@vellumai/cli 0.10.5-dev.202607051531.dbb8c59 → 0.10.5-dev.202607051730.b756a91

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vellumai/cli",
-  "version": "0.10.5-dev.202607051531.dbb8c59",
+  "version": "0.10.5-dev.202607051730.b756a91",
   "description": "CLI tools for vellum-assistant",
   "type": "module",
   "exports": {

package/src/__tests__/wake.test.ts

@@ -90,11 +90,16 @@ const resolveProcessStateMock = mock<typeof processLib.resolveProcessState>(
 const stopProcessByPidFileMock = mock<typeof processLib.stopProcessByPidFile>(
   async () => true,
 );
+const isProcessAliveMock = mock<typeof processLib.isProcessAlive>(() => ({
+  alive: false,
+  pid: null,
+}));
 
 mock.module("../lib/process", () => ({
   ...realProcessLib,
   resolveProcessState: resolveProcessStateMock,
   stopProcessByPidFile: stopProcessByPidFileMock,
+  isProcessAlive: isProcessAliveMock,
 }));
 
 const generateLocalSigningKeyMock = mock<typeof local.generateLocalSigningKey>(
@@ -110,6 +115,7 @@ const startLocalDaemonMock = mock<typeof local.startLocalDaemon>(async () => {})
 const startGatewayMock = mock<typeof local.startGateway>(
   async () => "http://127.0.0.1:7830",
 );
+const startCesMock = mock<typeof local.startCes>(async () => {});
 
 mock.module("../lib/local", () => ({
   ...realLocal,
@@ -118,6 +124,7 @@ mock.module("../lib/local", () => ({
   isGatewayWatchModeAvailable: isGatewayWatchModeAvailableMock,
   startLocalDaemon: startLocalDaemonMock,
   startGateway: startGatewayMock,
+  startCes: startCesMock,
 }));
 
 const maybeStartNgrokTunnelMock = mock<typeof ngrok.maybeStartNgrokTunnel>(
@@ -184,6 +191,10 @@ beforeEach(() => {
   startLocalDaemonMock.mockResolvedValue(undefined);
   startGatewayMock.mockReset();
   startGatewayMock.mockResolvedValue("http://127.0.0.1:7830");
+  startCesMock.mockReset();
+  startCesMock.mockResolvedValue(undefined);
+  isProcessAliveMock.mockReset();
+  isProcessAliveMock.mockReturnValue({ alive: false, pid: null });
   seedGuardianTokenFromSiblingEnvMock.mockReset();
   seedGuardianTokenFromSiblingEnvMock.mockReturnValue(false);
   loadGuardianTokenMock.mockReset();
@@ -291,4 +302,27 @@ describe("vellum wake", () => {
       "generated-bootstrap-secret",
     );
   });
+
+  test("relaunches CES sibling when daemon is healthy but CES is dead", async () => {
+    // Daemon is healthy (default mock) but CES pid says dead.
+    // isProcessAliveMock defaults to { alive: false }.
+    await wake();
+
+    // startCes should be called to relaunch the dead sibling.
+    expect(startCesMock).toHaveBeenCalledTimes(1);
+    // startLocalDaemon should NOT be called (daemon already running).
+    expect(startLocalDaemonMock).not.toHaveBeenCalled();
+  });
+
+  test("does NOT relaunch CES sibling when both daemon and CES are healthy", async () => {
+    // Daemon is healthy (default mock). CES is also alive.
+    isProcessAliveMock.mockReturnValue({ alive: true, pid: 789 });
+
+    await wake();
+
+    // startCes should NOT be called (CES is alive).
+    expect(startCesMock).not.toHaveBeenCalled();
+    // startLocalDaemon should NOT be called (daemon already running).
+    expect(startLocalDaemonMock).not.toHaveBeenCalled();
+  });
 });

package/src/commands/hatch.ts

@@ -146,7 +146,7 @@ ${userSetup}
 ${envSetLines}
 VELLUM_ASSISTANT_NAME=${instanceName}
 mkdir -p "\$HOME/.config/vellum"
-cat > "\$HOME/.config/vellum/env" << DOTENV_EOF
+cat > "\$HOME/.config/vellum/.env" << DOTENV_EOF
 ${dotenvLines}
 RUNTIME_HTTP_PORT=7821
 DOTENV_EOF

