@vellumai/cli 0.10.6 → 0.10.7-dev.202607072325.09ad030

package/src/lib/http-client.ts

@@ -1,5 +1,7 @@
 import { loopbackSafeFetch } from "./loopback-fetch.js";
 
+export type HttpProbeEndpoint = "healthz" | "readyz";
+
 /**
  * Build the base URL for the daemon HTTP server.
  */
@@ -7,16 +9,13 @@ export function buildDaemonUrl(port: number): string {
   return `http://127.0.0.1:${port}`;
 }
 
-/**
- * Perform an HTTP health check against the daemon's `/healthz` endpoint.
- * Returns true if the daemon responds with HTTP 200, false otherwise.
- */
-export async function httpHealthCheck(
+async function httpProbe(
   port: number,
-  timeoutMs = 1500,
+  endpoint: HttpProbeEndpoint,
+  timeoutMs: number,
 ): Promise<boolean> {
   try {
-    const url = `${buildDaemonUrl(port)}/healthz`;
+    const url = `${buildDaemonUrl(port)}/${endpoint}`;
     const response = await loopbackSafeFetch(url, {
       signal: AbortSignal.timeout(timeoutMs),
     });
@@ -27,21 +26,118 @@ export async function httpHealthCheck(
 }
 
 /**
- * Poll the daemon's `/healthz` endpoint until it responds with 200 or the
- * timeout is reached.
+ * Perform an HTTP health check against the daemon's `/healthz` endpoint.
+ * Returns true if the daemon responds with HTTP 200, false otherwise.
+ */
+export async function httpHealthCheck(
+  port: number,
+  timeoutMs = 1500,
+): Promise<boolean> {
+  return httpProbe(port, "healthz", timeoutMs);
+}
+
+/**
+ * Poll a daemon probe endpoint until it responds with 200 or the timeout is
+ * reached.
  *
- * Returns true if the daemon became healthy within the timeout, false otherwise.
+ * Returns true if the daemon became ready within the timeout, false otherwise.
  */
 export async function waitForDaemonReady(
   port: number,
   timeoutMs = 60000,
+  endpoint: HttpProbeEndpoint = "healthz",
 ): Promise<boolean> {
   const start = Date.now();
   while (Date.now() - start < timeoutMs) {
-    if (await httpHealthCheck(port)) {
+    if (await httpProbe(port, endpoint, 1500)) {
       return true;
     }
     await new Promise((r) => setTimeout(r, 250));
   }
   return false;
 }
+
+/**
+ * Migration-aware daemon readiness, derived from the `/readyz` BODY rather
+ * than its status code. The status code is the k8s contract — 200 while
+ * migrations run so the pod stays in service, 503 only on migration failure —
+ * so `response.ok` alone cannot distinguish "ready" from "still migrating".
+ */
+export type DaemonReadiness = "ready" | "migrating" | "failed" | "unreachable";
+
+/**
+ * Classify a `/readyz` response (daemon-direct or proxied through the
+ * gateway, which forwards the assistant's readiness body). Shared by the
+ * local daemon probe and the docker upgrade/hatch readiness waits so there is
+ * exactly one reader of the readiness wire shape.
+ *
+ * Any HTTP-answered response proves the daemon is alive, so a non-ready
+ * answer without a failed-migrations body classifies as "migrating" — this
+ * covers legacy daemons whose strict `/readyz` returns 503 with a `notReady`
+ * body throughout startup. "unreachable" is reserved for the no-answer case
+ * (the caller's fetch threw).
+ */
+export function classifyReadyzResponse(
+  ok: boolean,
+  body: unknown,
+): Exclude<DaemonReadiness, "unreachable"> {
+  const readiness = body as {
+    ready?: boolean;
+    dbMigrations?: { state?: string };
+  } | null;
+  if (readiness?.dbMigrations?.state === "failed") return "failed";
+  // A 200 with no explicit `ready: false` counts as ready — this also
+  // covers daemons that predate the migration-state body.
+  if (ok && readiness?.ready !== false) return "ready";
+  return "migrating";
+}
+
+/** Single `/readyz` probe, classified from the response body. */
+export async function probeDaemonReadiness(
+  port: number,
+  timeoutMs = 1500,
+): Promise<DaemonReadiness> {
+  try {
+    const response = await loopbackSafeFetch(`${buildDaemonUrl(port)}/readyz`, {
+      signal: AbortSignal.timeout(timeoutMs),
+    });
+    const body = (await response.json().catch(() => null)) as unknown;
+    return classifyReadyzResponse(response.ok, body);
+  } catch {
+    return "unreachable";
+  }
+}
+
+/**
+ * `probeDaemonReadiness` with one retry on a transient timeout: a single
+ * probe's 1.5s budget can elapse while a synchronous migration step blocks
+ * the daemon's event loop, misreporting a live daemon as unreachable.
+ */
+export async function probeDaemonReadinessWithRetry(
+  port: number,
+): Promise<DaemonReadiness> {
+  const first = await probeDaemonReadiness(port);
+  if (first !== "unreachable") {
+    return first;
+  }
+  return probeDaemonReadiness(port);
+}
+
+/**
+ * Poll `/readyz` until the daemon is ready, its migrations have terminally
+ * FAILED (returned immediately — failed never recovers without a restart, so
+ * waiting out the deadline would be pure delay), or `deadlineMs` passes.
+ * Returns the last observed readiness.
+ */
+export async function waitForDaemonMigrationsReady(
+  port: number,
+  deadlineMs: number,
+): Promise<DaemonReadiness> {
+  let last: DaemonReadiness = "unreachable";
+  for (;;) {
+    last = await probeDaemonReadiness(port);
+    if (last === "ready" || last === "failed") return last;
+    if (Date.now() >= deadlineMs) return last;
+    await new Promise((r) => setTimeout(r, 250));
+  }
+}

