@vellumai/cli 0.10.7 → 0.10.8-dev.202607102228.5945895

package/node_modules/@vellumai/local-mode/src/__tests__/gateway-proxy.test.ts

@@ -1,6 +1,12 @@
 import { describe, expect, test } from "bun:test";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
 
-import { resolveGatewayProxyTarget } from "../gateway-proxy";
+import {
+  readAllowedGatewayPorts,
+  resolveGatewayProxyTarget,
+} from "../gateway-proxy";
 
 const allow =
   (...ports: number[]) =>
@@ -64,6 +70,41 @@ describe("resolveGatewayProxyTarget", () => {
     });
   });
 
+  test("allowlists ports from resources, loopback URLs, and docker runtimeUrls — never remote URLs", () => {
+    const dir = fs.mkdtempSync(path.join(os.tmpdir(), "gateway-proxy-test-"));
+    const lockfilePath = path.join(dir, "assistants.json");
+    try {
+      fs.writeFileSync(
+        lockfilePath,
+        JSON.stringify({
+          assistants: [
+            { assistantId: "local-a", resources: { gatewayPort: 7830 } },
+            { assistantId: "local-b", localUrl: "http://127.0.0.1:7831" },
+            // Docker entries record their published gateway only as a
+            // loopback runtimeUrl.
+            {
+              assistantId: "docker-a",
+              cloud: "docker",
+              runtimeUrl: "http://localhost:7930",
+            },
+            // Remote runtimeUrls (managed / gcp / paired) must never widen
+            // the allowlist.
+            {
+              assistantId: "remote-a",
+              cloud: "gcp",
+              runtimeUrl: "https://assistant.example.com:8443",
+            },
+          ],
+        }),
+      );
+      expect(readAllowedGatewayPorts([lockfilePath])).toEqual(
+        new Set([7830, 7831, 7930]),
+      );
+    } finally {
+      fs.rmSync(dir, { recursive: true, force: true });
+    }
+  });
+
   test("never reads the allowlist for non-gateway or invalid-port paths", () => {
     let reads = 0;
     const counting = () => {

package/node_modules/@vellumai/local-mode/src/gateway-proxy.ts

@@ -87,6 +87,7 @@ export function readAllowedGatewayPorts(lockfilePaths: string[]): Set<number> {
         assistants?: Array<{
           gatewayUrl?: unknown;
           localUrl?: unknown;
+          runtimeUrl?: unknown;
           resources?: { gatewayPort?: unknown };
         }>;
       };
@@ -95,6 +96,10 @@ export function readAllowedGatewayPorts(lockfilePaths: string[]): Set<number> {
         if (!assistant) continue;
         addPortFromUrl(assistant.gatewayUrl, ports);
         addPortFromUrl(assistant.localUrl, ports);
+        // Docker entries record their published gateway as a loopback
+        // `runtimeUrl` with no `resources` block; the loopback-hostname filter
+        // in addPortFromUrl keeps remote runtimeUrls out of the allowlist.
+        addPortFromUrl(assistant.runtimeUrl, ports);
         const gp = assistant.resources?.gatewayPort;
         if (typeof gp === "number" && Number.isInteger(gp) && gp >= 1024 && gp <= 65535) {
           ports.add(gp);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vellumai/cli",
-  "version": "0.10.7",
+  "version": "0.10.8-dev.202607102228.5945895",
   "description": "CLI tools for vellum-assistant",
   "type": "module",
   "exports": {

