@vellumai/cli 0.11.7-staging.2 → 0.11.8-staging.1

package/src/lib/live-voice/connection.ts

@@ -1,6 +1,10 @@
 /**
  * Resolving the live-voice WebSocket URL and the credential to open it with.
  *
+ * Two transports, chosen by how the assistant is deployed. A cloud assistant
+ * goes through velay with a minted WS token (see `./velay.ts`, which owns that
+ * path end to end). Everything below is the local and self-hosted one.
+ *
  * The endpoint is the **gateway's** `/v1/live-voice`, not the runtime's. That
  * distinction is the whole of the auth story: the runtime's copy demands a
  * gateway service token, which no client can mint, while the gateway's copy
@@ -26,18 +30,36 @@ import {
   formatAssistantReference,
   lookupAssistantByIdentifier,
   resolveTargetAssistant,
+  type AssistantEntry,
 } from "../assistant-config.js";
+import { getPlatformUrl, readPlatformToken } from "../platform-client.js";
 import {
   guardianTokenDueForRenewal,
   loadGuardianToken,
   refreshGuardianToken,
 } from "../guardian-token.js";
+import {
+  buildVelayLiveVoiceUrl,
+  mintVelayWsToken,
+  VelayWsTokenError,
+} from "./velay.js";
+
+/**
+ * Where the credential goes on the upgrade.
+ *
+ * A gateway takes a guardian JWT in an `Authorization` header. velay takes a
+ * minted WS token in the query string and reads no headers, so the two are not
+ * interchangeable: sending the header form to velay authenticates nothing.
+ */
+export type LiveVoiceTokenTransport = "header" | "query";
 
 export interface LiveVoiceConnection {
-  /** `ws(s)://…/v1/live-voice` on the assistant's gateway. */
+  /** `ws(s)://…/v1/live-voice`, on the assistant's gateway or on velay. */
   readonly url: string;
-  /** Guardian access token, sent as `Authorization: Bearer`. */
+  /** Guardian access token, or a minted velay WS token. */
   readonly token: string;
+  /** How {@link token} reaches the server. */
+  readonly tokenTransport: LiveVoiceTokenTransport;
   readonly assistantId: string;
   /** `name (id)` when they differ, else the id, for user-facing output. */
   readonly reference: string;
@@ -65,15 +87,12 @@ export async function resolveLiveVoiceConnection(
     ? resolveNamedAssistant(assistantIdArg)
     : resolveTargetAssistant();
 
-  // Platform-cloud assistants authenticate with a platform session token
-  // (`X-Session-Token`), and the live-voice upgrade accepts only an actor edge
-  // JWT or a velay attestation, neither of which the CLI has for a cloud
-  // instance. Say so plainly rather than opening a socket that 401s.
+  // Platform-cloud assistants are reached the other way round. Their gateway
+  // is behind velay, which authenticates nobody and forwards an attestation
+  // the gateway trusts, so the credential is not the guardian JWT below but a
+  // WS token minted from the platform session the CLI already holds.
   if (entry.cloud === "vellum") {
-    throw new LiveVoiceConnectionError(
-      `${formatAssistantReference(entry)} is a Vellum cloud assistant. ` +
-        "Voice sessions are supported for local and self-hosted assistants only.",
-    );
+    return await resolveCloudConnection(entry);
   }
 