package/src/lib/local.ts

@@ -18,9 +18,17 @@ import {
   type LocalInstanceResources,
 } from "./assistant-config.js";
 import { GATEWAY_PORT } from "./constants.js";
-import { httpHealthCheck, waitForDaemonReady } from "./http-client.js";
+import {
+  type DaemonReadiness,
+  httpHealthCheck,
+  probeDaemonReadiness,
+  probeDaemonReadinessWithRetry,
+  waitForDaemonMigrationsReady,
+  waitForDaemonReady,
+} from "./http-client.js";
 import { stopIngressNginx } from "./nginx-ingress.js";
 import {
+  type ProcessState,
   resolveProcessState,
   stopProcess,
   stopProcessByPidFile,
@@ -565,32 +573,55 @@ function applyDaemonEnvOverrides(
     env.VELLUM_DEFAULT_WORKSPACE_CONFIG_PATH =
       options.defaultWorkspaceConfigPath;
   }
-  // When the CLI launches CES as a sibling (CES_STANDALONE), pin the daemon to
-  // the exact socket the sibling binds so the two agree regardless of any stale
-  // CES_LOCAL_SOCKET inherited from the parent environment. The assistant then
-  // connects to the sibling instead of spawning its own CES.
-  if (isCesSiblingOptIn()) {
-    env.CES_STANDALONE = "1";
-    env.CES_LOCAL_SOCKET = resolveCesSocketPath(resources);
-  }
+  // Pin the daemon to the exact socket the sibling binds so the two agree
+  // regardless of any stale CES_LOCAL_SOCKET inherited from the parent
+  // environment. The assistant connects to the sibling instead of spawning
+  // its own CES.
+  env.CES_STANDALONE = "1";
+  env.CES_LOCAL_SOCKET = resolveCesSocketPath(resources);
   applyIpcSocketDirOverride(env);
 }
 
-function logDaemonReadiness(ready: boolean): void {
-  if (ready) {
-    console.log("   Assistant ready\n");
-  } else {
-    console.log(
-      "   ⚠️  Assistant did not become ready within 60s — continuing anyway\n",
-    );
+function logDaemonReadiness(readiness: DaemonReadiness): void {
+  switch (readiness) {
+    case "ready":
+      console.log("   Assistant ready\n");
+      break;
+    case "migrating":
+      console.log(
+        "   Assistant is up — database migrations still running; DB-backed commands return 503 until they finish\n",
+      );
+      break;
+    case "failed":
+      console.log(
+        "   ⚠️  Assistant database migrations FAILED — DB-backed commands return 503 until the assistant is restarted\n",
+      );
+      break;
+    default:
+      console.log(
+        "   ⚠️  Assistant did not become ready within 60s — continuing anyway\n",
+      );
   }
 }
 
