@vellumai/cli 0.11.3 → 0.11.4-dev.202608190019.b94dbf2

package/src/__tests__/wake.test.ts

@@ -14,7 +14,6 @@ import { join } from "node:path";
 
 import * as assistantConfig from "../lib/assistant-config.js";
 import * as docker from "../lib/docker.js";
-import * as featureFlags from "../lib/feature-flags.js";
 import * as guardianToken from "../lib/guardian-token.js";
 import * as ingressConfig from "../lib/ingress-config.js";
 import * as local from "../lib/local.js";
@@ -141,19 +140,9 @@ mock.module("../lib/ngrok", () => ({
   maybeStartNgrokTunnel: maybeStartNgrokTunnelMock,
 }));
 
-const realFeatureFlags = { ...featureFlags };
 const realIngressConfig = { ...ingressConfig };
 const realNginxIngress = { ...nginxIngress };
 
-const isAssistantFeatureFlagEnabledMock = mock<
-  typeof featureFlags.isAssistantFeatureFlagEnabled
->(async () => true);
-
-mock.module("../lib/feature-flags.js", () => ({
-  ...realFeatureFlags,
-  isAssistantFeatureFlagEnabled: isAssistantFeatureFlagEnabledMock,
-}));
-
 const loadRawConfigMock = mock<typeof ingressConfig.loadRawConfig>(() => ({}));
 
 mock.module("../lib/ingress-config.js", () => ({
@@ -179,12 +168,12 @@ mock.module("../lib/nginx-ingress.js", () => ({
 }));
 
 const { wake } = await import("../commands/wake.js");
-const { WEB_INGRESS_FLAG_RETRY } = await import("../lib/tunnel-edge.js");
 
 let tempDir: string;
 let originalArgv: string[];
 let logSpy: ReturnType<typeof spyOn>;
 let warnSpy: ReturnType<typeof spyOn>;
+let localEntry: AssistantEntry;
 
 function makeLocalEntry(): AssistantEntry {
   tempDir = mkdtempSync(join(tmpdir(), "vellum-wake-test-"));
@@ -211,9 +200,9 @@ beforeEach(() => {
   logSpy = spyOn(console, "log").mockImplementation(() => {});
   warnSpy = spyOn(console, "warn").mockImplementation(() => {});
 
-  const entry = makeLocalEntry();
+  localEntry = makeLocalEntry();
   resolveTargetAssistantMock.mockReset();
-  resolveTargetAssistantMock.mockReturnValue(entry);
+  resolveTargetAssistantMock.mockReturnValue(localEntry);
   saveAssistantEntryMock.mockReset();
   getDaemonPidPathMock.mockReset();
   getDaemonPidPathMock.mockImplementation((resources) =>
@@ -256,8 +245,6 @@ beforeEach(() => {
   );
   maybeStartNgrokTunnelMock.mockReset();
   maybeStartNgrokTunnelMock.mockResolvedValue(null);
-  isAssistantFeatureFlagEnabledMock.mockReset();
-  isAssistantFeatureFlagEnabledMock.mockResolvedValue(true);
   loadRawConfigMock.mockReset();
   loadRawConfigMock.mockReturnValue({});
   ensureTunnelEdgeMock.mockReset();
@@ -288,7 +275,6 @@ afterAll(() => {
   mock.module("../lib/process", () => realProcessLib);
   mock.module("../lib/local", () => realLocal);
   mock.module("../lib/ngrok", () => realNgrok);
-  mock.module("../lib/feature-flags.js", () => realFeatureFlags);
   mock.module("../lib/ingress-config.js", () => realIngressConfig);
   mock.module("../lib/nginx-ingress.js", () => realNginxIngress);
 });
@@ -402,8 +388,73 @@ describe("vellum wake", () => {
     // startLocalDaemon should NOT be called (daemon already running).
     expect(startLocalDaemonMock).not.toHaveBeenCalled();
   });
-});
 
