npm - @vellumai/cli - Versions diffs - 0.11.3 → 0.11.4-dev.202608190019.b94dbf2 - Mend

@vellumai/cli 0.11.3 → 0.11.4-dev.202608190019.b94dbf2

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (41) hide show

package/node_modules/@vellumai/local-mode/src/__tests__/unpair.test.ts +33 -0
package/node_modules/@vellumai/local-mode/src/index.ts +3 -0
package/node_modules/@vellumai/local-mode/src/lockfile-lock.test.ts +165 -0
package/node_modules/@vellumai/local-mode/src/lockfile-lock.ts +156 -0
package/node_modules/@vellumai/local-mode/src/lockfile.test.ts +249 -8
package/node_modules/@vellumai/local-mode/src/lockfile.ts +186 -68
package/node_modules/@vellumai/local-mode/src/unpair.ts +18 -0
package/node_modules/@vellumai/service-contracts/package.json +1 -0
package/node_modules/@vellumai/service-contracts/src/__tests__/url-normalization.test.ts +135 -0
package/node_modules/@vellumai/service-contracts/src/channels.ts +11 -0
package/node_modules/@vellumai/service-contracts/src/index.ts +1 -0
package/node_modules/@vellumai/service-contracts/src/remote-web-pairing.ts +60 -0
package/node_modules/@vellumai/service-contracts/src/url-normalization.ts +107 -0
package/package.json +1 -1
package/src/__tests__/assistant-config.test.ts +35 -0
package/src/__tests__/nginx-ingress-command.test.ts +4 -23
package/src/__tests__/nginx-ingress.test.ts +59 -215
package/src/__tests__/pair.test.ts +11 -197
package/src/__tests__/retire-archive.test.ts +13 -1
package/src/__tests__/retire-local.test.ts +58 -4
package/src/__tests__/tunnel.test.ts +0 -28
package/src/__tests__/wake.test.ts +91 -69
package/src/__tests__/windows-lifecycle.test.ts +157 -0
package/src/commands/client.ts +9 -31
package/src/commands/nginx-ingress.ts +0 -15
package/src/commands/pair.ts +0 -39
package/src/commands/wake.ts +39 -12
package/src/lib/__tests__/web-dist.test.ts +86 -0
package/src/lib/assistant-config.ts +64 -27
package/src/lib/local.ts +60 -20
package/src/lib/nginx-ingress.ts +35 -108
package/src/lib/orphan-detection.test.ts +3 -0
package/src/lib/orphan-detection.ts +33 -11
package/src/lib/pgrep.ts +20 -2
package/src/lib/process.ts +191 -18
package/src/lib/retire-archive.ts +38 -8
package/src/lib/retire-local.ts +75 -9
package/src/lib/tunnel-edge.ts +14 -22
package/src/lib/web-dist.ts +48 -0
package/src/lib/feature-flags.test.ts +0 -157
package/src/lib/feature-flags.ts +0 -38

package/src/lib/__tests__/web-dist.test.ts ADDED Viewed

@@ -0,0 +1,86 @@
+import { afterEach, expect, test } from "bun:test";
+import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { findWebDistDir } from "../web-dist.js";
+const tempDirs: string[] = [];
+function makeTempDir(): string {
+  const dir = mkdtempSync(join(tmpdir(), "vellum-web-dist-"));
+  tempDirs.push(dir);
+  return dir;
+}
+function writeWebDist(dir: string): void {
+  mkdirSync(dir, { recursive: true });
+  writeFileSync(join(dir, "index.html"), "<!doctype html>", "utf8");
+}
+const missingPackage = (): string => {
+  throw new Error("package missing");
+};
+afterEach(() => {
+  for (const dir of tempDirs.splice(0)) {
+    rmSync(dir, { recursive: true, force: true });
+  }
+});
+test("finds web assets beside a packaged Windows CLI", () => {
+  const root = makeTempDir();
+  const runtimeDir = join(root, "runtime");
+  const webDistDir = join(runtimeDir, "web-dist");
+  writeWebDist(webDistDir);
+  expect(
+    findWebDistDir({
+      execPath: join(runtimeDir, "vellum.exe"),
+      platform: "win32",
+      resolvePackage: missingPackage,
+      startDir: join(root, "source"),
+    }),
+  ).toBe(webDistDir);
+});
+test("does not use the Windows runtime path on macOS", () => {
+  const root = makeTempDir();
+  const runtimeDir = join(root, "runtime");
+  writeWebDist(join(runtimeDir, "web-dist"));
+  expect(
+    findWebDistDir({
+      execPath: join(runtimeDir, "vellum"),
+      platform: "darwin",
+      resolvePackage: missingPackage,
+      startDir: join(root, "source"),
+    }),
+  ).toBeNull();
+});
+test("preserves installed package and source checkout resolution", () => {
+  const root = makeTempDir();
+  const packageDir = join(root, "package");
+  const packageDist = join(packageDir, "dist");
+  writeWebDist(packageDist);
+  writeFileSync(join(packageDir, "package.json"), "{}", "utf8");
+  expect(
+    findWebDistDir({
+      platform: "linux",
+      resolvePackage: () => join(packageDir, "package.json"),
+      startDir: join(root, "missing-source"),
+    }),
+  ).toBe(packageDist);
+  const sourceDist = join(root, "repo", "clients", "web", "dist");
+  writeWebDist(sourceDist);
+  expect(
+    findWebDistDir({
+      platform: "linux",
+      resolvePackage: missingPackage,
+      startDir: join(root, "repo", "cli", "src"),
+    }),
+  ).toBe(sourceDist);
+});

