@vellumai/cli 0.11.7 → 0.11.8-staging.1

package/src/__tests__/sleep.test.ts

@@ -26,6 +26,7 @@ const isProcessAliveMock = mock((): { alive: boolean; pid: number | null } => ({
 const realProcess = { ...(await import("../lib/process.js")) };
 
 mock.module("../lib/process.js", () => ({
+  ...realProcess,
   isProcessAlive: isProcessAliveMock,
   stopProcessByPidFile: stopProcessByPidFileMock,
 }));
@@ -222,14 +223,15 @@ describe("sleep command", () => {
     }
 
     expect(stopProcessByPidFileMock).toHaveBeenCalledTimes(3);
-    // The assistant stop passes a generous 120s grace so the daemon's WAL
-    // checkpoint completes before any SIGKILL (default 2s would truncate it).
+    // The assistant stop passes the daemon's own shutdown budget plus a margin,
+    // so its WAL checkpoint completes before any SIGKILL (the default 2s grace
+    // would truncate it).
     expect(stopProcessByPidFileMock).toHaveBeenNthCalledWith(
       1,
       join(assistantRootDir, "workspace", "vellum.pid"),
       "assistant",
       undefined,
-      120_000,
+      45_000,
     );
     expect(stopProcessByPidFileMock).toHaveBeenNthCalledWith(
       2,

package/src/__tests__/teleport.test.ts

@@ -325,6 +325,7 @@ mock.module("../lib/docker.js", () => ({
 const stopProcessByPidFileMock = mock(async () => true);
 
 mock.module("../lib/process.js", () => ({
+  ...realProcess,
   stopProcessByPidFile: stopProcessByPidFileMock,
 }));
 

package/src/__tests__/upgrade-local.test.ts

@@ -33,6 +33,8 @@ const realUpgradeLifecycle = { ...upgradeLifecycle };
 