package/src/__tests__/provider-inference-parity.test.ts

@@ -0,0 +1,57 @@
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+import { describe, expect, test } from "bun:test";
+
+import { inferProviderFromModel } from "../lib/provider-secrets.js";
+
+/**
+ * Drift guard for the CLI's model → provider inference heuristic.
+ *
+ * `inferProviderFromModel` mirrors the assistant resolver's
+ * `getCatalogProviderForModel` semantics without importing from
+ * `assistant/src/`: a model ID listed by multiple catalog providers resolves
+ * to the FIRST provider in catalog order (e.g. `anthropic/*` IDs shared by
+ * OpenRouter and the Vercel AI Gateway resolve to openrouter), while an ID
+ * unique to one provider resolves to that provider (e.g. `openai/gpt-5.5` and
+ * `xai/grok-4.3` to vercel-ai-gateway). This test recomputes that expectation
+ * from `meta/llm-provider-catalog.json` for every vendor-prefixed
+ * (slash-containing) model ID and fails if a catalog change breaks the
+ * heuristic.
+ */
+
+const REPO_ROOT = join(import.meta.dir, "..", "..", "..");
+
+interface LlmCatalog {
+  providers: Array<{ id: string; models: Array<{ id: string }> }>;
+}
+
+function loadLlmCatalog(): LlmCatalog {
+  const path = join(REPO_ROOT, "meta", "llm-provider-catalog.json");
+  return JSON.parse(readFileSync(path, "utf-8"));
+}
+
+describe("CLI provider inference parity", () => {
+  test("inferProviderFromModel matches first-catalog-provider resolution for every vendor-prefixed model ID", () => {
+    const catalog = loadLlmCatalog();
+    const expected: Record<string, string> = {};
+    for (const provider of catalog.providers) {
+      for (const model of provider.models) {
+        if (!model.id.includes("/")) {
+          continue;
+        }
+        expected[model.id] ??= provider.id;
+      }
+    }
+
+    // Sanity: the catalog still exercises both the unique-ID and shared-ID
+    // paths this guard exists for.
+    expect(Object.values(expected)).toContain("vercel-ai-gateway");
+    expect(Object.values(expected)).toContain("openrouter");
+
+    const actual: Record<string, string | undefined> = {};
+    for (const modelId of Object.keys(expected)) {
+      actual[modelId] = inferProviderFromModel(modelId);
+    }
+    expect(actual).toEqual(expected);
+  });
+});

package/src/__tests__/recover.test.ts

@@ -30,12 +30,14 @@ const realLocal = {
   generateLocalSigningKey: localModule.generateLocalSigningKey,
   startLocalDaemon: localModule.startLocalDaemon,
   startGateway: localModule.startGateway,
+  startCes: localModule.startCes,
 };
 const realExec = stepRunnerModule.exec;
 
-// Prevent real daemon / gateway from starting
+// Prevent real daemon / gateway / CES from starting
 const startLocalDaemonMock = mock(async () => {});
 const startGatewayMock = mock(async () => {});
+const startCesMock = mock(async () => {});
 
 // Capture exec calls without running real tar
 const execMock = mock(async (_cmd: string, _args: string[]) => {});
@@ -45,6 +47,7 @@ beforeAll(() => {
     generateLocalSigningKey: () => "deadbeefdeadbeefdeadbeefdeadbeef",
     startLocalDaemon: startLocalDaemonMock,
     startGateway: startGatewayMock,
+    startCes: startCesMock,
   }));
   mock.module("../lib/step-runner.js", () => ({ exec: execMock }));
 });
@@ -128,6 +131,7 @@ beforeEach(() => {
   execMock.mockClear();
   startLocalDaemonMock.mockClear();
   startGatewayMock.mockClear();
+  startCesMock.mockClear();
 });
 
 afterEach(() => {

package/src/__tests__/sleep.test.ts

@@ -172,8 +172,7 @@ describe("sleep command", () => {
       undefined,
       7000,
     );
-    // The CES sibling (CES_STANDALONE opt-in) is stopped by its PID file; a
-    // no-op when absent on the default topology.
+    // The CES sibling is stopped by its PID file; a no-op when absent.
     expect(stopProcessByPidFileMock).toHaveBeenNthCalledWith(
       3,
       join(assistantRootDir, "ces.pid"),

package/src/__tests__/upgrade-local.test.ts

@@ -119,6 +119,7 @@ const startGatewayMock = mock<typeof local.startGateway>(
 const stopLocalProcessesMock = mock<typeof local.stopLocalProcesses>(
   async () => {},
 );
+const startCesMock = mock<typeof local.startCes>(async () => {});
 
 mock.module("../lib/local.js", () => ({
   ...realLocal,
@@ -127,6 +128,7 @@ mock.module("../lib/local.js", () => ({
   startLocalDaemon: startLocalDaemonMock,
   startGateway: startGatewayMock,
   stopLocalProcesses: stopLocalProcessesMock,
+  startCes: startCesMock,
 }));
 