package/src/lib/assistant-config.ts CHANGED Viewed

@@ -11,6 +11,7 @@ import { homedir } from "os";
 import { dirname, join } from "path";
 import { SEEDS, type EnvironmentDefinition } from "@vellumai/environments";
+import { withLockfileLock } from "@vellumai/local-mode";
 import {
   resolveCloud,
   type LocalAssistantResources,
@@ -186,7 +187,7 @@ function readLockfile(): LockfileData {
   return {};
 }
-function writeLockfile(data: LockfileData): void {
+function writeLockfileUnlocked(data: LockfileData): void {
   const lockfilePath = getLockfilePath(getCurrentEnvironment());
   mkdirSync(dirname(lockfilePath), { recursive: true });
   const tmpPath = `${lockfilePath}.${randomBytes(4).toString("hex")}.tmp`;
@@ -201,6 +202,23 @@ function writeLockfile(data: LockfileData): void {
   }
 }
+/**
+ * Run `fn` under the same cross-process advisory lock the local-mode hosts
+ * use, keyed to this environment's write-path lockfile, so CLI writers and
+ * package-side writers (Electron main, Vite plugin, `vellum client`) never
+ * interleave read-modify-write cycles. Reentrant, so wrapped units may call
+ * the locked write helpers. Throws on lock timeout, matching the fs-error
+ * contract of the write path.
+ */
+function withCliLockfileLock<T>(fn: () => T): T {
+  const locked = withLockfileLock(
+    [getLockfilePath(getCurrentEnvironment())],
+    fn,
+  );
+  if (!locked.ok) throw new Error(locked.error);
+  return locked.value;
+}
 /**
  * Try to extract a port number from a URL string (e.g. `http://localhost:7830`).
  * Returns undefined if the URL is malformed or has no explicit port.
@@ -322,7 +340,18 @@ function readAssistants(): AssistantEntry[] {
   }
   if (migrated) {
-    writeLockfile(data);
+    // Persist the backfill against a fresh read under the lock so this
+    // snapshot cannot clobber a concurrent writer; skip on contention (the
+    // in-memory result below is already migrated).
+    withLockfileLock([getLockfilePath(getCurrentEnvironment())], () => {
+      const fresh = readLockfile();
+      if (!Array.isArray(fresh.assistants)) return;
+      let freshMigrated = false;
+      for (const entry of fresh.assistants) {
+        if (migrateLegacyEntry(entry)) freshMigrated = true;
+      }
+      if (freshMigrated) writeLockfileUnlocked(fresh);
+    });
   }
   const result: AssistantEntry[] = [];
@@ -342,9 +371,11 @@ function readAssistants(): AssistantEntry[] {
 }
 function writeAssistants(entries: AssistantEntry[]): void {
-  const data = readLockfile();
-  data.assistants = entries;
-  writeLockfile(data);
+  withCliLockfileLock(() => {
+    const data = readLockfile();
+    data.assistants = entries;
+    writeLockfileUnlocked(data);
+  });
 }
 export function loadLatestAssistant(): AssistantEntry | null {
@@ -428,21 +459,23 @@ export function formatAssistantLookupError(
 }
 export function removeAssistantEntry(assistantId: string): void {
-  const data = readLockfile();
-  const entries = (data.assistants ?? []).filter(
-    (e) => e.assistantId !== assistantId,
-  );
-  data.assistants = entries;
-  // Reassign active assistant if it matches the removed entry
-  if (data.activeAssistant === assistantId) {
-    const remaining = entries[0];
-    if (remaining) {
-      data.activeAssistant = String(remaining.assistantId);
-    } else {
-      delete data.activeAssistant;
+  withCliLockfileLock(() => {
+    const data = readLockfile();
+    const entries = (data.assistants ?? []).filter(
+      (e) => e.assistantId !== assistantId,
+    );
+    data.assistants = entries;
+    // Reassign active assistant if it matches the removed entry
+    if (data.activeAssistant === assistantId) {
+      const remaining = entries[0];
+      if (remaining) {
+        data.activeAssistant = String(remaining.assistantId);
+      } else {
+        delete data.activeAssistant;
+      }
     }
-  }
-  writeLockfile(data);
+    writeLockfileUnlocked(data);
+  });
 }
 export function loadAllAssistants(): AssistantEntry[] {
@@ -519,9 +552,11 @@ export function getActiveAssistant(): string | null {
 }
 export function setActiveAssistant(assistantId: string): void {
-  const data = readLockfile();
-  data.activeAssistant = assistantId;
-  writeLockfile(data);
+  withCliLockfileLock(() => {
+    const data = readLockfile();
+    data.activeAssistant = assistantId;
+    writeLockfileUnlocked(data);
+  });
 }
 /**
@@ -607,11 +642,13 @@ export function extractHostFromUrl(url: string): string {
 }
 export function saveAssistantEntry(entry: AssistantEntry): void {
-  const entries = readAssistants().filter(
-    (e) => e.assistantId !== entry.assistantId,
-  );
-  entries.unshift(entry);
-  writeAssistants(entries);
+  withCliLockfileLock(() => {
+    const entries = readAssistants().filter(
+      (e) => e.assistantId !== entry.assistantId,
+    );
+    entries.unshift(entry);
+    writeAssistants(entries);
+  });
 }
 /**