+  test("does not duplicate an assistant already classified as stuck", async () => {
+    localEntry.guardianBootstrapSecret = "existing-bootstrap-secret";
+    resolveProcessStateMock.mockImplementation(
+      async (_pidFile, _port, label) =>
+        label === "Assistant"
+          ? { status: "stuck", pid: 123 }
+          : { status: "healthy", pid: 456 },
+    );
+
+    await wake();
+
+    expect(startLocalDaemonMock).not.toHaveBeenCalled();
+    expect(logSpy).toHaveBeenCalledWith(
+      expect.stringContaining("could not be stopped"),
+    );
+  });
+
+  test("does not duplicate an assistant when a watch restart cannot stop it", async () => {
+    localEntry.guardianBootstrapSecret = "existing-bootstrap-secret";
+    isAssistantWatchModeAvailableMock.mockReturnValue(true);
+    stopProcessByPidFileMock.mockResolvedValue(false);
+    isProcessAliveMock.mockReturnValue({ alive: true, pid: 123 });
+
+    await wake();
+
+    expect(startLocalDaemonMock).not.toHaveBeenCalled();
+    expect(logSpy).toHaveBeenCalledWith(
+      expect.stringContaining("could not be stopped for watch mode"),
+    );
+  });
+
+  test("does not duplicate a gateway already classified as stuck", async () => {
+    localEntry.guardianBootstrapSecret = "existing-bootstrap-secret";
+    resolveProcessStateMock.mockImplementation(
+      async (_pidFile, _port, label) =>
+        label === "Gateway"
+          ? { status: "stuck", pid: 456 }
+          : { status: "healthy", pid: 123 },
+    );
+
+    await wake();
+
+    expect(startGatewayMock).not.toHaveBeenCalled();
+    expect(logSpy).toHaveBeenCalledWith(
+      expect.stringContaining("Gateway running"),
+    );
+  });
+
+  test("does not duplicate a gateway when a watch restart cannot stop it", async () => {
+    localEntry.guardianBootstrapSecret = "existing-bootstrap-secret";
+    isGatewayWatchModeAvailableMock.mockReturnValue(true);
+    stopProcessByPidFileMock.mockResolvedValue(false);
+    isProcessAliveMock.mockImplementation((pidFile) =>
+      pidFile.endsWith("gateway.pid")
+        ? { alive: true, pid: 456 }
+        : { alive: false, pid: null },
+    );
+
+    await wake();
+
+    expect(startGatewayMock).not.toHaveBeenCalled();
+    expect(logSpy).toHaveBeenCalledWith(
+      expect.stringContaining("Gateway running"),
+    );
+  });
+});
 
 describe("vellum wake — tunnel edge restore", () => {
   const webhookConfig = { telegram: { botUsername: "bot" } };
@@ -416,7 +467,7 @@ describe("vellum wake — tunnel edge restore", () => {
     process.argv = ["bun", "vellum", "wake", "local-assistant"];
   });
 
-  test("webhook-configured wake ensures the edge with the startup flag retry and tunnels the edge port", async () => {
+  test("webhook-configured wake ensures the edge and tunnels the edge port", async () => {
     loadRawConfigMock.mockReturnValue(webhookConfig);
 
     await wake();
@@ -425,7 +476,6 @@ describe("vellum wake — tunnel edge restore", () => {
       assistantId: "local-assistant",
       workspaceDir: workspaceDirOf(tempDir),
       gatewayPort: 7830,
-      flagRetry: WEB_INGRESS_FLAG_RETRY,
     });
     expect(maybeStartNgrokTunnelMock).toHaveBeenCalledWith(
       7840,
@@ -443,7 +493,6 @@ describe("vellum wake — tunnel edge restore", () => {
       assistantId: "local-assistant",
       workspaceDir: workspaceDirOf(tempDir),
       gatewayPort: 7830,
-      flagRetry: WEB_INGRESS_FLAG_RETRY,
     });
     expect(maybeStartNgrokTunnelMock).toHaveBeenCalledWith(
       7840,
@@ -455,7 +504,6 @@ describe("vellum wake — tunnel edge restore", () => {
   test("skips the edge and tunnels the gateway port when nothing wants an edge", async () => {
     await wake();
 
-    expect(isAssistantFeatureFlagEnabledMock).not.toHaveBeenCalled();
     expect(ensureTunnelEdgeMock).not.toHaveBeenCalled();
     expect(maybeStartNgrokTunnelMock).toHaveBeenCalledWith(
       7830,
@@ -483,7 +531,7 @@ describe("vellum wake — tunnel edge restore", () => {
     expect(ensureTunnelEdgeMock).not.toHaveBeenCalled();
   });
 
