@vellumai/cli 0.11.7-staging.2 → 0.11.8-staging.1

package/src/lib/nginx-ingress.ts

@@ -180,7 +180,7 @@ function remoteWebIngressConfig(
  * fingerprint matches, so this must change whenever the generated index or
  * nginx template does.
  */
-const EDGE_TEMPLATE_VERSION = 5;
+export const EDGE_TEMPLATE_VERSION = 7;
 
 /**
  * Stable fingerprint of the SPA config injected into the served index and
@@ -201,19 +201,56 @@ function safeScriptJson(value: unknown): string {
 }
 
 /**
- * Preloading the whole chunk graph opens ~290 tunnel connections on a cold
- * load, and one dropped request blanks the app before React can report it.
- * These are hints only; the entry module still pulls what it needs.
+ * How many modulepreload hints the served index may carry before they are
+ * stripped wholesale.
+ *
+ * The consolidated boot graph emits 4 hints (the entry chunk's static
+ * imports). Serving them lets a phone fetch the whole boot set in parallel;
+ * without them the browser cannot discover the other chunks until the entry
+ * has downloaded AND parsed, so ~515 kB gzip serializes behind ~623 kB plus
+ * a phone-CPU parse of ~2.2 MB of JavaScript.
+ *
+ * The strip exists for the pathological shape: a whole-chunk-graph index
+ * (~290 hints) floods the tunnel with requests, and one dropped *import*
+ * blanks the app before React can report it. A build that regresses toward
+ * that shape trips this threshold and gets the protective strip.
+ * All-or-nothing, because preserving an arbitrary prefix of a broken graph
+ * would be luck, not policy. 12 sits comfortably above the consolidated
+ * graph and within two rounds of the browser's six-per-origin HTTP/1.1
+ * connection pool, so kept hints never widen concurrency much beyond what
+ * the entry's own imports would open.
+ */
+export const MAX_PRESERVED_MODULE_PRELOADS = 12;
+
+const MODULE_PRELOAD_RE = /<link[^>]+rel="modulepreload"[^>]*>\s*/g;
+
+/**
+ * Failure semantics are engine-dependent while whatwg/html#10327 rolls out:
+ * older engines cache a failed module fetch in the module map (a later
+ * import returns the failure without refetching), newer ones evict it so a
+ * later import refetches. The invariant that matters holds in both models:
+ * the preserved hints name exactly the URLs the entry's static imports
+ * fetch anyway, through the same module map, so a dropped request for a
+ * BOOT chunk has the same outcome whether or not the chunk was hinted.
+ * Hints for the boot set add no failure surface; they only start the same
+ * fetches earlier. What the strip guards against is the whole-graph shape,
+ * where hundreds of speculative NON-boot fetches amplify the odds of any
+ * failure and (on old-model engines) a dropped lazy chunk poisons a later
+ * dynamic import.
  */
-function stripModulePreloads(html: string): string {
-  return html.replace(/<link[^>]+rel="modulepreload"[^>]*>\s*/g, "");
+function stripExcessModulePreloads(html: string): string {
+  const count = html.match(MODULE_PRELOAD_RE)?.length ?? 0;
+  if (count <= MAX_PRESERVED_MODULE_PRELOADS) {
+    return html;
+  }
+  return html.replace(MODULE_PRELOAD_RE, "");
 }
 
 export function buildRemoteWebIndexHtml(
   rawHtml: string,
   config: Record<string, unknown>,
 ): string {
-  const html = stripModulePreloads(rawHtml);
+  const html = stripExcessModulePreloads(rawHtml);
   const script = `<script>window.__VELLUM_CONFIG__=${safeScriptJson(config)}</script>`;
   if (html.includes("</head>")) {
     return html.replace("</head>", `${script}</head>`);
@@ -274,6 +311,19 @@ http {
   access_log off;
   default_type application/octet-stream;
 
+  # Compression tuning only. It stays inert here because nginx ships with
+  # gzip off, and only the static SPA locations below turn it on: this server
+  # also proxies authenticated /v1 and /webhooks traffic, and compressing a
+  # response that carries both a secret and attacker-influenced content over
+  # TLS is the BREACH side channel. The SPA bytes are the whole win, so the
+  # boundary is drawn by opting locations in rather than by excluding proxies.
+  # text/html is always compressed once gzip is on, so it must not be
+  # repeated in gzip_types.
+  gzip_vary on;
+  gzip_comp_level 5;
+  gzip_min_length 1024;
+  gzip_types application/javascript application/json application/wasm image/svg+xml text/css text/plain;
+
   types {
     application/javascript js mjs;
     application/json json map;
@@ -369,10 +419,16 @@ ${proxyBlock}
       rewrite ^ /assistant/__remote-index.html last;
     }
 
