@vellumai/cli 0.10.8-dev.202607152027.f053d5a → 0.10.8-staging.1

package/node_modules/@vellumai/local-mode/src/__tests__/gateway-proxy.test.ts

@@ -1,12 +1,6 @@
 import { describe, expect, test } from "bun:test";
-import fs from "node:fs";
-import os from "node:os";
-import path from "node:path";
 
-import {
-  readAllowedGatewayPorts,
-  resolveGatewayProxyTarget,
-} from "../gateway-proxy";
+import { resolveGatewayProxyTarget } from "../gateway-proxy";
 
 const allow =
   (...ports: number[]) =>
@@ -70,41 +64,6 @@ describe("resolveGatewayProxyTarget", () => {
     });
   });
 
-  test("allowlists ports from resources, loopback URLs, and docker runtimeUrls — never remote URLs", () => {
-    const dir = fs.mkdtempSync(path.join(os.tmpdir(), "gateway-proxy-test-"));
-    const lockfilePath = path.join(dir, "assistants.json");
-    try {
-      fs.writeFileSync(
-        lockfilePath,
-        JSON.stringify({
-          assistants: [
-            { assistantId: "local-a", resources: { gatewayPort: 7830 } },
-            { assistantId: "local-b", localUrl: "http://127.0.0.1:7831" },
-            // Docker entries record their published gateway only as a
-            // loopback runtimeUrl.
-            {
-              assistantId: "docker-a",
-              cloud: "docker",
-              runtimeUrl: "http://localhost:7930",
-            },
-            // Remote runtimeUrls (managed / gcp / paired) must never widen
-            // the allowlist.
-            {
-              assistantId: "remote-a",
-              cloud: "gcp",
-              runtimeUrl: "https://assistant.example.com:8443",
-            },
-          ],
-        }),
-      );
-      expect(readAllowedGatewayPorts([lockfilePath])).toEqual(
-        new Set([7830, 7831, 7930]),
-      );
-    } finally {
-      fs.rmSync(dir, { recursive: true, force: true });
-    }
-  });
-
   test("never reads the allowlist for non-gateway or invalid-port paths", () => {
     let reads = 0;
     const counting = () => {

package/node_modules/@vellumai/local-mode/src/gateway-proxy.ts

@@ -87,7 +87,6 @@ export function readAllowedGatewayPorts(lockfilePaths: string[]): Set<number> {
         assistants?: Array<{
           gatewayUrl?: unknown;
           localUrl?: unknown;
-          runtimeUrl?: unknown;
           resources?: { gatewayPort?: unknown };
         }>;
       };
@@ -96,10 +95,6 @@ export function readAllowedGatewayPorts(lockfilePaths: string[]): Set<number> {
         if (!assistant) continue;
         addPortFromUrl(assistant.gatewayUrl, ports);
         addPortFromUrl(assistant.localUrl, ports);
-        // Docker entries record their published gateway as a loopback
-        // `runtimeUrl` with no `resources` block; the loopback-hostname filter
-        // in addPortFromUrl keeps remote runtimeUrls out of the allowlist.
-        addPortFromUrl(assistant.runtimeUrl, ports);
         const gp = assistant.resources?.gatewayPort;
         if (typeof gp === "number" && Number.isInteger(gp) && gp >= 1024 && gp <= 65535) {
           ports.add(gp);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vellumai/cli",
-  "version": "0.10.8-dev.202607152027.f053d5a",
+  "version": "0.10.8-staging.1",
   "description": "CLI tools for vellum-assistant",
   "type": "module",
   "exports": {

package/src/lib/provider-secrets.ts

@@ -176,11 +176,6 @@ export function inferProviderFromModel(model: string): string | undefined {
   if (model.startsWith("accounts/fireworks/models/")) {
     return "fireworks";
   }
-  if (model.startsWith("openai/gpt-5.6")) {
-    // Listed by OpenRouter (#37856), the earlier catalog entry; the Vercel
-    // AI Gateway does not carry these IDs.
-    return "openrouter";
-  }
   if (model.startsWith("openai/") || model.startsWith("xai/")) {
     return "vercel-ai-gateway";
   }