   const baseUrl = (entry.localUrl || entry.runtimeUrl).replace(/\/+$/, "");
@@ -99,6 +118,64 @@ export async function resolveLiveVoiceConnection(
   return {
     url: parsed.toString(),
     token,
+    tokenTransport: "header",
+    assistantId: entry.assistantId,
+    reference: formatAssistantReference(entry),
+  };
+}
+
+/**
+ * Resolve a live-voice connection to a platform-hosted assistant.
+ *
+ * The session token is the CLI's own platform login, not anything specific to
+ * this assistant, so a missing one is a `vellum login` problem rather than an
+ * assistant problem and says so.
+ *
+ * The minted token is deliberately resolved here, at the last moment before
+ * the socket opens, and never cached: it expires in 60 seconds and is consumed
+ * by the upgrade that uses it.
+ */
+async function resolveCloudConnection(
+  entry: AssistantEntry,
+): Promise<LiveVoiceConnection> {
+  const sessionToken = readPlatformToken();
+  if (!sessionToken) {
+    throw new LiveVoiceConnectionError(
+      `${formatAssistantReference(entry)} is a Vellum cloud assistant, which ` +
+        "needs a platform login. Run 'vellum login' and try again.",
+    );
+  }
+
+  // `runtimeUrl` is the platform this entry was hatched against, which is the
+  // one that can mint for it. `getPlatformUrl()` is the fallback for an entry
+  // written before that field was recorded.
+  const platformUrl = (entry.runtimeUrl || getPlatformUrl()).replace(
+    /\/+$/,
+    "",
+  );
+
+  let token: string;
+  try {
+    token = await mintVelayWsToken({
+      platformUrl,
+      assistantId: entry.assistantId,
+      sessionToken,
+    });
+  } catch (err) {
+    if (err instanceof VelayWsTokenError) {
+      throw new LiveVoiceConnectionError(err.message);
+    }
+    throw err;
+  }
+
+  return {
+    url: buildVelayLiveVoiceUrl({
+      platformUrl,
+      assistantId: entry.assistantId,
+      token,
+    }),
+    token,
+    tokenTransport: "query",
     assistantId: entry.assistantId,
     reference: formatAssistantReference(entry),
   };

package/src/lib/live-voice/pcm-player.ts

@@ -47,6 +47,15 @@ const PLAYERS: readonly PlayerCommand[] = [
   {
     mode: "streaming",
     name: "ffplay",
+    // No channel-count flag. ffplay 7.x rejects `-ac` outright ("Option not
+    // found"), and `-ch_layout` does not exist before 5.1, so either spelling
+    // is broken on some supported machine. The pcm demuxer's `ch_layout`
+    // defaults to mono on every version, which is exactly what these frames
+    // are, so the portable answer is to say nothing and take the default.
+    //
+    // Getting this wrong fails silently: ffplay exits immediately, `adopt()`
+    // settles on that exit like any finished playback, and the session prints
+    // "Speaking via ffplay" while making no sound at all.
     args: (sampleRate) => [
       "-hide_banner",
       "-loglevel",
@@ -57,8 +66,6 @@ const PLAYERS: readonly PlayerCommand[] = [
       "s16le",
       "-ar",
       String(sampleRate),
-      "-ac",
-      "1",
       "-i",
       "pipe:0",
     ],
@@ -117,7 +124,11 @@ export function isOnPath(command: string): boolean {
       ? ["where", [command]]
       : ["/bin/sh", ["-c", `command -v ${command}`]];
   try {
-    execFileSync(probe, args, { stdio: "ignore", timeout: 2000 });
+    execFileSync(probe, args, {
+      stdio: "ignore",
+      timeout: 2000,
+      windowsHide: true,
+    });
     return true;
   } catch {
     return false;
@@ -261,6 +272,7 @@ export class PcmPlayer {
     }
     const child = spawn(this.player.name, this.player.args(sampleRate), {
       stdio: ["pipe", "ignore", "ignore"],
+      windowsHide: true,
     });
     this.adopt(child);
     this.activeSampleRate = sampleRate;
@@ -290,6 +302,7 @@ export class PcmPlayer {
     this.adopt(
       spawn(this.player.name, this.player.args(sampleRate, filePath), {
         stdio: "ignore",
+        windowsHide: true,
       }),
     );
   }