 const loopbackSafeFetchMock = mock<typeof loopbackFetch.loopbackSafeFetch>(
@@ -256,6 +258,8 @@ beforeEach(() => {
   startGatewayMock.mockResolvedValue("http://127.0.0.1:7830");
   stopLocalProcessesMock.mockReset();
   stopLocalProcessesMock.mockResolvedValue(undefined);
+  startCesMock.mockReset();
+  startCesMock.mockResolvedValue(undefined);
   loopbackSafeFetchMock.mockReset();
   loopbackSafeFetchMock.mockResolvedValue({
     ok: true,

package/src/commands/recover.ts

@@ -118,9 +118,9 @@ export async function recover(): Promise<void> {
   entry.guardianBootstrapSecret = bootstrapSecret;
   saveAssistantEntry(entry);
 
-  // 8. Start CES sibling (opt-in) + daemon + gateway in parallel, the way the
-  // Docker topology brings its sibling processes up together. startCes is a
-  // no-op unless CES_STANDALONE is set.
+  // 8. Start CES sibling + daemon + gateway in parallel, the way the
+  // Docker topology brings its sibling processes up together. startCes
+  // always launches the CES sibling.
   await Promise.all([
     startCes(false, entry.resources),
     startLocalDaemon(false, entry.resources, { signingKey }),

package/src/commands/sleep.ts

@@ -168,9 +168,8 @@ export async function sleep(): Promise<void> {
     console.log("Gateway stopped.");
   }
 
-  // Stop the CES sibling if one was launched (CES_STANDALONE). No-op when the
-  // PID file is absent — on the default topology the assistant owns CES as an
-  // stdio child and it exits with the daemon.
+  // Stop the CES sibling — it is stopped by its PID file, a no-op when the
+  // PID file is absent (e.g. the sibling was never started or already exited).
   const cesPidFile = join(vellumDir, "ces.pid");
   const cesStopped = await stopProcessByPidFile(
     cesPidFile,

package/src/commands/teleport.ts

@@ -408,11 +408,18 @@ async function exportFromAssistant(
     // Passing the target's runtime URL here keeps upload and download on
     // the same platform — otherwise a non-default/stale platform URL would
     // cause the import to look at an empty object.
+    //
+    // The PUT is performed by the source daemon, not this CLI. A bare-metal
+    // local daemon shares the host's network view, so the client-signed URL
+    // is reachable; a docker daemon runs inside a container and reaches the
+    // host the same way managed pods do, so its URL must be signed for the
+    // runtime-reachable storage endpoint.
     const { url: uploadUrl, bundleKey } = await platformRequestSignedUrl(
       {
         operation: "upload",
         minRuntimeVersion: sourceRuntimeVersion,
         maxRuntimeVersion: null,
+        ...(cloud === "docker" ? { consumer: "runtime" as const } : {}),
       },
       platformToken,
       bundlePlatformUrl,
@@ -510,6 +517,9 @@ async function exportFromAssistant(
         operation: "upload",
         minRuntimeVersion: sourceRuntimeVersion,
         maxRuntimeVersion: null,
+        // The managed pod PUTs the bundle, not this CLI — the URL must be
+        // signed against the runtime-reachable storage endpoint.
+        consumer: "runtime",
       },
       platformToken,
       bundlePlatformUrl,

package/src/commands/upgrade.ts

@@ -1018,8 +1018,8 @@ async function upgradeLocal(
   process.env.APP_VERSION = stripVersionPrefix(targetVersion);
   try {
     // Bring CES, daemon, and gateway up in parallel, the way the Docker
-    // topology starts its sibling processes together. startCes is a no-op
-    // unless CES_STANDALONE is set.
+    // topology starts its sibling processes together. startCes always
+    // launches the CES sibling.
     await Promise.all([
       startCes(false, entry.resources),
       startLocalDaemon(false, entry.resources, { signingKey }),

