@vellumai/cli 0.10.12-dev.202607250047.75b9ec6 → 0.10.12-staging.1

package/src/lib/hatch-local.ts

@@ -46,7 +46,6 @@ import {
 import { logHatchNextSteps } from "./hatch-next-steps.js";
 import { checkProviderApiKey } from "./api-key-check.js";
 import { loopbackSafeFetch } from "./loopback-fetch.js";
-import { withLocalHatchLock } from "./local-hatch-lock.js";
 
 /**
  * Attempts to place a symlink at the given path pointing to cliBinary.
@@ -180,116 +179,89 @@ export async function hatchLocal(
     name ?? process.env.VELLUM_ASSISTANT_NAME,
   );
 
-  const { resources, runtimeUrl, loopbackUrl, bootstrapSecret } =
-    await withLocalHatchLock(async () => {
-      reporter.progress(1, 6, "Allocating resources...");
+  reporter.progress(1, 6, "Allocating resources...");
 
-      const existing = findAssistantByName(instanceName);
-      if (existing && (!existing.cloud || existing.cloud === "local")) {
-        throw new Error(
-          `An assistant named "${instanceName}" is already hatched.\n` +
-            `Run \`vellum wake\` to restart it, or \`vellum retire ${instanceName}\` to remove it first.`,
-        );
-      }
-
-      const resources = await allocateLocalResources(instanceName);
-
-      const logsDir = join(
-        resources.instanceDir,
-        ".vellum",
-        "workspace",
-        "data",
-        "logs",
-      );
-      archiveLogFile("hatch.log", logsDir);
-      resetLogFile("hatch.log");
-
-      reporter.log(`🥚 Hatching local assistant: ${instanceName}`);
-      reporter.log(`   Species: ${species}`);
-      reporter.log("");
+  const existing = findAssistantByName(instanceName);
+  if (existing && (!existing.cloud || existing.cloud === "local")) {
+    throw new Error(
+      `An assistant named "${instanceName}" is already hatched.\n` +
+        `Run \`vellum wake\` to restart it, or \`vellum retire ${instanceName}\` to remove it first.`,
+    );
+  }
 
-      const apiKeyCheck = checkProviderApiKey();
-      if (!apiKeyCheck.hasKey) {
-        reporter.warn(
-          "Warning: No LLM provider API key is configured. The assistant will fail when you try to send a message.",
-        );
-        reporter.warn("  To fix, export your key before running vellum hatch:");
-        reporter.warn("  export ANTHROPIC_API_KEY=<your-key>");
-        reporter.warn("");
-      }
+  const resources = await allocateLocalResources(instanceName);
 
-      if (!process.env.APP_VERSION) {
-        process.env.APP_VERSION = cliPkg.version;
-      }
+  const logsDir = join(
+    resources.instanceDir,
+    ".vellum",
+    "workspace",
+    "data",
+    "logs",
+  );
+  archiveLogFile("hatch.log", logsDir);
+  resetLogFile("hatch.log");
 
-      reporter.progress(2, 6, "Writing configuration...");
-      const hatchConfigValues = buildHatchConfigValues(configValues, provider);
-      const defaultWorkspaceConfigPath = writeInitialConfig(hatchConfigValues);
+  reporter.log(`🥚 Hatching local assistant: ${instanceName}`);
+  reporter.log(`   Species: ${species}`);
+  reporter.log("");
 