package/src/lib/local.ts CHANGED Viewed

@@ -10,7 +10,7 @@ import {
 import { createRequire } from "module";
 import { Socket } from "net";
 import { homedir, networkInterfaces, platform, tmpdir } from "os";
-import { basename, dirname, join } from "path";
+import { basename, dirname, isAbsolute, join } from "path";
 import {
   findAssistantCommand,
@@ -39,6 +39,8 @@ import {
 import { stopIngressNginx } from "./nginx-ingress.js";
 import {
   type ProcessState,
+  executableName,
+  pathListDelimiter,
   resolveProcessState,
   stopProcess,
   stopProcessByPidFile,
@@ -55,6 +57,11 @@ const DARWIN_UNIX_SOCKET_MAX_PATH_BYTES = 103;
 // assistant.sock = 14 chars, plus 1 for the "/" separator = 15 overhead.
 const LONGEST_SOCKET_FILENAME = "assistant.sock";
 const LOCAL_RUNTIME_PACKAGE = "vellum";
+const PATH_DELIMITER = pathListDelimiter(platform());
+const DEFAULT_EXECUTABLE_PATH =
+  platform() === "win32"
+    ? "C:\\Windows\\System32;C:\\Windows"
+    : "/usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin";
 export interface LocalRuntimeInstall {
   version: string;
@@ -116,12 +123,16 @@ function hasLocalRuntimeComponents(installDir: string): boolean {
  * and point at whatever version happens to be installed globally.
  */
 export function isCompiledCli(): boolean {
-  const execBase = basename(process.execPath);
+  const execBase = basename(process.execPath).replace(/\.exe$/i, "");
   return (
     execBase !== "bun" && execBase !== "bunx" && !execBase.startsWith("bun-")
   );
 }
+function compiledSibling(name: string): string {
+  return join(dirname(process.execPath), executableName(name, platform()));
+}
 function resolveBunExecutable(): string {
   if (!isCompiledCli()) {
     return process.execPath;
@@ -130,16 +141,22 @@ function resolveBunExecutable(): string {
   const envBun = process.env.VELLUM_BUN;
   if (envBun && existsSync(envBun)) return envBun;
-  const siblingBun = join(dirname(process.execPath), "bun");
+  const bunName = executableName("bun", platform());
+  const siblingBun = compiledSibling("bun");
   if (existsSync(siblingBun)) return siblingBun;
-  const bundledBun = join(dirname(process.execPath), "..", "Resources", "bun");
+  const bundledBun = join(
+    dirname(process.execPath),
+    "..",
+    "Resources",
+    bunName,
+  );
   if (existsSync(bundledBun)) return bundledBun;
-  const homeBun = join(homedir(), ".bun", "bin", "bun");
+  const homeBun = join(homedir(), ".bun", "bin", bunName);
   if (existsSync(homeBun)) return homeBun;
-  return "bun";
+  return bunName;
 }
 function envWithBunPath(
@@ -147,16 +164,16 @@ function envWithBunPath(
   commandDirs: string[] = [],
 ): Record<string, string | undefined> {
   const bunPath = resolveBunExecutable();
-  const basePath = env.PATH || "/usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin";
+  const basePath = env.PATH || DEFAULT_EXECUTABLE_PATH;
   const extraDirs = [
-    bunPath.includes("/") ? dirname(bunPath) : "",
+    isAbsolute(bunPath) ? dirname(bunPath) : "",
     ...commandDirs,
     join(homedir(), ".bun", "bin"),
     join(homedir(), ".local", "bin"),
-  ].filter((dir) => dir && !basePath.split(":").includes(dir));
+  ].filter((dir) => dir && !basePath.split(PATH_DELIMITER).includes(dir));
   return {
     ...env,
-    PATH: [...extraDirs, basePath].filter(Boolean).join(":"),
+    PATH: [...extraDirs, basePath].filter(Boolean).join(PATH_DELIMITER),
   };
 }
@@ -649,7 +666,9 @@ function logAssistantAlreadyRunning(
       ? " but its database migrations failed — restart to recover"
       : status === "unready"
         ? " — database migrations still running"
-        : "";
+        : status === "stuck"
+          ? " but is not responding and could not be stopped"
+          : "";
   console.log(`   Assistant already running (pid ${pid})${suffix}\n`);
 }