package/src/lib/live-voice/velay.test.ts

@@ -0,0 +1,99 @@
+import { afterEach, describe, expect, test } from "bun:test";
+
+import {
+  buildVelayLiveVoiceUrl,
+  velayHostForPlatformUrl,
+  velayWsScheme,
+} from "./velay.js";
+
+const ORIGINAL_VELAY_HOST = process.env.VELLUM_VELAY_HOST;
+
+afterEach(() => {
+  if (ORIGINAL_VELAY_HOST === undefined) {
+    delete process.env.VELLUM_VELAY_HOST;
+  } else {
+    process.env.VELLUM_VELAY_HOST = ORIGINAL_VELAY_HOST;
+  }
+});
+
+describe("velayHostForPlatformUrl", () => {
+  test("maps a platform host onto its environment's velay", () => {
+    delete process.env.VELLUM_VELAY_HOST;
+    expect(velayHostForPlatformUrl("https://platform.vellum.ai")).toBe(
+      "velay.vellum.ai",
+    );
+    expect(velayHostForPlatformUrl("https://dev-platform.vellum.ai")).toBe(
+      "velay-dev.vellum.ai",
+    );
+  });
+
+  test("falls back to production velay for a host outside the convention", () => {
+    delete process.env.VELLUM_VELAY_HOST;
+    // A local platform predicts no velay of its own; guessing one would be
+    // worse than dialing the host that certainly exists.
+    expect(velayHostForPlatformUrl("http://localhost:8000")).toBe(
+      "velay.vellum.ai",
+    );
+    expect(velayHostForPlatformUrl("not a url")).toBe("velay.vellum.ai");
+  });
+
+  test("the env override wins, which is how a local vel up velay is reached", () => {
+    process.env.VELLUM_VELAY_HOST = "localhost:8501";
+    expect(velayHostForPlatformUrl("https://platform.vellum.ai")).toBe(
+      "localhost:8501",
+    );
+  });
+});
+
+describe("velayWsScheme", () => {
+  test("downgrades to ws only for loopback", () => {
+    expect(velayWsScheme("localhost:8501")).toBe("ws");
+    expect(velayWsScheme("127.0.0.1:8501")).toBe("ws");
+    expect(velayWsScheme("velay.vellum.ai")).toBe("wss");
+  });
+});
+
+describe("buildVelayLiveVoiceUrl", () => {
+  test("prefixes the assistant id, which is what selects the tunnel", () => {
+    delete process.env.VELLUM_VELAY_HOST;
+    const url = new URL(
+      buildVelayLiveVoiceUrl({
+        platformUrl: "https://platform.vellum.ai",
+        assistantId: "01a02514-e452-7019-88d5-30828f42cf17",
+        token: "tok_abc",
+      }),
+    );
+
+    expect(url.protocol).toBe("wss:");
+    expect(url.host).toBe("velay.vellum.ai");
+    expect(url.pathname).toBe(
+      "/01a02514-e452-7019-88d5-30828f42cf17/v1/live-voice",
+    );
+    expect(url.searchParams.get("token")).toBe("tok_abc");
+  });
+
+  test("encodes a token rather than letting it break the query", () => {
+    delete process.env.VELLUM_VELAY_HOST;
+    const url = new URL(
+      buildVelayLiveVoiceUrl({
+        platformUrl: "https://platform.vellum.ai",
+        assistantId: "a1",
+        token: "a+b/c=&d",
+      }),
+    );
+    expect(url.searchParams.get("token")).toBe("a+b/c=&d");
+  });
+
+  test("uses ws against a loopback velay so a local stack is reachable", () => {
+    process.env.VELLUM_VELAY_HOST = "localhost:8501";
+    const url = new URL(
+      buildVelayLiveVoiceUrl({
+        platformUrl: "http://localhost:8000",
+        assistantId: "a1",
+        token: "t",
+      }),
+    );
+    expect(url.protocol).toBe("ws:");
+    expect(url.host).toBe("localhost:8501");
+  });
+});