-  test("a running edge recorded against this gateway port is reused with zero flag calls", async () => {
+  test("a running edge recorded against this gateway port is reused without ensureTunnelEdge", async () => {
     loadRawConfigMock.mockReturnValue(webhookConfig);
     isIngressRunningMock.mockReturnValue(true);
     readIngressStateMock.mockReturnValue({
@@ -494,7 +542,6 @@ describe("vellum wake — tunnel edge restore", () => {
 
     await wake();
 
-    expect(isAssistantFeatureFlagEnabledMock).not.toHaveBeenCalled();
     expect(ensureTunnelEdgeMock).not.toHaveBeenCalled();
     expect(logSpy).toHaveBeenCalledWith(
       "   Tunnel edge already running on 127.0.0.1:7845 (remote web + webhooks).",
@@ -505,6 +552,26 @@ describe("vellum wake — tunnel edge restore", () => {
     );
   });
 
+  test("a running webhooks-only edge goes through ensureTunnelEdge to upgrade to the SPA edge", async () => {
+    loadRawConfigMock.mockReturnValue(webhookConfig);
+    isIngressRunningMock.mockReturnValue(true);
+    readIngressStateMock.mockReturnValue({
+      listenPort: 7845,
+      includeWebApp: false,
+      gatewayPort: 7830,
+    });
+
+    await wake();
+
+    expect(ensureTunnelEdgeMock).toHaveBeenCalledWith(
+      expect.objectContaining({ gatewayPort: 7830 }),
+    );
+    expect(maybeStartNgrokTunnelMock).toHaveBeenCalledWith(
+      7840,
+      workspaceDirOf(tempDir),
+    );
+  });
+
   test("a running edge recorded against a different gateway port goes through ensureTunnelEdge", async () => {
     loadRawConfigMock.mockReturnValue(webhookConfig);
     isIngressRunningMock.mockReturnValue(true);
@@ -563,28 +630,6 @@ describe("vellum wake — tunnel edge restore", () => {
     expect(logSpy).toHaveBeenCalledWith("Wake complete.");
   });
 
-  test("flag-off + webhooks-on produces a webhooks-only edge fronting the tunnel", async () => {
-    loadRawConfigMock.mockReturnValue(webhookConfig);
-    ensureTunnelEdgeMock.mockResolvedValue({
-      port: 7840,
-      started: true,
-      includesWebApp: false,
-    });
-
-    await wake();
-
-    expect(ensureTunnelEdgeMock).toHaveBeenCalledWith(
-      expect.objectContaining({ assistantId: "local-assistant" }),
-    );
-    expect(logSpy).toHaveBeenCalledWith(
-      expect.stringContaining("webhooks only"),
-    );
-    expect(maybeStartNgrokTunnelMock).toHaveBeenCalledWith(
-      7840,
-      workspaceDirOf(tempDir),
-    );
-  });
-
   test("a reused edge still points the tunnel at its listen port", async () => {
     loadRawConfigMock.mockReturnValue(enabledConfig);
     ensureTunnelEdgeMock.mockResolvedValue({
@@ -600,27 +645,4 @@ describe("vellum wake — tunnel edge restore", () => {
       workspaceDirOf(tempDir),
     );
   });
-
-  test("an exhausted flag lookup warns and falls back to the gateway-port tunnel", async () => {
-    loadRawConfigMock.mockReturnValue(webhookConfig);
-    ensureTunnelEdgeMock.mockRejectedValue(
-      new Error(
-        "Could not verify the `web-remote-ingress` feature flag before starting the edge. Is the assistant running? Try `vellum wake` and retry. gateway unreachable",
-      ),
-    );
-
-    await wake();
-
-    expect(warnSpy).toHaveBeenCalledWith(
-      expect.stringContaining("web-remote-ingress"),
-    );
-    expect(warnSpy).toHaveBeenCalledWith(
-      expect.stringContaining("vellum nginx-ingress up"),
-    );
-    expect(maybeStartNgrokTunnelMock).toHaveBeenCalledWith(
-      7830,
-      workspaceDirOf(tempDir),
-    );
-    expect(logSpy).toHaveBeenCalledWith("Wake complete.");
-  });
 });

