@vellumai/cli 0.10.7-dev.202607081809.214a958 → 0.10.7-dev.202607081935.d1f7c0a

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vellumai/cli",
-  "version": "0.10.7-dev.202607081809.214a958",
+  "version": "0.10.7-dev.202607081935.d1f7c0a",
   "description": "CLI tools for vellum-assistant",
   "type": "module",
   "exports": {

package/src/commands/teleport.ts

@@ -408,11 +408,18 @@ async function exportFromAssistant(
     // Passing the target's runtime URL here keeps upload and download on
     // the same platform — otherwise a non-default/stale platform URL would
     // cause the import to look at an empty object.
+    //
+    // The PUT is performed by the source daemon, not this CLI. A bare-metal
+    // local daemon shares the host's network view, so the client-signed URL
+    // is reachable; a docker daemon runs inside a container and reaches the
+    // host the same way managed pods do, so its URL must be signed for the
+    // runtime-reachable storage endpoint.
     const { url: uploadUrl, bundleKey } = await platformRequestSignedUrl(
       {
         operation: "upload",
         minRuntimeVersion: sourceRuntimeVersion,
         maxRuntimeVersion: null,
+        ...(cloud === "docker" ? { consumer: "runtime" as const } : {}),
       },
       platformToken,
       bundlePlatformUrl,
@@ -510,6 +517,9 @@ async function exportFromAssistant(
         operation: "upload",
         minRuntimeVersion: sourceRuntimeVersion,
         maxRuntimeVersion: null,
+        // The managed pod PUTs the bundle, not this CLI — the URL must be
+        // signed against the runtime-reachable storage endpoint.
+        consumer: "runtime",
       },
       platformToken,
       bundlePlatformUrl,

package/src/lib/docker.ts

@@ -1442,6 +1442,21 @@ export async function hatchDocker(params: HatchDockerParams): Promise<void> {
     }
     const hostDeviceId = getOrCreateHostDeviceId();
     extraAssistantEnv.VELLUM_DEVICE_ID = hostDeviceId;
+    // Forward the migration URL allowlists so a daemon inside the container
+    // can PUT/GET teleport bundles against a local (non-GCS) platform.
+    // Pass-through only: unset in normal use, preserving the strict
+    // GCS-only validator default. A containerized daemon reaches the host
+    // via host.docker.internal, so that is the value to export when
+    // teleporting docker assistants against a local platform.
+    for (const key of [
+      "VELLUM_MIGRATION_EXPORT_ALLOWED_HOSTS",
+      "VELLUM_MIGRATION_IMPORT_ALLOWED_HOSTS",
+    ] as const) {
+      const value = process.env[key];
+      if (value) {
+        extraAssistantEnv[key] = value;
+      }
+    }
     const extraGatewayEnv = {
       ...flagEnvVars,
       VELLUM_DEVICE_ID: hostDeviceId,

package/src/lib/local.ts

@@ -1399,6 +1399,8 @@ export async function startLocalDaemon(
         "VELLUM_DEV",
         "VELLUM_DESKTOP_APP",
         "VELLUM_DISABLE_PLATFORM",
+        "VELLUM_MIGRATION_EXPORT_ALLOWED_HOSTS",
+        "VELLUM_MIGRATION_IMPORT_ALLOWED_HOSTS",
         "VELLUM_WORKSPACE_DIR",
       ]) {
         if (process.env[key]) {

package/src/lib/platform-client.ts

@@ -1027,6 +1027,12 @@ export async function platformRequestSignedUrl(
     maxRuntimeVersion?: string | null;
     // Target-side, download only: runtime version that will import.
     targetRuntimeVersion?: string;
+    // Upload only: who will PUT to the URL. "runtime" signs against the
+    // runtime-reachable storage endpoint so a managed assistant pod can
+    // upload its export bundle (platform→local teleport); defaults to
+    // "client" server-side. No effect in production, where both endpoints
+    // are the same.
+    consumer?: "client" | "runtime";
   },
   token: string,
   platformUrl?: string,
@@ -1054,6 +1060,9 @@ export async function platformRequestSignedUrl(
   if (params.targetRuntimeVersion !== undefined) {
     body.target_runtime_version = params.targetRuntimeVersion;
   }
+  if (params.consumer !== undefined) {
+    body.consumer = params.consumer;
+  }
 
   const doRequest = async (): Promise<Response> =>
     loopbackSafeFetch(`${resolvedUrl}/v1/migrations/signed-url/`, {