+function logAssistantAlreadyRunning(
+  pid: number,
+  status: ProcessState["status"],
+): void {
+  const suffix =
+    status === "migration_failed"
+      ? " but its database migrations failed — restart to recover"
+      : status === "unready"
+        ? " — database migrations still running"
+        : "";
+  console.log(`   Assistant already running (pid ${pid})${suffix}\n`);
+}
+
 async function startDaemonFromSource(
   assistantIndex: string,
   resources: LocalInstanceResources,
   options?: DaemonStartOptions,
-): Promise<void> {
+): Promise<boolean> {
   const foreground = options?.foreground ?? false;
   const daemonMainPath = resolveDaemonMainPath(assistantIndex);
 
@@ -600,19 +631,21 @@ async function startDaemonFromSource(
   mkdirSync(dirname(pidFile), { recursive: true });
 
   // --- Lifecycle guard: prevent split-brain daemon state ---
-  if (await awaitStartingSentinel(pidFile, resources.daemonPort)) return;
+  if (await awaitStartingSentinel(pidFile, resources.daemonPort)) return false;
 
   const daemonState = await resolveProcessState(
     pidFile,
     resources.daemonPort,
     "Assistant",
+    60_000,
+    "readyz",
   );
-  if (daemonState.status === "healthy") {
-    console.log(`   Assistant already running (pid ${daemonState.pid})\n`);
-    return;
+  if (daemonState.status !== "needs_start") {
+    logAssistantAlreadyRunning(daemonState.pid, daemonState.status);
+    return false;
   }
 
-  if (await checkOrphanedDaemon(pidFile, resources.daemonPort)) return;
+  if (await checkOrphanedDaemon(pidFile, resources.daemonPort)) return false;
 
   const env: Record<string, string | undefined> = {
     ...process.env,
@@ -653,6 +686,7 @@ async function startDaemonFromSource(
       unlinkSync(pidFile);
     } catch {}
   }
+  return true;
 }
 
 // NOTE: startDaemonWatchFromSource() is the CLI-side watch-mode daemon
@@ -663,7 +697,7 @@ async function startDaemonWatchFromSource(
   assistantIndex: string,
   resources: LocalInstanceResources,
   options?: DaemonStartOptions,
-): Promise<void> {
+): Promise<boolean> {
   const mainPath = resolveDaemonMainPath(assistantIndex);
   if (!existsSync(mainPath)) {
     throw new Error(`Daemon main.ts not found at ${mainPath}`);
@@ -673,19 +707,21 @@ async function startDaemonWatchFromSource(
   mkdirSync(dirname(pidFile), { recursive: true });
 
   // --- Lifecycle guard: prevent split-brain daemon state ---
-  if (await awaitStartingSentinel(pidFile, resources.daemonPort)) return;
+  if (await awaitStartingSentinel(pidFile, resources.daemonPort)) return false;
 
   const daemonState = await resolveProcessState(
     pidFile,
     resources.daemonPort,
     "Assistant",
+    60_000,
+    "readyz",
   );
-  if (daemonState.status === "healthy") {
-    console.log(`   Assistant already running (pid ${daemonState.pid})\n`);
-    return;
+  if (daemonState.status !== "needs_start") {
+    logAssistantAlreadyRunning(daemonState.pid, daemonState.status);
+    return false;
   }
 
-  if (await checkOrphanedDaemon(pidFile, resources.daemonPort)) return;
+  if (await checkOrphanedDaemon(pidFile, resources.daemonPort)) return false;
 
   const env: Record<string, string | undefined> = {
     ...process.env,
@@ -719,6 +755,7 @@ async function startDaemonWatchFromSource(
   }
 
   console.log("   Assistant started in watch mode (bun --watch)");
+  return true;
 }
 
 function resolveGatewayDir(resources?: LocalInstanceResources): string {
@@ -811,19 +848,9 @@ function resolveCesSocketPath(resources?: LocalInstanceResources): string {
 }
 