package/src/__tests__/windows-lifecycle.test.ts

@@ -0,0 +1,157 @@
+import { expect, test } from "bun:test";
+import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import path from "node:path";
+
+import {
+  executableName,
+  isProcessAlive,
+  isVellumCommandLine,
+  isVellumWindowsProcess,
+  pathListDelimiter,
+  parseTasklistCsv,
+  stopProcess,
+  stopProcessByPidFile,
+  windowsCommandLineLookupArgs,
+} from "../lib/process";
+import {
+  isInteractiveCliSession,
+  parseRemotePs,
+  processTableCommand,
+} from "../lib/orphan-detection";
+
+test("uses Windows executable suffixes without changing Unix names", () => {
+  expect(executableName("vellum-daemon", "win32")).toBe("vellum-daemon.exe");
+  expect(executableName("vellum.exe", "win32")).toBe("vellum.exe");
+  expect(executableName("vellum-daemon", "darwin")).toBe("vellum-daemon");
+  expect(pathListDelimiter("win32")).toBe(";");
+  expect(pathListDelimiter("linux")).toBe(":");
+});
+
+test("parses tasklist rows and ignores informational output", () => {
+  const output =
+    '"vellum-daemon.exe","4812","Console","1","20,000 K"\r\nINFO: No tasks match.';
+  expect(parseTasklistCsv(output)).toEqual([
+    { imageName: "vellum-daemon.exe", pid: 4812 },
+  ]);
+});
+
+test("passes the PID inside the PowerShell command", () => {
+  const args = windowsCommandLineLookupArgs(4812);
+  expect(args).toHaveLength(4);
+  expect(args[3]).toContain("ProcessId = 4812");
+  expect(args[3]).not.toContain("$args");
+});
+
+test("selects a direct process-table command with fixed arguments", () => {
+  const windows = processTableCommand("win32");
+  expect(windows.command).toBe("powershell.exe");
+  expect(windows.args.join(" ")).toContain("Win32_Process");
+  expect(processTableCommand("linux")).toEqual({
+    command: "ps",
+    args: ["ax", "-o", "pid=,ppid=,args="],
+  });
+});
+
+test("preserves command lines containing spaces and Unicode usernames", () => {
+  const [parsed] = parseRemotePs(
+    "42 1 C:\\Users\\Example User 用户\\Vellum\\vellum-daemon.exe --port 3030",
+  );
+  expect(parsed.command).toContain(
+    "Example User 用户\\Vellum\\vellum-daemon.exe",
+  );
+  expect(
+    isInteractiveCliSession(
+      '"C:\\Users\\Example User 用户\\Vellum\\vellum.exe" exec -it --service vellum-gateway',
+    ),
+  ).toBeTrue();
+});
+
+test("rejects a stale PID file", () => {
+  const dir = mkdtempSync(path.join(tmpdir(), "vellum stale pid "));
+  const pidFile = path.join(dir, "assistant.pid");
+  writeFileSync(pidFile, "2147483647\n", "utf8");
+  expect(isProcessAlive(pidFile)).toEqual({ alive: false, pid: null });
+  rmSync(dir, { recursive: true, force: true });
+});
+
+test("recognizes only Vellum Bun-hosted process command lines", () => {
+  expect(
+    isVellumCommandLine(
+      "bun.exe C:\\Users\\Example User 用户\\.vellum\\runtime\\assistant\\src\\daemon\\main.ts",
+    ),
+  ).toBeTrue();
+  expect(
+    isVellumCommandLine("bun.exe C:\\work\\unrelated\\server.ts"),
+  ).toBeFalse();
+});
+
+test("verifies Windows Qdrant ownership from its command line", () => {
+  expect(
+    isVellumWindowsProcess(
+      "qdrant.exe",
+      "C:\\Users\\Example User\\.vellum\\workspace\\data\\qdrant\\bin\\qdrant.exe",
+    ),
+  ).toBeTrue();
+  expect(
+    isVellumWindowsProcess("qdrant.exe", "C:\\Databases\\qdrant.exe"),
+  ).toBeFalse();
+});
+
+test("reports a failed forced Windows process-tree termination", async () => {
+  const calls: string[][] = [];
+  const stopped = await stopProcess(
+    process.pid,
+    "test process",
+    0,
+    "win32",
+    (args) => {
+      calls.push(args);
+      throw new Error("access denied");
+    },
+  );
+
+  expect(stopped).toBeFalse();
+  expect(calls).toEqual([
+    ["/PID", String(process.pid), "/T"],
+    ["/PID", String(process.pid), "/T", "/F"],
+  ]);
+});
+
+test("treats a Unix exit before SIGKILL as a successful stop", async () => {
+  const signals: Array<NodeJS.Signals | number | undefined> = [];
+  const originalKill = process.kill.bind(process);
+  process.kill = ((_pid: number, signal?: NodeJS.Signals | number) => {
+    signals.push(signal);
+    if (signal === "SIGKILL") {
+      throw Object.assign(new Error("no such process"), { code: "ESRCH" });
+    }
+    return true;
+  }) as typeof process.kill;
+
+  try {
+    expect(await stopProcess(4812, "test process", 0, "darwin")).toBeTrue();
+    expect(signals).toEqual([0, "SIGTERM", 0, "SIGKILL"]);
+  } finally {
+    process.kill = originalKill;
+  }
+});
+
+test("preserves PID tracking when process termination fails", async () => {
+  const dir = mkdtempSync(path.join(tmpdir(), "vellum live pid "));
+  const pidFile = path.join(dir, "assistant.pid");
+  writeFileSync(pidFile, `${process.pid}\n`, "utf8");
+
+  expect(
+    await stopProcessByPidFile(
+      pidFile,
+      "test process",
+      undefined,
+      0,
+      async () => false,
+      () => true,
+    ),
+  ).toBeFalse();
+  expect(isProcessAlive(pidFile)).toEqual({ alive: true, pid: process.pid });
+  rmSync(dir, { recursive: true, force: true });
+});

