ts

@@ -23,7 +23,9 @@ let cached: string | undefined;
 function resolveDeviceIdPaths(): { dir: string; file: string } {
   const env = getCurrentEnvironment();
   const dir =
-    env.name === "production" ? join(homedir(), ".vellum") : getConfigDir(env);
+    env.name === "production"
+      ? join(homedir(), ".vellum")
+      : getConfigDir(env);
   return { dir, file: join(dir, "device.json") };
 }
 

package/src/lib/flag-args.test.ts

@@ -12,7 +12,12 @@ describe("parseFeatureFlagArgs", () => {
   });
 
   test("multiple flags produce multiple env vars", () => {
-    const result = parseFeatureFlagArgs(["--flag", "a=1", "--flag", "b=0"]);
+    const result = parseFeatureFlagArgs([
+      "--flag",
+      "a=1",
+      "--flag",
+      "b=0",
+    ]);
     expect(result).toEqual({
       envVars: { VELLUM_FLAG_A: "1", VELLUM_FLAG_B: "0" },
       remaining: [],

package/src/lib/guardian-token.ts

@@ -17,7 +17,10 @@ import { platform } from "os";
 import { dirname, join } from "path";
 
 import { SEEDS } from "@vellumai/environments";
-import { guardianTokenPath, resolveConfigDir } from "@vellumai/local-mode";
+import {
+  guardianTokenPath,
+  resolveConfigDir,
+} from "@vellumai/local-mode";
 
 import { getConfigDir } from "./environments/paths.js";
 import { getCurrentEnvironment } from "./environments/resolve.js";
@@ -344,24 +347,21 @@ export async function refreshGuardianToken(
 
     const tokenData = current ?? before;
 
-    const response = await loopbackSafeFetch(
-      `${gatewayUrl}/v1/guardian/refresh`,
-      {
-        method: "POST",
-        headers: {
-          "Content-Type": "application/json",
-          Authorization: `Bearer ${tokenData.accessToken}`,
-        },
-        body: JSON.stringify({
-          refreshToken: tokenData.refreshToken,
-          // The refresh token is device-bound; send the device id used at init
-          // (falling back to a fresh computation for tokens persisted before the
-          // field was stored) so the gateway can verify the binding.
-          deviceId: tokenData.deviceId || computeDeviceId(),
-        }),
-        signal: AbortSignal.timeout(REFRESH_FETCH_TIMEOUT_MS),
+    const response = await loopbackSafeFetch(`${gatewayUrl}/v1/guardian/refresh`, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        Authorization: `Bearer ${tokenData.accessToken}`,
       },
-    );
+      body: JSON.stringify({
+        refreshToken: tokenData.refreshToken,
+        // The refresh token is device-bound; send the device id used at init
+        // (falling back to a fresh computation for tokens persisted before the
+        // field was stored) so the gateway can verify the binding.
+        deviceId: tokenData.deviceId || computeDeviceId(),
+      }),
+      signal: AbortSignal.timeout(REFRESH_FETCH_TIMEOUT_MS),
+    });
     if (!response.ok) return null;
 
     const json = (await response.json()) as Record<string, unknown>;

package/src/lib/hatch-local.ts

@@ -46,7 +46,6 @@ import {
 import { logHatchNextSteps } from "./hatch-next-steps.js";
 import { checkProviderApiKey } from "./api-key-check.js";
 import { loopbackSafeFetch } from "./loopback-fetch.js";
-import { withLocalHatchLock } from "./local-hatch-lock.js";
 
 /**
  * Attempts to place a symlink at the given path pointing to cliBinary.
@@ -180,116 +179,89 @@ export async function hatchLocal(
     name ?? process.env.VELLUM_ASSISTANT_NAME,
   );
 
-  const { resources, runtimeUrl, loopbackUrl, bootstrapSecret } =
-    await withLocalHatchLock(async () => {
-      reporter.progress(1, 6, "Allocating resources...");
+  reporter.progress(1, 6, "Allocating resources...");
 