package/src/lib/live-voice/velay.ts

@@ -0,0 +1,199 @@
+/**
+ * The cloud leg of a live-voice session: minting a velay WS token and building
+ * the URL it opens.
+ *
+ * A platform-hosted assistant is not reachable the way a local one is. Its
+ * gateway sits behind velay, velay performs no user authentication of its own,
+ * and the gateway upstream accepts only an actor edge JWT or a velay
+ * attestation. The CLI holds neither for a cloud instance: what it has is a
+ * platform session token, which is the wrong credential for the socket but the
+ * right one for the platform.
+ *
+ * So the connection is made in two hops, the same two the web voice room makes
+ * (`clients/web/src/domains/chat/voice/live-voice/connection.ts`):
+ *
+ *  1. POST the platform for a short-lived, org+assistant-scoped WS token.
+ *  2. Open `wss://<velay>/<assistantId>/v1/live-voice?token=<wsToken>`.
+ *
+ * velay consumes the token on the upgrade and injects the authenticated user
+ * and org downstream as `X-Velay-*` headers alongside its bridge proof. The
+ * gateway reads that attestation rather than the query param, and pins it to
+ * the assistant's bound guardian (`requireManagedGuardian`). The token is
+ * therefore an admission ticket for one upgrade, not a session credential.
+ *
+ * Two properties of that ticket shape this module's API. It lives for
+ * `LIVE_VOICE_WS_TOKEN_TTL` (60 seconds) and it is **single-use**: the
+ * validator consumes it atomically, so the same token cannot open a second
+ * socket. Minting is consequently tied to connecting, and a reconnect has to
+ * mint again rather than reuse what resolution returned.
+ */
+
+import { velayHostForPlatformHost } from "@vellumai/service-contracts/ingress";
+
+import { authHeaders } from "../platform-client.js";
+
+/** Production velay, when the platform host implies nothing more specific. */
+const DEFAULT_VELAY_HOST = "velay.vellum.ai";
+
+/** Give up on the mint rather than hang the session behind a stalled platform. */
+const MINT_TIMEOUT_MS = 10_000;
+
+export class VelayWsTokenError extends Error {
+  readonly status: number;
+
+  constructor(status: number, message: string) {
+    super(message);
+    this.name = "VelayWsTokenError";
+    this.status = status;
+  }
+}
+
+/**
+ * The velay host serving a given platform base URL.
+ *
+ * `VELLUM_VELAY_HOST` wins when set, which is how a local `vel up` stack is
+ * reached: its velay is a loopback port that no naming convention predicts.
+ * Otherwise the deployment convention maps the platform host onto its sibling
+ * (`platform.vellum.ai` to `velay.vellum.ai`, `dev-platform.vellum.ai` to
+ * `velay-dev.vellum.ai`). A host outside that convention, including localhost,
+ * yields the production default, because guessing a velay for it would be
+ * worse than dialing the one host that certainly exists.
+ */
+export function velayHostForPlatformUrl(platformUrl: string): string {
+  const override = process.env.VELLUM_VELAY_HOST?.trim();
+  if (override) {
+    return override;
+  }
+  try {
+    return (
+      velayHostForPlatformHost(new URL(platformUrl).host) ?? DEFAULT_VELAY_HOST
+    );
+  } catch {
+    return DEFAULT_VELAY_HOST;
+  }
+}
+
+/**
+ * `ws` for a loopback velay, `wss` for everything else.
+ *
+ * The local `vel up` velay is plain HTTP on a loopback port, which a `wss` dial
+ * cannot reach. Mirrors `getVelayWsScheme` in the web client so the two ends of
+ * the transport cannot disagree about which scheme a host takes.
+ */
+export function velayWsScheme(host: string): "ws" | "wss" {
+  let hostname: string;
+  try {
+    ({ hostname } = new URL(`http://${host}`));
+  } catch {
+    return "wss";
+  }
+  return hostname === "localhost" ||