package/src/commands/wake.ts

@@ -210,9 +210,8 @@ export async function wake(): Promise<void> {
     // CES socket during startup (discoverCesWithRetry), so it tolerates CES
     // still binding. CES's lifecycle tracks the daemon (its only consumer):
     // restarting it under a live daemon would sever the daemon's open
-    // connection, so it is only (re)started alongside the daemon. startCes is a
-    // no-op unless CES_STANDALONE is set, in which case the assistant spawns
-    // CES itself as today.
+    // connection, so it is only (re)started alongside the daemon. startCes
+    // always launches the CES sibling unconditionally.
     await Promise.all([
       startCes(watch, resources),
       startLocalDaemon(watch, resources, { foreground, signingKey }),
@@ -229,7 +228,7 @@ export async function wake(): Promise<void> {
     // died independently (crash, OOM kill). A dead ces.pid under a live daemon
     // means credential operations will fail until the next wake. Relaunch the
     // sibling so the daemon's lazy reconnect (secure-keys.ts) picks it up on
-    // the next credential read. startCes is a no-op unless CES_STANDALONE.
+    // the next credential read. startCes always launches the sibling.
     const vellumDir = join(resources.instanceDir, ".vellum");
     const cesPidFile = join(vellumDir, "ces.pid");
     const cesAlive = isProcessAlive(cesPidFile).alive;

package/src/lib/__tests__/local-ces.test.ts

@@ -0,0 +1,119 @@
+import {
+  mkdtempSync,
+  rmSync,
+  writeFileSync,
+  existsSync,
+  mkdirSync,
+} from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { afterAll, beforeAll, describe, expect, mock, test } from "bun:test";
+
+import { startCes } from "../local.js";
+
+// ---------------------------------------------------------------------------
+// Mocks
+// ---------------------------------------------------------------------------
+
+// Capture spawn calls so we can assert on cmd/env.
+let lastSpawnCall: {
+  cmd: string[];
+  options: {
+    detached?: boolean;
+    env?: Record<string, string | undefined>;
+    cwd?: string;
+  };
+} | null = null;
+
+mock.module("node:child_process", () => ({
+  spawn: mock((cmd: string, args: string[], options: object) => {
+    lastSpawnCall = { cmd: [cmd, ...args], options };
+    // Return a fake subprocess with a pid and no-op methods.
+    return {
+      pid: 42,
+      unref: () => {},
+      stdout: { on: () => {} },
+      stderr: { on: () => {} },
+      on: () => {},
+    };
+  }),
+  execSync: () => "",
+  execFileSync: () => "",
+  spawnSync: () => ({ status: 0, stdout: "", stderr: "" }),
+}));
+
+// Mock xdg-log so we don't open real log files.
+mock.module("../xdg-log.js", () => ({
+  openLogFile: mock(() => 42),
+  pipeToLogFile: mock(() => {}),
+}));
+
+// Mock process helpers so stopProcessByPidFile is a no-op.
+mock.module("../process.js", () => ({
+  stopProcessByPidFile: mock(async () => {}),
+  isProcessAlive: mock(() => false),
+  stopProcessGracefully: mock(async () => {}),
+}));
+
+// ---------------------------------------------------------------------------
+// Tests
+// ---------------------------------------------------------------------------
+
+describe("startCes", () => {
+  let tempDir: string;
+
+  beforeAll(() => {
+    tempDir = mkdtempSync(join(tmpdir(), "ces-test-"));
+  });
+
+  afterAll(() => {
+    rmSync(tempDir, { recursive: true, force: true });
+  });
+
+  test("spawns CES with correct env vars and writes PID file", async () => {
+    // Create the socket path before calling startCes so the wait loop exits.
+    // startCes unlinks it first, then waits for it to reappear. We create it
+    // after a short delay to simulate CES binding the socket.
+    const resources = {
+      instanceDir: tempDir,
+      name: "test-assistant",
+    } as unknown as Parameters<typeof startCes>[1];
+
+    // Create the socket file asynchronously after startCes unlinks it.
+    // We use a small setTimeout to create it during the wait loop.
+    const vellumDir = join(tempDir, ".vellum");
+    mkdirSync(vellumDir, { recursive: true });
+
+    // Pre-create the socket so it exists when startCes checks after unlinking.
+    // startCes unlinks the stale socket, then polls for it. We create it with
+    // a slight delay so the poll catches it.
+    setTimeout(() => {
+      const socketDir = join(vellumDir, "workspace");
+      mkdirSync(socketDir, { recursive: true });
+      writeFileSync(join(socketDir, "ces.sock"), "");
+    }, 50);
+
+    lastSpawnCall = null;
+    await startCes(false, resources);
+
+    // Verify spawn was called
+    expect(lastSpawnCall).not.toBeNull();
+    expect(lastSpawnCall!.options.detached).toBe(true);
+
+    // Under plain bun (source tree / tests), CES must run via `bun run
+    // src/main.ts` — never an adjacent `credential-executor` binary, which in
+    // bun's own bin dir is an unrelated globally-installed package bin.
+    expect(lastSpawnCall!.cmd[0]).toBe(process.execPath);
+    expect(lastSpawnCall!.cmd).toContain("src/main.ts");
+
+    // Verify env vars
+    const env = lastSpawnCall!.options.env!;
+    expect(env["CES_LOCAL_SOCKET"]).toBeDefined();
+    expect(env["CREDENTIAL_SECURITY_DIR"]).toBeDefined();
+    expect(env["VELLUM_WORKSPACE_DIR"]).toBeDefined();
+
+    // Verify PID file was written
+    const cesPidFile = join(vellumDir, "ces.pid");
+    expect(existsSync(cesPidFile)).toBe(true);
+  }, 15_000);
+});