package/src/commands/client.ts

@@ -29,6 +29,7 @@ import {
 } from "../lib/client-identity";
 import {
   getLockfileData,
+  renameLockfileAssistantIfPresent,
   upsertRendererLockfileAssistant,
   replacePlatformAssistants,
   isActiveAssistant,
@@ -72,6 +73,7 @@ import { loopbackSafeFetch } from "../lib/loopback-fetch.js";
 import { probePort } from "../lib/port-probe.js";
 import { openBrowser } from "../lib/open-browser";
 import { isCompiledCli } from "../lib/local.js";
+import { findWebDistDir } from "../lib/web-dist.js";
 import { getLogDir, openLogFile, resetLogFile } from "../lib/xdg-log.js";
 
 const SUPPORTED_INTERFACES = ["cli", "web"] as const;
@@ -403,37 +405,6 @@ async function maybeHydratePlatformAssistantName(
 
 const SPA_BASE = "/assistant/";
 
-/**
- * Locate the pre-built @vellumai/web dist directory.
- *
- * Resolution order:
- *   1. npm-installed package — require.resolve('@vellumai/web/package.json')
- *   2. Source checkout — walk up from cli/ to find clients/web/dist/
- */
-function findWebDistDir(): string | null {
-  try {
-    const pkgPath = require.resolve("@vellumai/web/package.json");
-    const distDir = path.join(path.dirname(pkgPath), "dist");
-    if (existsSync(path.join(distDir, "index.html"))) {
-      return distDir;
-    }
-  } catch {
-    // Package not installed; try source checkout.
-  }
-
-  let dir = import.meta.dir;
-  for (let depth = 0; depth < 8; depth++) {
-    const candidate = path.join(dir, "clients", "web", "dist", "index.html");
-    if (existsSync(candidate)) {
-      return path.dirname(candidate);
-    }
-    const parent = path.dirname(dir);
-    if (parent === dir) break;
-    dir = parent;
-  }
-  return null;
-}
-
 /**
  * Locate the clients/web source directory for running the Vite dev server.
  * Only works from a source checkout (not npm-installed).
@@ -586,6 +557,13 @@ async function handleLocalEndpoints(
           body.platformAssistants as Array<Record<string, unknown>>,
           body.organizationId as string | undefined,
         );
+      } else if (body.rename && typeof body.rename === "object") {
+        const rename = body.rename as Record<string, unknown>;
+        result = renameLockfileAssistantIfPresent(
+          lockfilePaths,
+          rename.assistantId as string,
+          rename.name as string,
+        );
       } else {
         result = upsertRendererLockfileAssistant(
           lockfilePaths,