-      reporter.progress(3, 6, "Starting assistant...");
-      const signingKey = generateLocalSigningKey();
-      const bootstrapSecret = generateLocalSigningKey();
-      let runtimeUrl = `http://127.0.0.1:${resources.gatewayPort}`;
-      try {
-        // Launch the CES sibling alongside the daemon, in parallel — matching the
-        // Docker topology. The assistant does not spawn its own CES, so a freshly
-        // hatched instance would otherwise come up with CES unavailable.
-        // startCes always launches the CES sibling.
-        const startupResults = await Promise.allSettled([
-          startCes(watch, resources),
-          startLocalDaemon(watch, resources, {
-            defaultWorkspaceConfigPath,
-            requireReady: true,
-            signingKey,
-          }),
-        ]);
-        const startupFailure = startupResults.find(
-          (result): result is PromiseRejectedResult =>
-            result.status === "rejected",
-        );
-        if (startupFailure) {
-          throw startupFailure.reason;
-        }
+  const apiKeyCheck = checkProviderApiKey();
+  if (!apiKeyCheck.hasKey) {
+    reporter.warn(
+      "Warning: No LLM provider API key is configured. The assistant will fail when you try to send a message.",
+    );
+    reporter.warn("  To fix, export your key before running vellum hatch:");
+    reporter.warn("  export ANTHROPIC_API_KEY=<your-key>");
+    reporter.warn("");
+  }
 
-        reporter.progress(4, 6, "Starting gateway...");
-        runtimeUrl = await startGateway(watch, resources, {
-          signingKey,
-          bootstrapSecret,
-          envOverrides: flagEnvVars,
-          requireReady: true,
-        });
-      } catch (error) {
-        reporter.error(
-          `\n❌ Local assistant startup failed — stopping partial processes.`,
-        );
-        await stopLocalProcesses(resources);
-        throw error;
-      }
+  if (!process.env.APP_VERSION) {
+    process.env.APP_VERSION = cliPkg.version;
+  }
 
-      const loopbackUrl = `http://127.0.0.1:${resources.gatewayPort}`;
-      const localEntry: AssistantEntry = {
-        assistantId: instanceName,
-        runtimeUrl,
-        localUrl: `http://127.0.0.1:${resources.gatewayPort}`,
-        cloud: "local",
-        species,
-        hatchedAt: new Date().toISOString(),
-        resources: { ...resources, signingKey },
-        guardianBootstrapSecret: bootstrapSecret,
-      };
-
-      reporter.progress(5, 6, "Saving configuration...");
-      saveAssistantEntry(localEntry);
-      setActiveAssistant(instanceName);
-
-      return { resources, runtimeUrl, loopbackUrl, bootstrapSecret };
+  reporter.progress(2, 6, "Writing configuration...");
+  const hatchConfigValues = buildHatchConfigValues(configValues, provider);
+  const defaultWorkspaceConfigPath = writeInitialConfig(hatchConfigValues);
+
+  reporter.progress(3, 6, "Starting assistant...");
+  const signingKey = generateLocalSigningKey();
+  const bootstrapSecret = generateLocalSigningKey();
+  // Launch the CES sibling alongside the daemon, in parallel — matching the
+  // Docker topology. The assistant does not spawn its own CES, so a freshly
+  // hatched instance would otherwise come up with CES unavailable.
+  // startCes always launches the CES sibling.
+  await Promise.all([
+    startCes(watch, resources),
+    startLocalDaemon(watch, resources, {
+      defaultWorkspaceConfigPath,
+      signingKey,
+    }),
+  ]);
+
+  reporter.progress(4, 6, "Starting gateway...");
+  let runtimeUrl = `http://127.0.0.1:${resources.gatewayPort}`;
+  try {
+    runtimeUrl = await startGateway(watch, resources, {
+      signingKey,
+      bootstrapSecret,
+      envOverrides: flagEnvVars,
     });
+  } catch (error) {
+    // Gateway failed — stop the daemon we just started so we don't leave
+    // orphaned processes with no lock file entry.
+    reporter.error(
+      `\n❌ Gateway startup failed — stopping assistant to avoid orphaned processes.`,
+    );
+    await stopLocalProcesses(resources);
+    throw error;
+  }
 