-      const existing = findAssistantByName(instanceName);
-      if (existing && (!existing.cloud || existing.cloud === "local")) {
-        throw new Error(
-          `An assistant named "${instanceName}" is already hatched.\n` +
-            `Run \`vellum wake\` to restart it, or \`vellum retire ${instanceName}\` to remove it first.`,
-        );
-      }
-
-      const resources = await allocateLocalResources(instanceName);
-
-      const logsDir = join(
-        resources.instanceDir,
-        ".vellum",
-        "workspace",
-        "data",
-        "logs",
-      );
-      archiveLogFile("hatch.log", logsDir);
-      resetLogFile("hatch.log");
-
-      reporter.log(`🥚 Hatching local assistant: ${instanceName}`);
-      reporter.log(`   Species: ${species}`);
-      reporter.log("");
+  const existing = findAssistantByName(instanceName);
+  if (existing && (!existing.cloud || existing.cloud === "local")) {
+    throw new Error(
+      `An assistant named "${instanceName}" is already hatched.\n` +
+        `Run \`vellum wake\` to restart it, or \`vellum retire ${instanceName}\` to remove it first.`,
+    );
+  }
 
-      const apiKeyCheck = checkProviderApiKey();
-      if (!apiKeyCheck.hasKey) {
-        reporter.warn(
-          "Warning: No LLM provider API key is configured. The assistant will fail when you try to send a message.",
-        );
-        reporter.warn("  To fix, export your key before running vellum hatch:");
-        reporter.warn("  export ANTHROPIC_API_KEY=<your-key>");
-        reporter.warn("");
-      }
+  const resources = await allocateLocalResources(instanceName);
 
-      if (!process.env.APP_VERSION) {
-        process.env.APP_VERSION = cliPkg.version;
-      }
+  const logsDir = join(
+    resources.instanceDir,
+    ".vellum",
+    "workspace",
+    "data",
+    "logs",
+  );
+  archiveLogFile("hatch.log", logsDir);
+  resetLogFile("hatch.log");
 
-      reporter.progress(2, 6, "Writing configuration...");
-      const hatchConfigValues = buildHatchConfigValues(configValues, provider);
-      const defaultWorkspaceConfigPath = writeInitialConfig(hatchConfigValues);
+  reporter.log(`🥚 Hatching local assistant: ${instanceName}`);
+  reporter.log(`   Species: ${species}`);
+  reporter.log("");
 
-      reporter.progress(3, 6, "Starting assistant...");
-      const signingKey = generateLocalSigningKey();
-      const bootstrapSecret = generateLocalSigningKey();
-      let runtimeUrl = `http://127.0.0.1:${resources.gatewayPort}`;
-      try {
-        // Launch the CES sibling alongside the daemon, in parallel — matching the
-        // Docker topology. The assistant does not spawn its own CES, so a freshly
-        // hatched instance would otherwise come up with CES unavailable.
-        // startCes always launches the CES sibling.
-        const startupResults = await Promise.allSettled([
-          startCes(watch, resources),
-          startLocalDaemon(watch, resources, {
-            defaultWorkspaceConfigPath,
-            requireReady: true,
-            signingKey,
-          }),
-        ]);
-        const startupFailure = startupResults.find(
-          (result): result is PromiseRejectedResult =>
-            result.status === "rejected",
-        );
-        if (startupFailure) {
-          throw startupFailure.reason;
-        }
+  const apiKeyCheck = checkProviderApiKey();
+  if (!apiKeyCheck.hasKey) {
+    reporter.warn(
+      "Warning: No LLM provider API key is configured. The assistant will fail when you try to send a message.",
+    );
+    reporter.warn("  To fix, export your key before running vellum hatch:");
+    reporter.warn("  export ANTHROPIC_API_KEY=<your-key>");
+    reporter.warn("");
+  }
 