+    hostname === "127.0.0.1" ||
+    hostname === "[::1]" ||
+    hostname === "::1"
+    ? "ws"
+    : "wss";
+}
+
+/**
+ * Build the velay live-voice URL.
+ *
+ * The `/<assistantId>` prefix is what selects the tunnel: velay strips it to
+ * recover the upstream path, and matches that path against its allowlist and
+ * against the scope recorded for the token. The token rides as `?token=`
+ * because a WebSocket upgrade from a non-browser client still cannot carry a
+ * credential anywhere velay reads except the query string.
+ */
+export function buildVelayLiveVoiceUrl(args: {
+  platformUrl: string;
+  assistantId: string;
+  token: string;
+}): string {
+  const host = velayHostForPlatformUrl(args.platformUrl);
+  const url = new URL(
+    `${velayWsScheme(host)}://${host}/${args.assistantId}/v1/live-voice`,
+  );
+  url.searchParams.set("token", args.token);
+  return url.toString();
+}
+
+interface LiveVoiceTokenResponse {
+  token?: unknown;
+  expiresAt?: unknown;
+}
+
+/**
+ * Mint a single-use velay WS token for one assistant.
+ *
+ * Authenticates with the CLI's stored platform session token. The mint
+ * endpoint pins its authenticators to the user-session ones
+ * (`SessionAuthentication` and `XSessionTokenAuthentication`) and deliberately
+ * excludes API-key auth, so `X-Session-Token` is the CLI's way in and a
+ * `vak_` key is not: a caller holding only an API key cannot mint here, by
+ * design on the platform's side.
+ *
+ * Throws {@link VelayWsTokenError} carrying the HTTP status, so the caller can
+ * tell "sign in again" (401) from "not your assistant" (403) from a platform
+ * that is simply down.
+ */
+export async function mintVelayWsToken(args: {
+  platformUrl: string;
+  assistantId: string;
+  sessionToken: string;
+}): Promise<string> {
+  const url = `${args.platformUrl.replace(/\/+$/, "")}/v1/auth/live-voice-token/`;
+  // `authHeaders` resolves `Vellum-Organization-Id`, which the endpoint needs
+  // to scope the token, and which is cached per token so a session does not
+  // pay for an extra round trip.
+  const headers = await authHeaders(args.sessionToken, args.platformUrl);
+
+  let response: Response;
+  try {
+    response = await fetch(url, {
+      method: "POST",
+      headers,
+      body: JSON.stringify({ assistantId: args.assistantId }),
+      signal: AbortSignal.timeout(MINT_TIMEOUT_MS),
+    });
+  } catch (err) {
+    throw new VelayWsTokenError(
+      0,
+      `Could not reach the Vellum platform to authorize the voice session: ${
+        err instanceof Error ? err.message : String(err)
+      }`,
+    );
+  }
+
+  if (!response.ok) {
+    throw new VelayWsTokenError(
+      response.status,
+      describeMintFailure(response.status),
+    );
+  }
+
+  const body = (await response.json().catch(() => ({}))) as
+    | LiveVoiceTokenResponse
+    | undefined;
+  const token = typeof body?.token === "string" ? body.token.trim() : "";
+  if (!token) {
+    throw new VelayWsTokenError(
+      response.status,
+      "The Vellum platform returned no voice session token.",
+    );
+  }
+  return token;
+}
+
+/** Turn a mint rejection into something the user can act on. */
+function describeMintFailure(status: number): string {
+  if (status === 401) {
+    return "Not signed in to the Vellum platform. Run 'vellum login' and try again.";
+  }
+  if (status === 403) {
+    return "This account cannot open a voice session on that assistant. Check that it belongs to the organization you are signed in to.";
+  }
+  if (status === 404) {
+    return "The Vellum platform does not offer voice session tokens. It may be running an older release.";
+  }
+  return `The Vellum platform refused to authorize the voice session (HTTP ${status}).`;
+}