@@ -968,7 +987,7 @@ export async function startCes(
   let ces;
   const runtimeCesDir = !watch ? localRuntimeCesDir(resources) : undefined;
-  const cesBinary = join(dirname(process.execPath), "credential-executor");
+  const cesBinary = compiledSibling("credential-executor");
   if (!runtimeCesDir && isCompiledCli() && existsSync(cesBinary) && !watch) {
     // Compiled binary alongside the CLI (desktop app / compiled CLI).
     const cesLogFd = openLogFile("hatch.log");
@@ -1328,7 +1347,10 @@ export function isGatewayWatchModeAvailable(): boolean {
  * The wrapper is idempotent: safe to call on every daemon wake.
  */
 function writeAssistantWrapper(resources: LocalInstanceResources): void {
-  const assistantBinary = join(dirname(process.execPath), "assistant");
+  if (platform() === "win32") {
+    return;
+  }
+  const assistantBinary = compiledSibling("assistant");
   if (!isCompiledCli() || !existsSync(assistantBinary)) return;
   const workspaceDir = join(resources.instanceDir, ".vellum", "workspace");
@@ -1391,7 +1413,7 @@ export async function startLocalDaemon(
   // This covers both the desktop app (VELLUM_DESKTOP_APP) and the case where
   // the user runs the compiled CLI directly from the terminal (e.g. via a
   // /usr/local/bin/vellum symlink into the app bundle).
-  const daemonBinary = join(dirname(process.execPath), "vellum-daemon");
+  const daemonBinary = compiledSibling("vellum-daemon");
   if (isCompiledCli() && existsSync(daemonBinary) && !watch) {
     // In watch mode, skip the bundled binary and use source (bun --watch
     // only works with source files, not compiled binaries).
@@ -1443,21 +1465,39 @@ export async function startLocalDaemon(
       const home = homedir();
       const bunBinDir = join(home, ".bun", "bin");
       const localBinDir = join(home, ".local", "bin");
-      const basePath =
-        process.env.PATH || "/usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin";
+      const basePath = process.env.PATH || DEFAULT_EXECUTABLE_PATH;
       // The compiled `assistant` ships beside the daemon binary, so its
       // directory is what puts `assistant …` on PATH for agent-run commands.
       const daemonBinaryDir = dirname(daemonBinary);
-      const assistantBinaryDir = existsSync(join(daemonBinaryDir, "assistant"))
+      const assistantBinaryDir = existsSync(
+        join(daemonBinaryDir, executableName("assistant", platform())),
+      )
         ? [daemonBinaryDir]
         : [];
       const extraDirs = [...assistantBinaryDir, bunBinDir, localBinDir].filter(
-        (d) => !basePath.split(":").includes(d),
+        (d) => !basePath.split(PATH_DELIMITER).includes(d),
       );
       const daemonEnv: Record<string, string> = {
         HOME: process.env.HOME || home,
-        PATH: [...extraDirs, basePath].filter(Boolean).join(":"),
+        PATH: [...extraDirs, basePath].filter(Boolean).join(PATH_DELIMITER),
       };
+      if (platform() === "win32") {
+        for (const key of [
+          "APPDATA",
+          "COMSPEC",
+          "LOCALAPPDATA",
+          "PATHEXT",
+          "SystemDrive",
+          "SystemRoot",
+          "TEMP",
+          "TMP",
+          "USERPROFILE",
+        ]) {
+          if (process.env[key]) {
+            daemonEnv[key] = process.env[key];
+          }
+        }
+      }
       // Forward optional config env vars the daemon may need.
       // `VELLUM_ENVIRONMENT` must be forwarded so the daemon resolves
       // env-scoped paths (device ID, platform/guardian tokens, XDG
@@ -1692,7 +1732,7 @@ export async function startGateway(
   const runtimeGatewayDir = !watch
     ? localRuntimeGatewayDir(resources)
     : undefined;
-  const gatewayBinary = join(dirname(process.execPath), "vellum-gateway");
+  const gatewayBinary = compiledSibling("vellum-gateway");
   if (
     !runtimeGatewayDir &&
     isCompiledCli() &&