 /**
- * Whether the CLI should launch CES as an independent sibling process instead
- * of leaving the assistant to spawn it as an stdio child. Temporary opt-in
- * (`CES_STANDALONE=1`) while local CES converges onto the sibling model that
- * containerized homes already use.
- */
-function isCesSiblingOptIn(): boolean {
-  return process.env.CES_STANDALONE === "1";
-}
-
-/**
- * Launch the local CES sibling over a Unix socket (opted into via
- * `CES_STANDALONE=1`). No-op unless the opt-in is set, in which case the
- * assistant continues to spawn CES itself as today.
+ * Launch the local CES sibling over a Unix socket. The sibling model is now
+ * the default topology for local (non-containerized) instances, matching how
+ * containerized homes already run CES.
  *
  * The sibling runs with `CES_STANDALONE=1` so its lifecycle is anchored to
  * SIGTERM rather than stdin EOF, mirroring the gateway: a CLI-owned process
@@ -834,8 +861,6 @@ export async function startCes(
   watch: boolean = false,
   resources?: LocalInstanceResources,
 ): Promise<void> {
-  if (!isCesSiblingOptIn()) return;
-
   const vellumDir = resources
     ? join(resources.instanceDir, ".vellum")
     : join(homedir(), ".vellum");
@@ -996,8 +1021,14 @@ async function awaitStartingSentinel(
   }
 
   console.log("   Assistant is starting — waiting for it to become ready...");
-  if (await waitForDaemonReady(daemonPort, 60000)) {
-    console.log("   Assistant is ready\n");
+  const readiness = await waitForDaemonMigrationsReady(
+    daemonPort,
+    Date.now() + 60000,
+  );
+  if (readiness !== "unreachable") {
+    // The daemon exists and is answering — migrating and failed states must
+    // NOT fall through to a second spawn (split-brain). Report honestly.
+    logDaemonReadiness(readiness);
     return true;
   }
   try {
@@ -1264,8 +1295,20 @@ export async function startLocalDaemon(
     : undefined;
   if (runtimeAssistantIndex) {
     console.log("🔨 Starting local assistant runtime...");
-    await startDaemonFromSource(runtimeAssistantIndex, resources, options);
-    logDaemonReadiness(await waitForDaemonReady(resources.daemonPort, 60000));
+    // Wait for readiness only after an actual spawn — an attach to an
+    // already-running daemon was classified and logged inside
+    // startDaemonFromSource, and re-waiting would just block on a migration
+    // the user was already told about.
+    if (
+      await startDaemonFromSource(runtimeAssistantIndex, resources, options)
+    ) {
+      logDaemonReadiness(
+        await waitForDaemonMigrationsReady(
+          resources.daemonPort,
+          Date.now() + 60000,
+        ),
+      );
+    }
     return;
   }
 
@@ -1291,15 +1334,22 @@ export async function startLocalDaemon(
       pidFile,
       resources.daemonPort,
       "Assistant",
+      60_000,
+      "readyz",
     );
-    const daemonAlive = daemonState.status === "healthy";
+    const daemonAlive = daemonState.status !== "needs_start";
     if (daemonAlive) {
-      console.log(`   Assistant already running (pid ${daemonState.pid})\n`);
+      logAssistantAlreadyRunning(daemonState.pid, daemonState.status);
     }
 
     if (!daemonAlive) {
       if (await checkOrphanedDaemon(pidFile, resources.daemonPort)) {
         ensureBunInstalled();
+        // The orphan already answers health checks — a readiness probe
+        // classifies it without blocking on an in-flight migration.
+        logDaemonReadiness(
+          await probeDaemonReadinessWithRetry(resources.daemonPort),
+        );
         return;
       }
 