package/src/lib/local-hatch-lock.ts

@@ -10,7 +10,7 @@ import {
   utimesSync,
   writeFileSync,
 } from "fs";
-import { hostname, userInfo } from "os";
+import { hostname, platform, userInfo } from "os";
 import { dirname, join } from "path";
 
 const DEFAULT_TIMEOUT_MS = 240_000;
@@ -62,11 +62,24 @@ function processIsAlive(pid: number): boolean {
 }
 
 function processStartedAt(pid: number): string | undefined {
+  const [file, args] =
+    platform() === "win32"
+      ? [
+          "powershell.exe",
+          [
+            "-NoProfile",
+            "-NonInteractive",
+            "-Command",
+            `(Get-CimInstance Win32_Process -Filter 'ProcessId = ${pid}').CreationDate.ToString('o')`,
+          ],
+        ]
+      : ["ps", ["-o", "lstart=", "-p", String(pid)]];
   try {
-    const value = execFileSync("ps", ["-o", "lstart=", "-p", String(pid)], {
+    const value = execFileSync(file, args, {
       encoding: "utf-8",
       stdio: ["ignore", "pipe", "ignore"],
-      timeout: 1_000,
+      timeout: platform() === "win32" ? 5_000 : 1_000,
+      windowsHide: true,
     }).trim();
     return value || undefined;
   } catch {

package/src/lib/local.ts

@@ -44,10 +44,12 @@ import {
 } from "./http-client.js";
 import { stopIngressNginx } from "./nginx-ingress.js";
 import {
+  DAEMON_STOP_TIMEOUT_MS,
   type ProcessState,
   executableName,
   isProcessAlive,
   pathListDelimiter,
+  readProcessCommandLine,
   resolveProcessState,
   stopProcess,
   stopProcessByPidFile,
@@ -140,6 +142,18 @@ function compiledSibling(name: string): string {
   return join(dirname(process.execPath), executableName(name, platform()));
 }
 
+function envWithCompiledRuntimeNodePath(
+  env: Record<string, string>,
+): Record<string, string> {
+  if (!isCompiledCli()) {
+    return env;
+  }
+  return {
+    ...env,
+    NODE_PATH: join(dirname(process.execPath), "node_modules"),
+  };
+}
+
 function resolveBunExecutable(): string {
   if (!isCompiledCli()) {
     return process.execPath;
@@ -266,6 +280,7 @@ export function ensureLocalRuntime(
     cwd: installDir,
     stdio: "inherit",
     env: envWithBunPath(process.env),
+    windowsHide: true,
   });
 
   if (result.error || result.status !== 0) {
@@ -517,6 +532,7 @@ function ensureBunInstalled(): void {
     execFileSync(resolveBunExecutable(), ["--version"], {
       stdio: "pipe",
       env: envWithBunPath(process.env),
+      windowsHide: true,
     });
     return;
   } catch {
@@ -555,6 +571,7 @@ function ensureBunInstalled(): void {
       stdio: "pipe",
       timeout: 60_000,
       env: installEnv,
+      windowsHide: true,
     });
     console.log("   Bun installed successfully");
   } catch {
@@ -832,6 +849,7 @@ async function startDaemonFromSource(
     ? spawn(bunPath, ["run", daemonMainPath], {
         stdio: "inherit",
         env: spawnEnv,
+        windowsHide: true,
       })
     : (() => {
         const daemonLogFd = openLogFile("hatch.log");
@@ -1170,7 +1188,12 @@ function findPidListeningOnPort(port: number): number | undefined {
     const output = execFileSync(
       "lsof",
       ["-iTCP:" + port, "-sTCP:LISTEN", "-t"],
-      { encoding: "utf-8", timeout: 3000, stdio: ["ignore", "pipe", "ignore"] },
+      {
+        encoding: "utf-8",
+        timeout: 3000,
+        stdio: ["ignore", "pipe", "ignore"],
+        windowsHide: true,
+      },
     ).trim();
     // lsof -t may return multiple PIDs (one per line); take the first.
     const pid = parseInt(output.split("\n")[0], 10);
@@ -1645,6 +1668,7 @@ export async function startLocalDaemon(
         }
       }
       applyDaemonEnvOverrides(daemonEnv, resources, options);
+      const daemonSpawnEnv = envWithCompiledRuntimeNodePath(daemonEnv);
 