+    # The shell and the unhashed files beside it revalidate rather than
+    # refusing storage: they carry no credential, and nginx serves them from
+    # disk with a validator, so a repeat load costs a 304 instead of the whole
+    # document. __config is the exception below: it is returned inline, so
+    # nginx attaches no validator for a revalidation to match against.
     location = /assistant/__remote-index.html {
       internal;
+      gzip on;
       alias ${nginxQuoted(indexHtmlPath, "remote web ingress index path")};
-      add_header Cache-Control "no-store";
+      add_header Cache-Control "no-cache";
     }
 
     location = /assistant/__config {
@@ -382,15 +438,17 @@ ${proxyBlock}
     }
 
     location ^~ /assistant/assets/ {
+      gzip on;
       alias ${nginxQuoted(nginxDirPath(webAssetsDir), "web assets path")};
       try_files $uri =404;
       add_header Cache-Control "public, max-age=31536000, immutable";
     }
 
     location ^~ /assistant/ {
+      gzip on;
       alias ${nginxQuoted(webDistDir, "web dist path")};
       try_files $uri $uri/ /assistant/__remote-index.html;
-      add_header Cache-Control "no-store";
+      add_header Cache-Control "no-cache";
     }
 
     location = / {
@@ -415,6 +473,7 @@ export function getNginxVersion(): string | null {
   const result = spawnSync(nginxBin(), ["-v"], {
     encoding: "utf-8",
     timeout: 5_000,
+    windowsHide: true,
   });
   if (result.error || result.status !== 0) return null;
   const output = `${result.stderr || ""}${result.stdout || ""}`.trim();
@@ -464,6 +523,7 @@ function isIngressNginxProcess(pid: number, paths: IngressPaths): boolean {
         encoding: "utf-8",
         timeout: 3000,
         stdio: ["ignore", "pipe", "ignore"],
+        windowsHide: true,
       },
     ).trim();
     return (
@@ -604,7 +664,7 @@ export function startIngressNginx(opts: {
   const child = spawn(
     nginxBin(),
     ["-p", paths.dir, "-c", paths.confPath, "-g", "daemon off;"],
-    { detached: true, stdio: ["ignore", fd, fd] },
+    { detached: true, stdio: ["ignore", fd, fd], windowsHide: true },
   );
   closeSync(fd);
 

package/src/lib/ngrok.ts

@@ -36,6 +36,7 @@ export function getNgrokVersion(): string | null {
       encoding: "utf-8",
       timeout: 5_000,
       stdio: ["ignore", "pipe", "ignore"],
+      windowsHide: true,
     });
     return output.trim();
   } catch {
@@ -152,6 +153,7 @@ export function startNgrokProcess(
   const child = spawn("ngrok", args, {
     detached: true,
     stdio,
+    windowsHide: true,
   });
 
   // The child process inherits a duplicate of the fd via dup2, so the

package/src/lib/open-browser.ts

@@ -12,7 +12,11 @@ export function openBrowser(url: string): void {
     platform === "win32"
       ? ["/c", "start", '""', url.replace(/&/g, "^&")]
       : [url];
-  const child = spawn(cmd, args, { stdio: "ignore", detached: true });
+  const child = spawn(cmd, args, {
+    stdio: "ignore",
+    detached: true,
+    windowsHide: true,
+  });
   child.on("error", () => {
     // Silently ignore — the user can still copy the URL from the console.
   });

package/src/lib/process.ts

@@ -76,13 +76,22 @@ export function windowsCommandLineLookupArgs(pid: number): string[] {
   ];
 }
 
-function readWindowsCommandLine(pid: number): string {
-  return execFileSync("powershell.exe", windowsCommandLineLookupArgs(pid), {
+/** Read a process command line using the platform's process inspection tool. */
+export function readProcessCommandLine(
+  pid: number,
+  hostPlatform: NodeJS.Platform = platform(),
+): string {
+  const command = hostPlatform === "win32" ? "powershell.exe" : "ps";
+  const args =
+    hostPlatform === "win32"
+      ? windowsCommandLineLookupArgs(pid)
+      : ["-p", String(pid), "-o", "command="];
+  return execFileSync(command, args, {
     windowsHide: true,
     encoding: "utf8",
     timeout: 3000,
     stdio: ["ignore", "pipe", "ignore"],
-  });
+  }).trim();
 }
 
 export function isVellumWindowsProcess(
@@ -102,6 +111,21 @@ export function isVellumWindowsProcess(
   return /^bun\.exe$/i.test(imageName) && isVellumCommandLine(commandLine);
 }
 