package/src/lib/docker.ts

@@ -1442,6 +1442,21 @@ export async function hatchDocker(params: HatchDockerParams): Promise<void> {
     }
     const hostDeviceId = getOrCreateHostDeviceId();
     extraAssistantEnv.VELLUM_DEVICE_ID = hostDeviceId;
+    // Forward the migration URL allowlists so a daemon inside the container
+    // can PUT/GET teleport bundles against a local (non-GCS) platform.
+    // Pass-through only: unset in normal use, preserving the strict
+    // GCS-only validator default. A containerized daemon reaches the host
+    // via host.docker.internal, so that is the value to export when
+    // teleporting docker assistants against a local platform.
+    for (const key of [
+      "VELLUM_MIGRATION_EXPORT_ALLOWED_HOSTS",
+      "VELLUM_MIGRATION_IMPORT_ALLOWED_HOSTS",
+    ] as const) {
+      const value = process.env[key];
+      if (value) {
+        extraAssistantEnv[key] = value;
+      }
+    }
     const extraGatewayEnv = {
       ...flagEnvVars,
       VELLUM_DEVICE_ID: hostDeviceId,

package/src/lib/flag-args.ts

@@ -1,4 +1,4 @@
-/** Only allow simple kebab-case keys (e.g. "voice-mode", "ces-tools"). */
+/** Only allow simple kebab-case keys (e.g. "voice-mode", "browser"). */
 const ALLOWED_KEY_RE = /^[a-z0-9][a-z0-9-]*$/;
 
 /**

package/src/lib/hatch-local.ts

@@ -227,9 +227,9 @@ export async function hatchLocal(
   const signingKey = generateLocalSigningKey();
   const bootstrapSecret = generateLocalSigningKey();
   // Launch the CES sibling alongside the daemon, in parallel — matching the
-  // Docker topology. Under the opt-in the assistant does not spawn its own CES,
-  // so a freshly hatched instance would otherwise come up with CES unavailable.
-  // startCes is a no-op unless CES_STANDALONE is set.
+  // Docker topology. The assistant does not spawn its own CES, so a freshly
+  // hatched instance would otherwise come up with CES unavailable.
+  // startCes always launches the CES sibling.
   await Promise.all([
     startCes(watch, resources),
     startLocalDaemon(watch, resources, {

package/src/lib/local.ts

@@ -94,9 +94,26 @@ function hasLocalRuntimeComponents(installDir: string): boolean {
   );
 }
 