   // Lease a guardian token so the desktop app can import it on first launch
   // instead of hitting /v1/guardian/init itself. Use loopback to satisfy
   // the daemon's local-only check — the mDNS runtimeUrl resolves to a LAN
   // IP which the daemon rejects as non-loopback.
-  reporter.progress(6, 6, "Securing connection...");
+  reporter.progress(5, 6, "Securing connection...");
+  const loopbackUrl = `http://127.0.0.1:${resources.gatewayPort}`;
   const maxLeaseAttempts = 3;
   let guardianAccessToken: string | undefined;
   for (let attempt = 1; attempt <= maxLeaseAttempts; attempt++) {
@@ -318,6 +290,22 @@ export async function hatchLocal(
     }
   }
 
+  // Auto-start ngrok if webhook integrations (e.g. Telegram, Twilio) are configured.
+  const localEntry: AssistantEntry = {
+    assistantId: instanceName,
+    runtimeUrl,
+    localUrl: `http://127.0.0.1:${resources.gatewayPort}`,
+    cloud: "local",
+    species,
+    hatchedAt: new Date().toISOString(),
+    resources: { ...resources, signingKey },
+    guardianBootstrapSecret: bootstrapSecret,
+  };
+
+  reporter.progress(6, 6, "Saving configuration...");
+  saveAssistantEntry(localEntry);
+  setActiveAssistant(instanceName);
+
   if (process.env.VELLUM_DESKTOP_APP) {
     installCLISymlink();
   }

package/src/lib/local.ts

@@ -548,7 +548,6 @@ export function generateLocalSigningKey(): string {
 type DaemonStartOptions = {
   foreground?: boolean;
   defaultWorkspaceConfigPath?: string;
-  requireReady?: boolean;
   signingKey?: string;
 };
 
@@ -598,10 +597,7 @@ function applyDaemonEnvOverrides(
   applyIpcSocketDirOverride(env);
 }
 
-function logDaemonReadiness(
-  readiness: DaemonReadiness,
-  requireReady = false,
-): void {
+function logDaemonReadiness(readiness: DaemonReadiness): void {
   switch (readiness) {
     case "ready":
       console.log("   Assistant ready\n");
@@ -617,11 +613,6 @@ function logDaemonReadiness(
       );
       break;
     default:
-      if (requireReady) {
-        throw new Error(
-          "Assistant did not bind its local port within 60 seconds.",
-        );
-      }
       console.log(
         "   ⚠️  Assistant did not become ready within 60s — continuing anyway\n",
       );
@@ -1329,7 +1320,6 @@ export async function startLocalDaemon(
           resources.daemonPort,
           Date.now() + 60000,
         ),
-        options?.requireReady,
       );
     }
     return;
@@ -1372,7 +1362,6 @@ export async function startLocalDaemon(
         // classifies it without blocking on an in-flight migration.
         logDaemonReadiness(
           await probeDaemonReadinessWithRetry(resources.daemonPort),
-          options?.requireReady,
         );
         return;
       }
@@ -1524,7 +1513,7 @@ export async function startLocalDaemon(
         readiness = await probeDaemonReadiness(resources.daemonPort);
       }
 
-      logDaemonReadiness(readiness, options?.requireReady);
+      logDaemonReadiness(readiness);
     }
   } else {
     console.log("🔨 Starting local assistant...");
@@ -1546,7 +1535,6 @@ export async function startLocalDaemon(
           resources.daemonPort,
           Date.now() + 60000,
         ),
-        options?.requireReady,
       );
     }
   }
@@ -1559,7 +1547,6 @@ export async function startGateway(
     signingKey?: string;
     bootstrapSecret?: string;
     envOverrides?: Record<string, string>;
-    requireReady?: boolean;
   },
 ): Promise<string> {
   const effectiveGatewayPort = resources?.gatewayPort ?? GATEWAY_PORT;
@@ -1689,11 +1676,6 @@ export async function startGateway(
   // connection-refused errors.
   const ready = await waitForDaemonReady(effectiveGatewayPort, 30000);
   if (!ready) {
-    if (options?.requireReady) {
-      throw new Error(
-        "Assistant gateway did not bind its local port within 30 seconds.",
-      );
-    }
     console.warn(
       "⚠ Gateway started but health check did not respond within 30s",
     );

package/src/lib/nginx-ingress.ts

@@ -17,7 +17,6 @@ import { createRequire } from "node:module";
 import { dirname, join } from "node:path";
 
 import { GATEWAY_PORT } from "./constants.js";
-import { waitForDaemonReady } from "./http-client.js";
 import { loadRawConfig, saveRawConfig } from "./ingress-config.js";
 