package/src/commands/wake.ts

@@ -12,7 +12,7 @@ import {
   resetGuardianBootstrap,
   seedGuardianTokenFromSiblingEnv,
 } from "../lib/guardian-token.js";
-import { resolveProcessState, stopProcessByPidFile } from "../lib/process";
+import { resolveProcessState, stopProcessByPidFile, isProcessAlive } from "../lib/process";
 import {
   generateLocalSigningKey,
   isAssistantWatchModeAvailable,
@@ -189,6 +189,19 @@ export async function wake(): Promise<void> {
       startCes(watch, resources),
       startLocalDaemon(watch, resources, { foreground, signingKey }),
     ]);
+  } else {
+    // Self-heal: the daemon is already healthy, but the CES sibling may have
+    // died independently (crash, OOM kill). A dead ces.pid under a live daemon
+    // means credential operations will fail until the next wake. Relaunch the
+    // sibling so the daemon's lazy reconnect (secure-keys.ts) picks it up on
+    // the next credential read. startCes is a no-op unless CES_STANDALONE.
+    const vellumDir = join(resources.instanceDir, ".vellum");
+    const cesPidFile = join(vellumDir, "ces.pid");
+    const cesAlive = isProcessAlive(cesPidFile).alive;
+    if (!cesAlive) {
+      console.log("CES sibling not running — relaunching...");
+      await startCes(watch, resources);
+    }
   }
 
   // Start gateway

package/src/index.ts

@@ -1,5 +1,10 @@
 #!/usr/bin/env bun
 
+import { join } from "path";
+import { readFileSync } from "node:fs";
+
+import { resolveConfigDir } from "@vellumai/local-mode";
+
 import cliPkg from "../package.json";
 import { backup } from "./commands/backup";
 import { clean } from "./commands/clean";
@@ -156,6 +161,56 @@ function applyNoColorFlags(argv: string[]): void {
   }
 }
 
+/**
+ * Load env vars from the vellum config dotenv file into `process.env` so
+ * that `vellum hatch` forwards provider API keys to containers and other
+ * commands have access to them.
+ *
+ * Reads `$XDG_CONFIG_HOME/vellum{-env}/.env` — the same config directory
+ * the CLI uses for guardian tokens and environment state. The file is
+ * written by remote-hatch scripts and can be user-managed.
+ *
+ * Existing `process.env` values take precedence (standard dotenv convention).
+ * Only KEY=VALUE lines are parsed. Lines starting with # are comments.
+ * Values may be quoted with single or double quotes.
+ */
+function loadConfigDotenv(): void {
+  const configDir = resolveConfigDir(process.env);
+  const envPath = join(configDir, ".env");
+
+  let content: string;
+  try {
+    content = readFileSync(envPath, "utf-8");
+  } catch {
+    return;
+  }
+
+  for (const line of content.split("\n")) {
+    const trimmed = line.trim();
+    if (!trimmed || trimmed.startsWith("#")) continue;
+
+    const eqIndex = trimmed.indexOf("=");
+    if (eqIndex === -1) continue;
+
+    const key = trimmed.slice(0, eqIndex).trim();
+    if (!key) continue;
+
+    // Existing env vars take precedence (dotenv convention).
+    if (process.env[key] !== undefined) continue;
+
+    let value = trimmed.slice(eqIndex + 1).trim();
+    // Strip surrounding quotes.
+    if (
+      (value.startsWith('"') && value.endsWith('"')) ||
+      (value.startsWith("'") && value.endsWith("'"))
+    ) {
+      value = value.slice(1, -1);
+    }
+
+    process.env[key] = value;
+  }
+}
+
 /**
  * If a running assistant is detected, launch the TUI client and return true.
  * Otherwise return false so the caller can fall back to help text.
@@ -181,6 +236,10 @@ async function tryLaunchClient(): Promise<boolean> {
 }
 
 async function main() {
+  // Load $XDG_CONFIG_HOME/vellum/.env before any command runs so
+  // provider API keys and other config are available to hatch, exec, etc.
+  loadConfigDotenv();
+
   const args = process.argv.slice(2);
 
   // Must run before any command or terminal-capabilities usage