-function resolveBunExecutable(): string {
+/**
+ * True when this process is a compiled standalone binary (desktop app or
+ * `bun build --compile` CLI) rather than a script executed by a plain `bun`
+ * binary (source tree, bunx, npm/global install).
+ *
+ * Only a compiled binary may trust product siblings in
+ * `dirname(process.execPath)`: under plain bun that directory is bun's own
+ * bin dir (e.g. `~/.bun/bin`), where bin links of globally-installed packages
+ * (`assistant`, `credential-executor`) collide with app-bundle binary names
+ * and point at whatever version happens to be installed globally.
+ */
+function isCompiledCli(): boolean {
   const execBase = basename(process.execPath);
-  if (execBase === "bun" || execBase.startsWith("bun-")) {
+  return (
+    execBase !== "bun" && execBase !== "bunx" && !execBase.startsWith("bun-")
+  );
+}
+
+function resolveBunExecutable(): string {
+  if (!isCompiledCli()) {
     return process.execPath;
   }
 
@@ -573,14 +590,11 @@ function applyDaemonEnvOverrides(
     env.VELLUM_DEFAULT_WORKSPACE_CONFIG_PATH =
       options.defaultWorkspaceConfigPath;
   }
-  // When the CLI launches CES as a sibling (CES_STANDALONE), pin the daemon to
-  // the exact socket the sibling binds so the two agree regardless of any stale
-  // CES_LOCAL_SOCKET inherited from the parent environment. The assistant then
-  // connects to the sibling instead of spawning its own CES.
-  if (isCesSiblingOptIn()) {
-    env.CES_STANDALONE = "1";
-    env.CES_LOCAL_SOCKET = resolveCesSocketPath(resources);
-  }
+  // Pin the daemon to the exact socket the sibling binds so the two agree
+  // regardless of any stale CES_LOCAL_SOCKET inherited from the parent
+  // environment. The assistant connects to the sibling instead of spawning
+  // its own CES.
+  env.CES_LOCAL_SOCKET = resolveCesSocketPath(resources);
   applyIpcSocketDirOverride(env);
 }
 
@@ -784,7 +798,7 @@ function resolveGatewayDir(resources?: LocalInstanceResources): string {
 
   // Compiled binary: gateway/ bundled adjacent to the CLI executable.
   const binGateway = join(dirname(process.execPath), "gateway");
-  if (isGatewaySourceDir(binGateway)) {
+  if (isCompiledCli() && isGatewaySourceDir(binGateway)) {
     return binGateway;
   }
 
@@ -850,31 +864,18 @@ function resolveCesSocketPath(resources?: LocalInstanceResources): string {
 }
 
 /**
- * Whether the CLI should launch CES as an independent sibling process instead
- * of leaving the assistant to spawn it as an stdio child. Temporary opt-in
- * (`CES_STANDALONE=1`) while local CES converges onto the sibling model that
- * containerized homes already use.
- */
-function isCesSiblingOptIn(): boolean {
-  return process.env.CES_STANDALONE === "1";
-}
-
-/**
- * Launch the local CES sibling over a Unix socket (opted into via
- * `CES_STANDALONE=1`). No-op unless the opt-in is set, in which case the
- * assistant continues to spawn CES itself as today.
+ * Launch the local CES sibling over a Unix socket. The sibling model is now
+ * the default topology for local (non-containerized) instances, matching how
+ * containerized homes already run CES.
  *
- * The sibling runs with `CES_STANDALONE=1` so its lifecycle is anchored to
- * SIGTERM rather than stdin EOF, mirroring the gateway: a CLI-owned process
- * with a PID file under `.vellum/ces.pid`, started by `wake` and stopped by
- * `sleep`.
+ * The sibling runs as an independent process with its lifecycle anchored to
+ * SIGTERM, mirroring the gateway: a CLI-owned process with a PID file under
+ * `.vellum/ces.pid`, started by `wake` and stopped by `sleep`.
  */
 export async function startCes(
   watch: boolean = false,
   resources?: LocalInstanceResources,
 ): Promise<void> {
-  if (!isCesSiblingOptIn()) return;
-
   const vellumDir = resources
     ? join(resources.instanceDir, ".vellum")
     : join(homedir(), ".vellum");
@@ -905,7 +906,6 @@ export async function startCes(
 