-        reporter.progress(4, 6, "Starting gateway...");
-        runtimeUrl = await startGateway(watch, resources, {
-          signingKey,
-          bootstrapSecret,
-          envOverrides: flagEnvVars,
-          requireReady: true,
-        });
-      } catch (error) {
-        reporter.error(
-          `\n❌ Local assistant startup failed — stopping partial processes.`,
-        );
-        await stopLocalProcesses(resources);
-        throw error;
-      }
+  if (!process.env.APP_VERSION) {
+    process.env.APP_VERSION = cliPkg.version;
+  }
 
-      const loopbackUrl = `http://127.0.0.1:${resources.gatewayPort}`;
-      const localEntry: AssistantEntry = {
-        assistantId: instanceName,
-        runtimeUrl,
-        localUrl: `http://127.0.0.1:${resources.gatewayPort}`,
-        cloud: "local",
-        species,
-        hatchedAt: new Date().toISOString(),
-        resources: { ...resources, signingKey },
-        guardianBootstrapSecret: bootstrapSecret,
-      };
-
-      reporter.progress(5, 6, "Saving configuration...");
-      saveAssistantEntry(localEntry);
-      setActiveAssistant(instanceName);
-
-      return { resources, runtimeUrl, loopbackUrl, bootstrapSecret };
+  reporter.progress(2, 6, "Writing configuration...");
+  const hatchConfigValues = buildHatchConfigValues(configValues, provider);
+  const defaultWorkspaceConfigPath = writeInitialConfig(hatchConfigValues);
+
+  reporter.progress(3, 6, "Starting assistant...");
+  const signingKey = generateLocalSigningKey();
+  const bootstrapSecret = generateLocalSigningKey();
+  // Launch the CES sibling alongside the daemon, in parallel — matching the
+  // Docker topology. The assistant does not spawn its own CES, so a freshly
+  // hatched instance would otherwise come up with CES unavailable.
+  // startCes always launches the CES sibling.
+  await Promise.all([
+    startCes(watch, resources),
+    startLocalDaemon(watch, resources, {
+      defaultWorkspaceConfigPath,
+      signingKey,
+    }),
+  ]);
+
+  reporter.progress(4, 6, "Starting gateway...");
+  let runtimeUrl = `http://127.0.0.1:${resources.gatewayPort}`;
+  try {
+    runtimeUrl = await startGateway(watch, resources, {
+      signingKey,
+      bootstrapSecret,
+      envOverrides: flagEnvVars,
     });
+  } catch (error) {
+    // Gateway failed — stop the daemon we just started so we don't leave
+    // orphaned processes with no lock file entry.
+    reporter.error(
+      `\n❌ Gateway startup failed — stopping assistant to avoid orphaned processes.`,
+    );
+    await stopLocalProcesses(resources);
+    throw error;
+  }
 
   // Lease a guardian token so the desktop app can import it on first launch
   // instead of hitting /v1/guardian/init itself. Use loopback to satisfy
   // the daemon's local-only check — the mDNS runtimeUrl resolves to a LAN
   // IP which the daemon rejects as non-loopback.
-  reporter.progress(6, 6, "Securing connection...");
+  reporter.progress(5, 6, "Securing connection...");
+  const loopbackUrl = `http://127.0.0.1:${resources.gatewayPort}`;
   const maxLeaseAttempts = 3;
   let guardianAccessToken: string | undefined;
   for (let attempt = 1; attempt <= maxLeaseAttempts; attempt++) {
@@ -318,6 +290,22 @@ export async function hatchLocal(
     }
   }
 
+  // Auto-start ngrok if webhook integrations (e.g. Telegram, Twilio) are configured.
+  const localEntry: AssistantEntry = {
+    assistantId: instanceName,
+    runtimeUrl,
+    localUrl: `http://127.0.0.1:${resources.gatewayPort}`,
+    cloud: "local",
+    species,
+    hatchedAt: new Date().toISOString(),
+    resources: { ...resources, signingKey },
+    guardianBootstrapSecret: bootstrapSecret,
+  };
+
+  reporter.progress(6, 6, "Saving configuration...");
+  saveAssistantEntry(localEntry);
+  setActiveAssistant(instanceName);
+
   if (process.env.VELLUM_DESKTOP_APP) {
     installCLISymlink();
   }