package/src/commands/nginx-ingress.ts

@@ -9,7 +9,6 @@ import {
 import type { AssistantEntry } from "../lib/assistant-config.js";
 import { parseAssistantTargetArg } from "../lib/assistant-target-args.js";
 import { GATEWAY_PORT } from "../lib/constants.js";
-import { WEB_REMOTE_INGRESS_FLAG } from "../lib/feature-flags.js";
 import {
   DEFAULT_NGINX_INGRESS_PORT,
   ensureTunnelEdge,
@@ -61,15 +60,6 @@ function printHelp(): void {
   console.log("  $ vellum nginx-ingress status");
   console.log("  $ vellum nginx-ingress up");
   console.log("  $ vellum nginx-ingress down my-assistant");
-  console.log("");
-  console.log("Feature flags:");
-  console.log(
-    `  ${WEB_REMOTE_INGRESS_FLAG} selects the edge mode: enabled serves the`,
-  );
-  console.log(
-    "  remote web app alongside webhooks; disabled starts a webhooks-only",
-  );
-  console.log("  proxy.");
 }
 
 interface NginxIngressTarget {
@@ -177,11 +167,6 @@ export async function up(target: NginxIngressTarget): Promise<void> {
 
   console.log("");
   console.log(`nginx ingress running: http://127.0.0.1:${edge.port} (${mode})`);
-  if (!edge.includesWebApp) {
-    console.log(
-      `Enable the ${WEB_REMOTE_INGRESS_FLAG} feature flag to also serve the web app remotely.`,
-    );
-  }
   console.log("");
   console.log("Next steps:");
   console.log(

package/src/commands/pair.ts

@@ -42,11 +42,6 @@ import {
 } from "../lib/client-identity.js";
 import { GATEWAY_PORT } from "../lib/constants.js";
 import { getCurrentEnvironment } from "../lib/environments/resolve.js";
-import {
-  formatFeatureFlagGateMessage,
-  isAssistantFeatureFlagEnabled,
-  WEB_REMOTE_INGRESS_FLAG,
-} from "../lib/feature-flags.js";
 import { getLocalLanIPv4 } from "../lib/local.js";
 import { isLoopbackUrl, loopbackSafeFetch } from "../lib/loopback-fetch.js";
 import { formatWebApproveFailure, parseGatewayErrorCode } from "../lib/pair.js";
@@ -265,34 +260,6 @@ async function approveRemoteWebPairing(
   return (await response.json()) as RemoteWebPairingVerificationResponse;
 }
 
-async function assertWebRemoteIngressEnabled(
-  assistantId: string,
-  runtimeUrl: string,
-): Promise<void> {
-  let enabled: boolean;
-  try {
-    enabled = await isAssistantFeatureFlagEnabled(
-      assistantId,
-      WEB_REMOTE_INGRESS_FLAG,
-      { runtimeUrl },
-    );
-  } catch (err) {
-    console.error(
-      `Error: could not verify the \`${WEB_REMOTE_INGRESS_FLAG}\` feature flag. Is the assistant running? Try \`vellum wake\` and retry. ${
-        err instanceof Error ? err.message : String(err)
-      }`,
-    );
-    process.exit(1);
-  }
-
-  if (!enabled) {
-    console.error(
-      `Error: ${formatFeatureFlagGateMessage(WEB_REMOTE_INGRESS_FLAG)}`,
-    );
-    process.exit(1);
-  }
-}
-
 export async function pair(): Promise<void> {
   const rawArgs = process.argv.slice(3);
 