+/**
+ * The POSIX command line for `pid`, or null when it cannot be read.
+ *
+ * Used to prove a PID still names the same process across an awaited gap. The
+ * Windows path never needs it: `taskkill /T` already terminates the tree, so
+ * no group escalation happens there.
+ */
+export function readPosixCommandLine(pid: number): string | null {
+  try {
+    return readProcessCommandLine(pid, platform());
+  } catch {
+    return null;
+  }
+}
+
 export function isVellumProcess(
   pid: number,
   hostPlatform: NodeJS.Platform = platform(),
@@ -110,15 +134,11 @@ export function isVellumProcess(
     if (hostPlatform === "win32") {
       const imageName = readWindowsProcesses(pid)[0]?.imageName ?? "";
       const commandLine = /^(?:bun|qdrant)\.exe$/i.test(imageName)
-        ? readWindowsCommandLine(pid)
+        ? readProcessCommandLine(pid, hostPlatform)
         : "";
       return isVellumWindowsProcess(imageName, commandLine);
     }
-    const output = execFileSync("ps", ["-p", String(pid), "-o", "command="], {
-      encoding: "utf-8",
-      timeout: 3000,
-      stdio: ["ignore", "pipe", "ignore"],
-    }).trim();
+    const output = readProcessCommandLine(pid, hostPlatform);
     return isVellumCommandLine(output);
   } catch {
     return false;
@@ -277,6 +297,15 @@ export async function resolveProcessState(
   return { status: "healthy", pid: result.pid };
 }
 
+/**
+ * SIGKILL ceiling for stopping the assistant daemon.
+ *
+ * Defined in `@vellumai/local-mode` because the host wrappers that spawn these
+ * commands derive their own timeouts from it: a wrapper that expires first
+ * kills the CLI before this ceiling is ever reached.
+ */
+export { DAEMON_STOP_TIMEOUT_MS } from "@vellumai/local-mode";
+
 /**
  * Stop a process by PID: SIGTERM, wait up to `timeoutMs`, then SIGKILL if still alive.
  * Returns true if the process was stopped, false if it wasn't alive or
@@ -294,6 +323,7 @@ export async function stopProcess(
       stdio: "ignore",
     });
   },
+  readIdentity: (pid: number) => string | null = readPosixCommandLine,
 ): Promise<boolean> {
   try {
     process.kill(pid, 0);
@@ -301,6 +331,11 @@ export async function stopProcess(
     return false;
   }
 
+  // Snapshot who this PID is before any waiting, so the group escalation below
+  // can prove it is still the same process rather than a recycled PID.
+  const identityBeforeWait =
+    hostPlatform === "win32" ? null : readIdentity(pid);
+
   console.log(`Stopping ${label} (pid ${pid})...`);
   let waitForGracefulExit = true;
   if (hostPlatform === "win32") {
@@ -343,6 +378,32 @@ export async function stopProcess(
     }
   }
   console.log(`${label} did not exit after SIGTERM, sending SIGKILL...`);
+  // Kill the process group, not just the process. Daemons are spawned
+  // `detached: true` (a session and group leader), and their worker
+  // subprocesses inherit that group, so a single-PID SIGKILL here is what
+  // orphans workers onto init running a stale runtime. Group-kill takes the
+  // whole tree at once, which is what the Windows branch above already does
+  // via `taskkill /T`. Tool subprocesses run in their own groups (see
+  // assistant orphan-reaper), so they are unaffected. SIGTERM above stays
+  // single-PID on purpose: graceful shutdown is the daemon's to orchestrate,
+  // and a group-wide SIGTERM would kill the route host mid-HTTP-drain.
+  //
+  // Widening a signal to a whole group demands more than liveness: the target
+  // may have exited during the wait and the OS may have handed its PID to an
+  // unrelated group leader. Escalate only while the command line still matches
+  // the one captured before the wait; otherwise fall through to the
+  // single-PID kill this function has always sent.
+  const identityHolds =
+    identityBeforeWait != null && readIdentity(pid) === identityBeforeWait;
+  if (identityHolds) {
+    try {
+      process.kill(-pid, "SIGKILL");
+      return true;
+    } catch {
+      // `pid` does not lead a group (or the group is already gone). Fall back
+      // to the single-PID kill.
+    }
+  }
   try {
     process.kill(pid, "SIGKILL");
     return true;
@@ -428,7 +489,7 @@ export async function stopOrphanedDaemonProcesses(
               (/^vellum-daemon\.exe$/i.test(imageName) ||
                 (/^bun\.exe$/i.test(imageName) &&
                   /vellum-daemon|[\\/]assistant[\\/]src[\\/](?:index|daemon[\\/]main)\.ts/i.test(
-                    readWindowsCommandLine(pid),
+                    readProcessCommandLine(pid, hostPlatform),
                   ))),
           )
           .map(({ pid }) =>
@@ -446,6 +507,7 @@ export async function stopOrphanedDaemonProcesses(
       encoding: "utf-8",
       timeout: 5000,
       stdio: ["ignore", "pipe", "ignore"],
+      windowsHide: true,
     });
   } catch {
     return false;