   const cesEnv: Record<string, string | undefined> = {
     ...process.env,
-    CES_STANDALONE: "1",
     CES_LOCAL_SOCKET: socketPath,
     CREDENTIAL_SECURITY_DIR: securityDir,
     VELLUM_WORKSPACE_DIR: workspaceDir,
@@ -914,7 +914,7 @@ export async function startCes(
   let ces;
   const runtimeCesDir = !watch ? localRuntimeCesDir(resources) : undefined;
   const cesBinary = join(dirname(process.execPath), "credential-executor");
-  if (!runtimeCesDir && existsSync(cesBinary) && !watch) {
+  if (!runtimeCesDir && isCompiledCli() && existsSync(cesBinary) && !watch) {
     // Compiled binary alongside the CLI (desktop app / compiled CLI).
     const cesLogFd = openLogFile("hatch.log");
     ces = spawn(cesBinary, [], {
@@ -1270,7 +1270,7 @@ export function isGatewayWatchModeAvailable(): boolean {
  */
 function writeAssistantWrapper(resources: LocalInstanceResources): void {
   const assistantBinary = join(dirname(process.execPath), "assistant");
-  if (!existsSync(assistantBinary)) return;
+  if (!isCompiledCli() || !existsSync(assistantBinary)) return;
 
   const workspaceDir = join(resources.instanceDir, ".vellum", "workspace");
   const protectedDir = join(resources.instanceDir, ".vellum", "protected");
@@ -1332,7 +1332,7 @@ export async function startLocalDaemon(
   // the user runs the compiled CLI directly from the terminal (e.g. via a
   // /usr/local/bin/vellum symlink into the app bundle).
   const daemonBinary = join(dirname(process.execPath), "vellum-daemon");
-  if (existsSync(daemonBinary) && !watch) {
+  if (isCompiledCli() && existsSync(daemonBinary) && !watch) {
     // In watch mode, skip the bundled binary and use source (bun --watch
     // only works with source files, not compiled binaries).
 
@@ -1413,6 +1413,8 @@ export async function startLocalDaemon(
         "VELLUM_DEV",
         "VELLUM_DESKTOP_APP",
         "VELLUM_DISABLE_PLATFORM",
+        "VELLUM_MIGRATION_EXPORT_ALLOWED_HOSTS",
+        "VELLUM_MIGRATION_IMPORT_ALLOWED_HOSTS",
         "VELLUM_WORKSPACE_DIR",
       ]) {
         if (process.env[key]) {
@@ -1624,7 +1626,12 @@ export async function startGateway(
     ? localRuntimeGatewayDir(resources)
     : undefined;
   const gatewayBinary = join(dirname(process.execPath), "vellum-gateway");
-  if (!runtimeGatewayDir && existsSync(gatewayBinary) && !watch) {
+  if (
+    !runtimeGatewayDir &&
+    isCompiledCli() &&
+    existsSync(gatewayBinary) &&
+    !watch
+  ) {
     // Use the compiled gateway binary when available (desktop app or compiled
     // CLI invoked from the terminal). In watch mode, skip the bundled binary
     // and use source (bun --watch only works with source files).
@@ -1713,9 +1720,8 @@ export async function stopLocalProcesses(
   const gatewayPidFile = join(vellumDir, "gateway.pid");
   await stopProcessByPidFile(gatewayPidFile, "gateway", undefined, 7000);
 
-  // Stop the CES sibling if one was launched (CES_STANDALONE). No-op when the
-  // PID file is absent, so this is safe on the default topology where the
-  // assistant owns CES as an stdio child.
+  // Stop the CES sibling if one was launched. No-op when the
+  // PID file is absent.
   const cesPidFile = join(vellumDir, "ces.pid");
   await stopProcessByPidFile(cesPidFile, "credential-executor");
 

package/src/lib/platform-client.ts

@@ -1027,6 +1027,12 @@ export async function platformRequestSignedUrl(
     maxRuntimeVersion?: string | null;
     // Target-side, download only: runtime version that will import.
     targetRuntimeVersion?: string;
+    // Upload only: who will PUT to the URL. "runtime" signs against the
+    // runtime-reachable storage endpoint so a managed assistant pod can
+    // upload its export bundle (platform→local teleport); defaults to
+    // "client" server-side. No effect in production, where both endpoints
+    // are the same.
+    consumer?: "client" | "runtime";
   },
   token: string,
   platformUrl?: string,
@@ -1054,6 +1060,9 @@ export async function platformRequestSignedUrl(
   if (params.targetRuntimeVersion !== undefined) {
     body.target_runtime_version = params.targetRuntimeVersion;
   }
+  if (params.consumer !== undefined) {
+    body.consumer = params.consumer;
+  }
 