@@ -1400,29 +1450,56 @@ export async function startLocalDaemon(
     }
 
     // Wait for daemon to respond on HTTP (up to 60s — fresh installs
-    // may need 30-60s for Qdrant download, migrations, and first-time init)
-    let daemonReady = await waitForDaemonReady(resources.daemonPort, 60000);
-
-    // Dev fallback: if the bundled daemon did not become ready in time,
-    // fall back to source daemon startup so local source runs still work.
-    if (!daemonReady) {
-      const assistantIndex = resolveAssistantIndexPath(resources);
-      if (assistantIndex) {
-        console.log(
-          "   Bundled assistant not ready after 60s — falling back to source assistant...",
-        );
-        // Kill the bundled daemon to avoid two processes competing for the same port
-        await stopProcessByPidFile(pidFile, "bundled daemon");
-        if (watch) {
-          await startDaemonWatchFromSource(assistantIndex, resources, options);
-        } else {
-          await startDaemonFromSource(assistantIndex, resources, options);
+    // may need 30-60s for Qdrant download, migrations, and first-time init).
+    // "migrating" and "failed" both mean the daemon is up and answering, so
+    // they don't trigger the source fallback (a restart against the same DB
+    // would reproduce the same migration state).
+    //
+    // Runs only after a fresh spawn: an attached daemon was already
+    // classified and logged by resolveProcessState above, and re-waiting on
+    // its in-flight migration would just double the reported diagnosis.
+    if (!daemonAlive) {
+      let readiness = await waitForDaemonMigrationsReady(
+        resources.daemonPort,
+        Date.now() + 60000,
+      );
+      const daemonHealthy =
+        readiness !== "unreachable" ||
+        (await httpHealthCheck(resources.daemonPort));
+
+      // Dev fallback: if the bundled daemon did not become healthy in time,
+      // fall back to source daemon startup so local source runs still work.
+      if (!daemonHealthy) {
+        const assistantIndex = resolveAssistantIndexPath(resources);
+        if (assistantIndex) {
+          console.log(
+            "   Bundled assistant not healthy after 60s — falling back to source assistant...",
+          );
+          // Kill the bundled daemon to avoid two processes competing for the same port
+          await stopProcessByPidFile(pidFile, "bundled daemon");
+          if (watch) {
+            await startDaemonWatchFromSource(
+              assistantIndex,
+              resources,
+              options,
+            );
+          } else {
+            await startDaemonFromSource(assistantIndex, resources, options);
+          }
+          readiness = await waitForDaemonMigrationsReady(
+            resources.daemonPort,
+            Date.now() + 60000,
+          );
         }
-        daemonReady = await waitForDaemonReady(resources.daemonPort, 60000);
+      } else if (readiness === "unreachable") {
+        // The health check just passed, so the readyz probes were the flaky
+        // part — re-probe once so the log reports the daemon's real state
+        // instead of "did not become ready".
+        readiness = await probeDaemonReadiness(resources.daemonPort);
       }
-    }
 
-    logDaemonReadiness(daemonReady);
+      logDaemonReadiness(readiness);
+    }
   } else {
     console.log("🔨 Starting local assistant...");
 
@@ -1433,12 +1510,18 @@ export async function startLocalDaemon(
           "  Ensure the daemon binary is bundled alongside the CLI, or run from the source tree.",
       );
     }
-    if (watch) {
-      await startDaemonWatchFromSource(assistantIndex, resources, options);
-    } else {
-      await startDaemonFromSource(assistantIndex, resources, options);
+    const spawned = watch
+      ? await startDaemonWatchFromSource(assistantIndex, resources, options)
+      : await startDaemonFromSource(assistantIndex, resources, options);
+    // Attach case was classified and logged inside the start function.
+    if (spawned) {
+      logDaemonReadiness(
+        await waitForDaemonMigrationsReady(
+          resources.daemonPort,
+          Date.now() + 60000,
+        ),
+      );
     }
-    logDaemonReadiness(await waitForDaemonReady(resources.daemonPort, 60000));
   }
 }
 

package/src/lib/process.ts

@@ -1,7 +1,12 @@
 import { execFileSync } from "child_process";
 import { existsSync, readFileSync, unlinkSync } from "fs";
 
-import { httpHealthCheck, waitForDaemonReady } from "./http-client.js";
+import {
+  httpHealthCheck,
+  type HttpProbeEndpoint,
+  probeDaemonReadinessWithRetry,
+  waitForDaemonReady,
+} from "./http-client.js";
 
 /**
  * Verify that a PID belongs to a vellum-related process by inspecting its
@@ -78,31 +83,43 @@ export async function isProcessHealthy(
 
 /**
  * Outcome of {@link resolveProcessState}. Callers switch on `status`:
- * - `"healthy"` — process is alive and responding; `pid` is the live PID.
+ * - `"healthy"` — process is alive and ready; `pid` is the live PID.
+ * - `"unready"` — process is alive and healthy, but DB migrations were still
+ *   running when the readiness wait elapsed.
+ * - `"migration_failed"` — process is alive and healthy, but its DB migrations
+ *   failed: a terminal state that never recovers without a restart. The
+ *   process is kept alive (same keep-alive rule as `"unready"`).
  * - `"needs_start"` — process was dead, hung (and killed), or a stale PID
  *   was cleaned up. Caller should start a fresh process.
  */
 export type ProcessState =
   | { status: "healthy"; pid: number }
+  | { status: "unready"; pid: number }
+  | { status: "migration_failed"; pid: number }
   | { status: "needs_start"; pid: number | null };
 