package/src/lib/provider-secrets.ts

@@ -243,6 +243,11 @@ export function inferProviderFromModel(model: string): string | undefined {
   if (model.startsWith("poolside/")) {
     return "poolside";
   }
+  if (model === "qwen/qwen3-8b") {
+    // The only qwen/* ID the Vellum hosted provider carries; the rest are
+    // OpenRouter's.
+    return "vellum";
+  }
   if (model.includes("/")) {
     return "openrouter";
   }

package/src/lib/retire-local.ts

@@ -12,6 +12,7 @@ import type { AssistantEntry } from "./assistant-config.js";
 import { stopIngressNginx } from "./nginx-ingress.js";
 import { getKnownPidsFromAssistants } from "./orphan-detection.js";
 import {
+  DAEMON_STOP_TIMEOUT_MS,
   stopOrphanedDaemonProcesses,
   stopProcessByPidFile,
 } from "./process.js";
@@ -119,7 +120,12 @@ export async function retireLocal(
   }
 
   const daemonPidFile = getDaemonPidPath(resources);
-  const daemonStopped = await stopProcessByPidFile(daemonPidFile, "daemon");
+  const daemonStopped = await stopProcessByPidFile(
+    daemonPidFile,
+    "daemon",
+    undefined,
+    DAEMON_STOP_TIMEOUT_MS,
+  );
 
   // Stop gateway via PID file — use a longer timeout because the gateway has a
   // drain window (5s) before it exits.
@@ -137,10 +143,10 @@ export async function retireLocal(
     reporter.log("credential-executor stopped.");
   }
 
-  // Stop Qdrant — the daemon's graceful shutdown tries to stop it via
-  // qdrantManager.stop(), but if the daemon was SIGKILL'd (after 2s timeout)
-  // Qdrant may still be running as an orphan. Check both the current PID file
-  // location and the legacy location.
+  // Stop Qdrant. The daemon's graceful shutdown tries to stop it via
+  // qdrantManager.stop(), but a daemon that never completes that shutdown
+  // (crash, OOM kill, or the SIGKILL ceiling above) leaves Qdrant running as
+  // an orphan. Check both the current PID file location and the legacy one.
   const qdrantPidFile = join(
     vellumDir,
     "workspace",
@@ -211,6 +217,7 @@ export async function retireLocal(
   const child = spawn(archiveCommand.command, archiveCommand.args, {
     stdio: "ignore",
     detached: true,
+    windowsHide: true,
     ...(archiveCommand.env
       ? { env: { ...process.env, ...archiveCommand.env } }
       : {}),

package/src/lib/step-runner.ts

@@ -42,6 +42,7 @@ export function exec(
     const child = spawn(command, args, {
       cwd: options.cwd,
       stdio: ["pipe", "pipe", "pipe"],
+      windowsHide: true,
     });
 
     let stdout = "";
@@ -82,6 +83,7 @@ export function execWithStdin(
     const child = spawn(command, args, {
       cwd: options.cwd,
       stdio: ["pipe", "pipe", "pipe"],
+      windowsHide: true,
     });
 
     let stdout = "";
@@ -116,6 +118,7 @@ export function execOutput(
     const child = spawn(command, args, {
       cwd: options.cwd,
       stdio: ["pipe", "pipe", "pipe"],
+      windowsHide: true,
     });
 
     let settled = false;

package/src/lib/tailscale-tunnel.ts

@@ -88,6 +88,7 @@ function realFindBinary(): string | null {
       encoding: "utf-8",
       timeout: 5_000,
       stdio: ["ignore", "pipe", "ignore"],
+      windowsHide: true,
     });
     if (!res.error && res.status === 0) {
       return candidate;
@@ -97,7 +98,11 @@ function realFindBinary(): string | null {
 }
 
 function realRun(bin: string, args: string[]): TailscaleCommandResult {
-  const res = spawnSync(bin, args, { encoding: "utf-8", timeout: 15_000 });
+  const res = spawnSync(bin, args, {
+    encoding: "utf-8",
+    timeout: 15_000,
+    windowsHide: true,
+  });
   if (res.error) {
     throw res.error;
   }

package/src/lib/upgrade-lifecycle.ts

@@ -74,6 +74,7 @@ export async function captureUpgradeFailureLogs(
           {
             encoding: "utf8",
             maxBuffer: 10 * 1024 * 1024, // 10 MB
+            windowsHide: true,
           },
         );
         const output = [result.stdout, result.stderr].filter(Boolean).join("");