 /**
@@ -541,95 +540,6 @@ export async function stopIngressNginx(workspaceDir: string): Promise<boolean> {
   return true;
 }
 
-/** Probe budget for confirming the freshly-spawned edge answers /healthz. */
-export const INGRESS_READY_TIMEOUT_MS = 5_000;
-
-/**
- * Outcome of an attempt to bring up the remote-web nginx ingress edge. Callers
- * render their own messaging per variant: `nginx-ingress up` prints
- * install/build guidance and exits non-zero, while the wake restore path warns
- * and continues.
- */
-export type StartRemoteWebIngressResult =
-  | {
-      status: "started";
-      listenPort: number;
-      webDistDir: string;
-      version: string;
-    }
-  | { status: "already-running"; listenPort: number }
-  | { status: "nginx-missing" }
-  | { status: "web-dist-missing" }
-  | { status: "unreachable"; listenPort: number; logPath: string };
-
-/**
- * Generate the nginx config and start the remote-web ingress edge, then probe
- * /healthz through it to prove the ingress → gateway path is live. A spawned
- * but unreachable nginx is rolled back so a failed attempt leaves no half-up
- * edge behind.
- *
- * Pure mechanism: it performs no console output and never exits the process, so
- * both the `nginx-ingress up` command and the wake restore path can share one
- * implementation and map the returned result to their own UX.
- */
-export async function startRemoteWebIngress(opts: {
-  workspaceDir: string;
-  gatewayPort: number;
-  listenPort?: number;
-  readyTimeoutMs?: number;
-  /**
-   * Invoked once, after every preflight check passes and immediately before
-   * nginx is spawned, so callers can emit their own "starting" progress line
-   * with the resolved version/dist/port. Never fires on a preflight bail-out
-   * (nginx-missing, already-running, web-dist-missing).
-   */
-  onStarting?: (info: {
-    version: string;
-    webDistDir: string;
-    listenPort: number;
-  }) => void;
-}): Promise<StartRemoteWebIngressResult> {
-  const listenPort = opts.listenPort ?? getNginxIngressPort();
-
-  const version = getNginxVersion();
-  if (!version) {
-    return { status: "nginx-missing" };
-  }
-
-  if (isIngressRunning(opts.workspaceDir)) {
-    return { status: "already-running", listenPort };
-  }
-
-  const webDistDir = findWebDistDir();
-  if (!webDistDir) {
-    return { status: "web-dist-missing" };
-  }
-
-  opts.onStarting?.({ version, webDistDir, listenPort });
-
-  const child = startIngressNginx({
-    workspaceDir: opts.workspaceDir,
-    gatewayPort: opts.gatewayPort,
-    listenPort,
-    remoteWebIngress: { webDistDir },
-  });
-  child.unref();
-
-  // /healthz proxies through nginx to the gateway, so a 200 proves the whole
-  // ingress → gateway path works.
-  const ready = await waitForDaemonReady(
-    listenPort,
-    opts.readyTimeoutMs ?? INGRESS_READY_TIMEOUT_MS,
-  );
-  if (!ready) {
-    const { logPath } = getIngressPaths(opts.workspaceDir);
-    await stopIngressNginx(opts.workspaceDir);
-    return { status: "unreachable", listenPort, logPath };
-  }
-
-  return { status: "started", listenPort, webDistDir, version };
-}
-
 /**
  * Resolve the local port a tunnel should target: the nginx ingress when it is
  * recorded AND its process is alive, otherwise the gateway port directly