package/src/lib/nginx-ingress.ts CHANGED Viewed

@@ -7,16 +7,14 @@ import {
 import { createHash } from "node:crypto";
 import {
   closeSync,
-  existsSync,
   mkdirSync,
   openSync,
   readFileSync,
   rmSync,
   writeFileSync,
 } from "node:fs";
-import { createRequire } from "node:module";
 import { networkInterfaces } from "node:os";
-import { dirname, join } from "node:path";
+import { join } from "node:path";
 import { cloudAssistantHubUrl } from "@vellumai/environments";
@@ -25,12 +23,11 @@ import {
   lookupAssistantByIdentifier,
 } from "./assistant-config.js";
 import { getCurrentEnvironment } from "./environments/resolve.js";
-import {
-  isAssistantFeatureFlagEnabled,
-  WEB_REMOTE_INGRESS_FLAG,
-} from "./feature-flags.js";
 import { waitForDaemonReady } from "./http-client.js";
 import { loadRawConfig, saveRawConfig } from "./ingress-config.js";
+import { findWebDistDir } from "./web-dist.js";
+export { findWebDistDir } from "./web-dist.js";
 /**
  * CLI-managed nginx reverse proxy that fronts the gateway as the canonical
@@ -41,7 +38,6 @@ import { loadRawConfig, saveRawConfig } from "./ingress-config.js";
  */
 export const DEFAULT_NGINX_INGRESS_PORT = 7840;
-const _require = createRequire(import.meta.url);
 /** Listen port for nginx ingress, from VELLUM_NGINX_INGRESS_PORT. */
 export function getNginxIngressPort(): number {
@@ -72,37 +68,6 @@ export function getIngressPaths(workspaceDir: string): IngressPaths {
   };
 }
-/**
- * Locate the pre-built @vellumai/web dist directory.
- *
- * Resolution order:
- *   1. npm-installed package — require.resolve('@vellumai/web/package.json')
- *   2. Source checkout — walk up from cli/ to find clients/web/dist/
- */
-export function findWebDistDir(): string | null {
-  try {
-    const pkgPath = _require.resolve("@vellumai/web/package.json");
-    const distDir = join(dirname(pkgPath), "dist");
-    if (existsSync(join(distDir, "index.html"))) {
-      return distDir;
-    }
-  } catch {
-    // Package not installed; try source checkout.
-  }
-  let dir = import.meta.dir;
-  for (let depth = 0; depth < 8; depth++) {
-    const candidate = join(dir, "clients", "web", "dist", "index.html");
-    if (existsSync(candidate)) {
-      return dirname(candidate);
-    }
-    const parent = dirname(dir);
-    if (parent === dir) break;
-    dir = parent;
-  }
-  return null;
-}
 function nginxQuoted(value: string, label: string): string {
   if (/[\u0000-\u001f\u007f]/.test(value)) {
     throw new Error(`${label} contains a control character`);
@@ -125,6 +90,7 @@ function gatewayProxyBlock(gatewayPort: number): string {
       proxy_read_timeout 1h;
       proxy_set_header Host $host;
       proxy_set_header X-Vellum-Edge-Forwarded "1";
+      proxy_set_header X-Vellum-Client-Ip $vellum_edge_client_ip;
       proxy_set_header Upgrade $http_upgrade;
       proxy_set_header Connection $connection_upgrade;`;
 }
@@ -147,6 +113,12 @@ const DENYLIST_LOCATIONS = `    location = /auth/token { return 404; }
     location = /v1/guardian/init/ { return 404; }
     location = /v1/guardian/reset-bootstrap { return 404; }
     location = /v1/guardian/reset-bootstrap/ { return 404; }
+    location = /v1/remote-web/pairing-requests { return 404; }
+    location = /v1/remote-web/pairing-requests/ { return 404; }
+    location = /v1/remote-web/pairing-requests/approve { return 404; }
+    location = /v1/remote-web/pairing-requests/approve/ { return 404; }
+    location = /v1/remote-web/pairing-requests/deny { return 404; }