   const doRequest = async (): Promise<Response> =>
     loopbackSafeFetch(`${resolvedUrl}/v1/migrations/signed-url/`, {

package/src/lib/provider-secrets.ts

@@ -71,6 +71,10 @@ const PROVIDER_LABELS: Record<LlmProviderId, string> = {
   gemini: "Gemini",
   fireworks: "Fireworks",
   openrouter: "OpenRouter",
+  "vercel-ai-gateway": "Vercel AI Gateway",
+  minimax: "MiniMax",
+  atlascloud: "Atlas Cloud",
+  together: "Together AI",
 };
 
 export function formatProviderName(provider: LlmProviderId): string {
@@ -151,13 +155,42 @@ function readConfigValue(
   return value && value.length > 0 ? value : undefined;
 }
 
-function inferProviderFromModel(model: string): string | undefined {
-  if (model.startsWith("claude-")) return "anthropic";
-  if (model.startsWith("gpt-")) return "openai";
-  if (model.startsWith("gemini-")) return "gemini";
-  if (model.startsWith("accounts/fireworks/models/")) return "fireworks";
-  if (model.includes("/")) return "openrouter";
-  if (model === "llama3.2" || model === "mistral") return "ollama";
+/**
+ * Infer the provider a bare model ID implies, mirroring the assistant
+ * resolver's `getCatalogProviderForModel`: an ID listed by multiple catalog
+ * providers resolves to the FIRST one in catalog order. Vendor prefixes unique
+ * to one provider map to it; shared gateway IDs (e.g. `anthropic/*`) fall
+ * through to openrouter, the earlier catalog entry. Drift guard:
+ * `cli/src/__tests__/provider-inference-parity.test.ts`. Exported for tests.
+ */
+export function inferProviderFromModel(model: string): string | undefined {
+  if (model.startsWith("claude-")) {
+    return "anthropic";
+  }
+  if (model.startsWith("gpt-")) {
+    return "openai";
+  }
+  if (model.startsWith("gemini-")) {
+    return "gemini";
+  }
+  if (model.startsWith("accounts/fireworks/models/")) {
+    return "fireworks";
+  }
+  if (model.startsWith("openai/") || model.startsWith("xai/")) {
+    return "vercel-ai-gateway";
+  }
+  if (model.startsWith("MiniMaxAI/")) {
+    return "together";
+  }
+  if (model.startsWith("deepseek-ai/")) {
+    return "atlascloud";
+  }
+  if (model.includes("/")) {
+    return "openrouter";
+  }
+  if (model === "llama3.2" || model === "mistral") {
+    return "ollama";
+  }
   return undefined;
 }
 

package/src/lib/retire-local.ts

@@ -66,9 +66,8 @@ export async function retireLocal(
   const gatewayPidFile = join(vellumDir, "gateway.pid");
   await stopProcessByPidFile(gatewayPidFile, "gateway", undefined, 7000);
 
-  // Stop the CES sibling if one was launched (CES_STANDALONE). No-op when the
-  // PID file is absent — on the default topology the assistant owns CES as an
-  // stdio child and it exits with the daemon.
+  // Stop the CES sibling — it is stopped by its PID file, a no-op when the
+  // PID file is absent (e.g. the sibling was never started or already exited).
   const cesPidFile = join(vellumDir, "ces.pid");
   const cesStopped = await stopProcessByPidFile(
     cesPidFile,

package/src/shared/provider-env-vars.ts

@@ -26,6 +26,7 @@ export const LLM_PROVIDER_ENV_VAR_NAMES: Record<string, string> = {
   gemini: "GEMINI_API_KEY",
   fireworks: "FIREWORKS_API_KEY",
   openrouter: "OPENROUTER_API_KEY",
+  "vercel-ai-gateway": "AI_GATEWAY_API_KEY",
   minimax: "MINIMAX_API_KEY",
   atlascloud: "ATLASCLOUD_API_KEY",
   together: "TOGETHER_API_KEY",