       // Write a sentinel PID file before spawning so concurrent hatch() calls
       // see the file and fall through to the isDaemonResponsive() port check
@@ -1655,7 +1679,8 @@ export async function startLocalDaemon(
         ? spawn(daemonBinary, [], {
             cwd: dirname(daemonBinary),
             stdio: "inherit",
-            env: daemonEnv,
+            env: daemonSpawnEnv,
+            windowsHide: true,
           })
         : (() => {
             const daemonLogFd = openLogFile("hatch.log");
@@ -1664,7 +1689,7 @@ export async function startLocalDaemon(
               detached: true,
               stdio: ["ignore", "pipe", "pipe"],
               windowsHide: true,
-              env: daemonEnv,
+              env: daemonSpawnEnv,
             });
             pipeToLogFile(c, daemonLogFd, "daemon");
             c.unref();
@@ -1716,8 +1741,17 @@ export async function startLocalDaemon(
           console.log(
             "   Bundled assistant not healthy after 60s, falling back to source assistant...",
           );
-          // Kill the bundled daemon to avoid two processes competing for the same port
-          await stopProcessByPidFile(pidFile, "bundled daemon");
+          // Kill the bundled daemon to avoid two processes competing for the
+          // same port. It gets the full stop budget like any other daemon:
+          // failing the health probe does not mean it has nothing to flush, and
+          // a daemon still working through a long DB migration is exactly the
+          // one whose WAL checkpoint must not be interrupted.
+          await stopProcessByPidFile(
+            pidFile,
+            "bundled daemon",
+            undefined,
+            DAEMON_STOP_TIMEOUT_MS,
+          );
           daemonSpawn = watch
             ? await startDaemonWatchFromSource(
                 assistantIndex,
@@ -1876,7 +1910,7 @@ export async function startGateway(
       detached: true,
       stdio: ["ignore", "pipe", "pipe"],
       windowsHide: true,
-      env: gatewayEnv,
+      env: envWithCompiledRuntimeNodePath(gatewayEnv),
     });
     pipeToLogFile(gateway, gatewayLogFd, "gateway");
   } else {
@@ -1932,12 +1966,8 @@ export async function startGateway(
 /** Check whether a PID belongs to an ngrok process via its command line. */
 function isNgrokProcess(pid: number): boolean {
   try {
-    const output = execFileSync("ps", ["-p", String(pid), "-o", "command="], {
-      encoding: "utf-8",
-      timeout: 3000,
-      stdio: ["ignore", "pipe", "ignore"],
-    }).trim();
-    return /ngrok/.test(output);
+    const output = readProcessCommandLine(pid);
+    return /ngrok/i.test(output);
   } catch {
     return false;
   }
@@ -1958,7 +1988,12 @@ export async function stopLocalProcesses(
     ? join(resources.instanceDir, ".vellum")
     : join(homedir(), ".vellum");
   const daemonPidFile = getDaemonPidPath(resources);
-  await stopProcessByPidFile(daemonPidFile, "daemon");
+  await stopProcessByPidFile(
+    daemonPidFile,
+    "daemon",
+    undefined,
+    DAEMON_STOP_TIMEOUT_MS,
+  );
 
   const gatewayPidFile = join(vellumDir, "gateway.pid");
   await stopProcessByPidFile(gatewayPidFile, "gateway", undefined, 7000);