+    location = /v1/remote-web/pairing-requests/deny/ { return 404; }
     location = /v1/remote-web/pairing-verification { return 404; }
     location = /v1/remote-web/pairing-verification/ { return 404; }
     location ^~ /assistant/__local/ { return 404; }
@@ -193,7 +165,7 @@ function remoteWebIngressConfig(
  * fingerprint matches, so this must change whenever the generated index or
  * nginx template does.
  */
-const EDGE_TEMPLATE_VERSION = 2;
+const EDGE_TEMPLATE_VERSION = 3;
 /**
  * Stable fingerprint of the SPA config injected into the served index and
@@ -309,6 +281,19 @@ http {
     "" close;
   }
+  # Edge-observed client address, stamped onto every proxied request as
+  # X-Vellum-Client-Ip. proxy_set_header overwrites any inbound value, so a
+  # remote client cannot smuggle one. Every caller reaches this loopback-only
+  # listener through the TLS-terminating front (tunnel agent), so the raw peer
+  # is always 127.0.0.1; the front records the real client as the RIGHTMOST
+  # X-Forwarded-For entry (ngrok/cloudflared append, tailscale serve sets it),
+  # which the remote client cannot control. Fall back to the raw peer when the
+  # front sets no X-Forwarded-For.
+  map $http_x_forwarded_for $vellum_edge_client_ip {
+    default $remote_addr;
+    "~,?\\s*(?<vellum_last_xff>[^,\\s]+)\\s*$" $vellum_last_xff;
+  }
   server {
     listen 127.0.0.1:${opts.listenPort};
 ${ipv6Listen}    client_max_body_size 512m;
@@ -910,50 +895,6 @@ export async function startRemoteWebIngress(opts: {
   return rollback("port-conflict");
 }
-/** Retry policy for the `web-remote-ingress` flag lookup. */
-export interface FlagRetryPolicy {
-  attempts: number;
-  intervalMs: number;
-}
-/**
- * Resolve the edge mode for an assistant: the `web-remote-ingress` flag selects
- * the SPA edge when enabled and the webhooks-only edge when disabled. The
- * lookup requires a reachable assistant; `flagRetry` rides out a gateway that
- * is still starting by retrying thrown lookups (a resolved `false` is a real
- * answer, not a retry). When the budget is spent the last error throws with a
- * wake hint.
- */
-async function resolveEdgeIncludesWebApp(
-  assistantId: string,
-  gatewayPort: number,
-  flagRetry?: FlagRetryPolicy,
-): Promise<boolean> {
-  const attempts = Math.max(1, flagRetry?.attempts ?? 1);
-  let lastError: unknown;
-  for (let attempt = 1; attempt <= attempts; attempt++) {
-    try {
-      return await isAssistantFeatureFlagEnabled(
-        assistantId,
-        WEB_REMOTE_INGRESS_FLAG,
-        { runtimeUrl: `http://127.0.0.1:${gatewayPort}` },
-      );
-    } catch (err) {
-      lastError = err;
-      if (attempt < attempts) {
-        await new Promise((resolve) =>
-          setTimeout(resolve, flagRetry?.intervalMs ?? 0),
-        );
-      }
-    }
-  }
-  throw new Error(
-    `Could not verify the \`${WEB_REMOTE_INGRESS_FLAG}\` feature flag before starting the edge. Is the assistant running? Try \`vellum wake\` and retry. ${
-      lastError instanceof Error ? lastError.message : String(lastError)
-    }`,
-  );
-}
 /**
  * Display name recorded for the assistant in the CLI lockfile; undefined when
  * no entry matches, so the served config omits the label rather than guessing.
@@ -983,13 +924,11 @@ export interface TunnelEdge {
  * Bring up the nginx edge as the canonical tunnel target and return the listen
  * port a tunnel should front.
  *
- * The `web-remote-ingress` flag picks the edge mode (enabled: SPA + gateway