@@ -440,8 +407,6 @@ export async function pair(): Promise<void> {
   }
 
   if (webApproveCode) {
-    await assertWebRemoteIngressEnabled(entry.assistantId, mintUrl);
-
     // Rejections are diagnosed here rather than by exitOnHttpError: a
     // rejected code must name the gateway that was asked, or an
     // assistant/environment mismatch is indistinguishable from a typo.
@@ -472,8 +437,6 @@ export async function pair(): Promise<void> {
   }
 
   if (webPairing) {
-    await assertWebRemoteIngressEnabled(entry.assistantId, mintUrl);
-
     let publicBaseUrl: string;
     try {
       publicBaseUrl = normalizePairingBaseUrl(advertisedUrl);
@@ -551,8 +514,6 @@ export async function pair(): Promise<void> {
     }
     const qrBaseUrl = qrResult.url;
 
-    await assertWebRemoteIngressEnabled(entry.assistantId, mintUrl);
-
     // Mint a challenge and immediately approve it: running this CLI on the host
     // IS the local-presence proof, so the scanning device completes pairing in
     // one step. Reuses the `--web` + `--web-approve` code paths.

package/src/commands/wake.ts

@@ -134,11 +134,24 @@ export async function wake(): Promise<void> {
     "readyz",
   );
   if (daemonState.status !== "needs_start") {
-    if (watch && isAssistantWatchModeAvailable()) {
+    if (daemonState.status === "stuck") {
+      daemonRunning = true;
+      daemonUnready = true;
+      console.log(
+        `Assistant running (pid ${daemonState.pid}) but is not responding and could not be stopped.`,
+      );
+    } else if (watch && isAssistantWatchModeAvailable()) {
       console.log(
         `Assistant running (pid ${daemonState.pid}) — restarting in watch mode...`,
       );
-      await stopProcessByPidFile(pidFile, "assistant");
+      const stopped = await stopProcessByPidFile(pidFile, "assistant");
+      if (!stopped && isProcessAlive(pidFile).alive) {
+        daemonRunning = true;
+        daemonUnready = true;
+        console.log(
+          `Assistant running (pid ${daemonState.pid}) but could not be stopped for watch mode.`,
+        );
+      }
     } else {
       daemonRunning = true;
       daemonUnready = daemonState.status !== "healthy";
@@ -249,8 +262,29 @@ export async function wake(): Promise<void> {
       "Gateway",
     );
     const gatewayAlive = gatewayState.status === "healthy";
+    const gatewayStuck = gatewayState.status === "stuck";
+    const restartGateway = async (
+      restartWithWatch: boolean,
+    ): Promise<boolean> => {
+      const stopped = await stopProcessByPidFile(gatewayPidFile, "gateway");
+      if (!stopped && isProcessAlive(gatewayPidFile).alive) {
+        console.log(
+          `Gateway running (pid ${gatewayState.pid}) but could not be stopped.`,
+        );
+        return false;
+      }
+      await startGateway(restartWithWatch, resources, {
+        signingKey,
+        bootstrapSecret,
+      });
+      return true;
+    };
     const needsRestart = bootstrapSecretBackfilled && gatewayAlive;
-    if (needsRestart) {
+    if (gatewayStuck) {
+      console.log(
+        `Gateway running (pid ${gatewayState.pid}) but is not responding and could not be stopped.`,
+      );
+    } else if (needsRestart) {
       const restartWithWatch = watch && isGatewayWatchModeAvailable();
       if (restartWithWatch) {
         console.log(
@@ -261,20 +295,13 @@ export async function wake(): Promise<void> {
           `Gateway running (pid ${gatewayState.pid}) — restarting without watch mode to apply bootstrap secret...`,
         );
       }
-      await stopProcessByPidFile(gatewayPidFile, "gateway");
-      await startGateway(restartWithWatch, resources, {
-        signingKey,
-        bootstrapSecret,
-      });
-      gatewayStarted = true;
+      gatewayStarted = await restartGateway(restartWithWatch);
     } else if (gatewayAlive) {
       if (watch && isGatewayWatchModeAvailable()) {
         console.log(
           `Gateway running (pid ${gatewayState.pid}) — restarting in watch mode...`,
         );
-        await stopProcessByPidFile(gatewayPidFile, "gateway");
-        await startGateway(watch, resources, { signingKey, bootstrapSecret });
-        gatewayStarted = true;
+        gatewayStarted = await restartGateway(watch);
       } else {
         if (watch) {
           console.log(