 /**
- * Determine whether a PID-tracked process is alive and healthy. If the
- * process exists but is unresponsive, waits up to `readinessWaitMs`
- * (default 60s — matches the spawner's own `waitForDaemonReady` timeout
- * so a concurrent caller never kills a daemon the spawner is still
- * waiting on) for it to finish initializing. If it remains unresponsive,
- * verifies it belongs to Vellum before killing it, then cleans up the
- * PID file.
+ * Determine whether a PID-tracked process is alive and healthy. If the process
+ * exists but is unresponsive, waits up to `readinessWaitMs` (default 60s —
+ * matches the spawner's own `waitForDaemonReady` timeout so a concurrent
+ * caller never kills a process the spawner is still waiting on) for it to
+ * start answering health checks. If it remains unresponsive, verifies it
+ * belongs to Vellum before killing it, then cleans up the PID file.
  *
- * Encapsulates the full health → readiness-wait → guard → kill → cleanup
- * flow so callers don't need to reimplement it.
+ * When callers pass the `"readyz"` readiness endpoint, this also CLASSIFIES
+ * DB migration readiness with a single `/readyz` probe (read from the body —
+ * the status code stays 200 during migrations for k8s). It never waits for
+ * readiness: the kill/keep decision depends only on the health check, and
+ * callers that want to wait out a migration own that wait themselves. A
+ * health-checking process is kept alive when migrations are running or
+ * failed.
  */
 export async function resolveProcessState(
   pidFile: string,
   healthPort: number,
   label: string,
   readinessWaitMs: number = 60_000,
+  readinessEndpoint: HttpProbeEndpoint = "healthz",
 ): Promise<ProcessState> {
   const result = await isProcessHealthy(pidFile, healthPort);
 
@@ -110,29 +127,52 @@ export async function resolveProcessState(
     return { status: "needs_start", pid: null };
   }
 
-  if (result.healthy) {
-    return { status: "healthy", pid: result.pid };
+  if (!result.healthy) {
+    // Alive but not healthy — may still be starting up.
+    const becameHealthy = await waitForDaemonReady(
+      healthPort,
+      readinessWaitMs,
+      "healthz",
+    );
+    if (!becameHealthy) {
+      // Genuinely hung — kill if it belongs to Vellum, otherwise just clean up.
+      if (isVellumProcess(result.pid)) {
+        console.log(
+          `${label} process alive (pid ${result.pid}) but not responding — killing and restarting...`,
+        );
+        await stopProcess(result.pid, label);
+      } else {
+        console.log(
+          `Stale PID file (pid ${result.pid} is not a Vellum process) — cleaning up...`,
+        );
+      }
+      removeFiles(pidFile);
+      return { status: "needs_start", pid: result.pid };
+    }
   }
 
-  // Alive but not healthy — may still be starting up.
-  const becameHealthy = await waitForDaemonReady(healthPort, readinessWaitMs);
-  if (becameHealthy) {
-    return { status: "healthy", pid: result.pid };
+  if (readinessEndpoint !== "healthz") {
+    const readiness = await probeDaemonReadinessWithRetry(healthPort);
+    if (readiness === "failed") {
+      return { status: "migration_failed", pid: result.pid };
+    }
+    if (readiness === "unreachable") {
+      // The daemon answered the health check moments ago but not /readyz —
+      // it may have died in between (e.g. OOM during a heavy migration).
+      // Re-verify liveness before reporting it alive, so callers don't skip
+      // starting a replacement for a dead process.
+      if (!isProcessAlive(pidFile).alive) {
+        removeFiles(pidFile);
+        return { status: "needs_start", pid: result.pid };
+      }
+      return { status: "unready", pid: result.pid };
+    }
+    if (readiness !== "ready") {
+      return { status: "unready", pid: result.pid };
+    }
   }
 
-  // Genuinely hung — kill if it belongs to Vellum, otherwise just clean up.
-  if (isVellumProcess(result.pid)) {
-    console.log(
-      `${label} process alive (pid ${result.pid}) but not responding — killing and restarting...`,
-    );
-    await stopProcess(result.pid, label);
-  } else {
-    console.log(
-      `Stale PID file (pid ${result.pid} is not a Vellum process) — cleaning up...`,
-    );
-  }
-  removeFiles(pidFile);
-  return { status: "needs_start", pid: result.pid };
+  return { status: "healthy", pid: result.pid };
 }
 
 /**