- * proxy, disabled: webhooks-only proxy); an entry without an assistant id
- * cannot have the flag verified and gets the webhooks-only edge. The resolved
+ * The edge always serves the SPA alongside the gateway proxy. The requested
  * mode is always delegated to `startRemoteWebIngress`, which reuses a running
  * edge that already serves that mode, gateway port, and injected SPA config
  * and restarts one that drifted in any respect, so the returned port always
- * fronts the flag-resolved config. `started` is false when a matching edge was
+ * fronts the requested config. `started` is false when a matching edge was
  * reused; a drifted edge that survives the restart attempt throws rather than
  * reporting the wrong config. Failures throw with actionable install or
  * diagnostic text.
@@ -998,8 +937,6 @@ export async function ensureTunnelEdge(opts: {
   assistantId: string | undefined;
   workspaceDir: string;
   gatewayPort: number;
-  /** Retries thrown flag lookups (e.g. a still-starting gateway); default one attempt. */
-  flagRetry?: FlagRetryPolicy;
   /** Forwarded to `startRemoteWebIngress` for caller progress output. */
   onStarting?: (info: {
     version: string;
@@ -1007,23 +944,14 @@ export async function ensureTunnelEdge(opts: {
     listenPort: number;
   }) => void;
 }): Promise<TunnelEdge> {
-  const includeWebApp = opts.assistantId
-    ? await resolveEdgeIncludesWebApp(
-        opts.assistantId,
-        opts.gatewayPort,
-        opts.flagRetry,
-      )
-    : false;
-  const assistantName =
-    includeWebApp && opts.assistantId
-      ? lockfileAssistantName(opts.assistantId)
-      : undefined;
+  const assistantName = opts.assistantId
+    ? lockfileAssistantName(opts.assistantId)
+    : undefined;
   const result = await startRemoteWebIngress({
     workspaceDir: opts.workspaceDir,
     gatewayPort: opts.gatewayPort,
-    includeWebApp,
+    includeWebApp: true,
     ...(assistantName ? { assistantName } : {}),
     ...(opts.onStarting ? { onStarting: opts.onStarting } : {}),
   });
@@ -1033,16 +961,15 @@ export async function ensureTunnelEdge(opts: {
       return {
         port: result.listenPort,
         started: true,
-        includesWebApp: includeWebApp,
+        includesWebApp: true,
       };
     case "already-running": {
       // `already-running` also covers a drifted edge whose restart failed, so
       // trust the recorded state it carries over the requested config.
-      if (result.includeWebApp !== includeWebApp) {
-        const describe = (spa: boolean) => (spa ? "web app" : "webhooks-only");
+      if (!result.includeWebApp) {
         throw new Error(
-          `The nginx edge is still running in ${describe(result.includeWebApp)} mode ` +
-            `and could not be restarted in ${describe(includeWebApp)} mode. ` +
+          "The nginx edge is still running in webhooks-only mode " +
+            "and could not be restarted in web app mode. " +
             "Run `vellum nginx-ingress down` and retry.",
         );
       }

package/src/lib/orphan-detection.test.ts CHANGED Viewed

@@ -150,6 +150,9 @@ describe("detectOrphanedProcesses", () => {
       "103 1 vellum --plain logs foo",
       "104 1 bun /x/bin/vellum-gateway --port 7830",
       "105 1 vellum hatch",
+      "106 1 node /opt/unrelated-service/daemon/main.ts",
+      "107 1 node ./tools daemon start",
+      "108 1 node /opt/VELLUM/daemon/main.ts",
     ].join("\n");
     mock.module("./step-runner", () => ({
       ...realStepRunner,