 const findAssistantByNameMock =
   mock<typeof assistantConfig.findAssistantByName>();
+const lookupAssistantByIdentifierMock =
+  mock<typeof assistantConfig.lookupAssistantByIdentifier>();
 const getActiveAssistantMock = mock<typeof assistantConfig.getActiveAssistant>(
   () => "local-assistant",
 );
@@ -46,6 +48,7 @@ const saveAssistantEntryMock = mock<typeof assistantConfig.saveAssistantEntry>(
 mock.module("../lib/assistant-config", () => ({
   ...realAssistantConfig,
   findAssistantByName: findAssistantByNameMock,
+  lookupAssistantByIdentifier: lookupAssistantByIdentifierMock,
   getActiveAssistant: getActiveAssistantMock,
   loadAllAssistants: loadAllAssistantsMock,
   saveAssistantEntry: saveAssistantEntryMock,
@@ -228,6 +231,8 @@ beforeEach(() => {
   const entry = makeLocalEntry();
   findAssistantByNameMock.mockReset();
   findAssistantByNameMock.mockReturnValue(entry);
+  lookupAssistantByIdentifierMock.mockReset();
+  lookupAssistantByIdentifierMock.mockReturnValue({ status: "found", entry });
   getActiveAssistantMock.mockReset();
   getActiveAssistantMock.mockReturnValue("local-assistant");
   loadAllAssistantsMock.mockReset();
@@ -446,3 +451,114 @@ describe("vellum upgrade local", () => {
     expect(consoleLogSpy.mock.calls.flat().join("\n")).toContain("Already on");
   });
 });
+
+// `cli/AGENTS.md` § "Assistant targeting convention": exact assistant ID
+// matches win over display-name matches; a unique display-name match
+// resolves to its assistant; an ambiguous display name is an error listing
+// the matching IDs. That precedence lives in, and is tested directly against,
+// `lookupAssistantByIdentifier` (see assistant-config.test.ts). These tests
+// only check `vellum upgrade`'s wiring: each one stubs the exact result
+// (found/ambiguous) the shared helper would return for a given argument, and
+// asserts the command acts on it correctly, without reimplementing the
+// lookup rules themselves.
+describe("vellum upgrade assistant targeting", () => {
+  function makeQuillEntry(
+    overrides: Partial<AssistantEntry> = {},
+  ): AssistantEntry {
+    return {
+      ...makeLocalEntry(),
+      assistantId: "quill-uuid",
+      name: "Quill",
+      ...overrides,
+    };
+  }
+
+  function argvFor(...positional: string[]): string[] {
+    return [
+      "bun",
+      "vellum",
+      "upgrade",
+      ...positional,
+      "--version",
+      cliPkg.version ? `v${cliPkg.version}` : "v0.8.12",
+    ];
+  }
+
+  test("resolves a unique display-name match to its assistant", async () => {
+    const quill = makeQuillEntry();
+    process.argv = argvFor("Quill");
+    lookupAssistantByIdentifierMock.mockReturnValue({
+      status: "found",
+      entry: quill,
+    });
+
+    await upgrade();
+
+    expect(lookupAssistantByIdentifierMock).toHaveBeenCalledWith("Quill");
+    expect(exitSpy).not.toHaveBeenCalled();
+    expect(stopLocalProcessesMock).toHaveBeenCalledWith(
+      expect.objectContaining({ instanceDir: quill.resources!.instanceDir }),
+    );
+  });
+
+  test("resolves a multi-word display-name argument, unsplit by --version", async () => {
+    const multiWord = makeQuillEntry({ name: "My Assistant" });
+    process.argv = argvFor("My", "Assistant");
+    lookupAssistantByIdentifierMock.mockReturnValue({
+      status: "found",
+      entry: multiWord,
+    });
+
+    await upgrade();
+
+    expect(lookupAssistantByIdentifierMock).toHaveBeenCalledWith(
+      "My Assistant",
+    );
+    expect(exitSpy).not.toHaveBeenCalled();
+    expect(stopLocalProcessesMock).toHaveBeenCalledWith(
+      expect.objectContaining({
+        instanceDir: multiWord.resources!.instanceDir,
+      }),
+    );
+  });
+
+  test("an exact assistant-ID argument resolves via the shared helper's found result", async () => {
+    // `lookupAssistantByIdentifier` owns ID-wins-over-name precedence
+    // (covered in assistant-config.test.ts); this only checks that
+    // `vellum upgrade` passes the raw argument through unmodified and acts
+    // on whatever entry the shared helper resolves.
+    const target = makeQuillEntry({ assistantId: "quill-uuid" });
+    process.argv = argvFor("quill-uuid");
+    lookupAssistantByIdentifierMock.mockReturnValue({
+      status: "found",
+      entry: target,
+    });
+
+    await upgrade();
+
+    expect(lookupAssistantByIdentifierMock).toHaveBeenCalledWith("quill-uuid");
+    expect(exitSpy).not.toHaveBeenCalled();
+    expect(stopLocalProcessesMock).toHaveBeenCalledWith(
+      expect.objectContaining({ instanceDir: target.resources!.instanceDir }),
+    );
+  });
+
+  test("an ambiguous display name fails and lists the matching IDs", async () => {
+    process.argv = argvFor("Quill");
+    lookupAssistantByIdentifierMock.mockReturnValue({
+      status: "ambiguous",
+      matches: [
+        makeQuillEntry({ assistantId: "quill-uuid-1" }),
+        makeQuillEntry({ assistantId: "quill-uuid-2" }),
+      ],
+    });
+
+    await expect(upgrade()).rejects.toThrow("process.exit(1)");
+
+    expect(stopLocalProcessesMock).not.toHaveBeenCalled();
+    const errText = consoleErrorSpy.mock.calls.flat().join("\n");
+    expect(errText).toContain("Multiple assistants match 'Quill'");
+    expect(errText).toContain("quill-uuid-1");
+    expect(errText).toContain("quill-uuid-2");
+  });
+});

package/src/__tests__/windows-lifecycle.test.ts

@@ -119,10 +119,10 @@ test("reports a failed forced Windows process-tree termination", async () => {
 });
 
 test("treats a Unix exit before SIGKILL as a successful stop", async () => {
-  const signals: Array<NodeJS.Signals | number | undefined> = [];
+  const calls: Array<[number, NodeJS.Signals | number | undefined]> = [];
   const originalKill = process.kill.bind(process);
-  process.kill = ((_pid: number, signal?: NodeJS.Signals | number) => {
-    signals.push(signal);
+  process.kill = ((pid: number, signal?: NodeJS.Signals | number) => {
+    calls.push([pid, signal]);
     if (signal === "SIGKILL") {
       throw Object.assign(new Error("no such process"), { code: "ESRCH" });
     }
@@ -130,8 +130,80 @@ test("treats a Unix exit before SIGKILL as a successful stop", async () => {
   }) as typeof process.kill;
 
   try {
-    expect(await stopProcess(4812, "test process", 0, "darwin")).toBeTrue();
-    expect(signals).toEqual([0, "SIGTERM", 0, "SIGKILL"]);
+    expect(
+      await stopProcess(
+        4812,
+        "test process",
+        0,
+        "darwin",
+        undefined,
+        () => "bun run /app/daemon/main.ts",
+      ),
+    ).toBeTrue();
+    // Escalation targets the process group first (the negative PID), so a
+    // daemon's workers die with it, then falls back to the single PID for
+    // processes that lead no group. ESRCH on both means it exited on its
+    // own, which is a successful stop.
+    expect(calls).toEqual([
+      [4812, 0],
+      [4812, "SIGTERM"],
+      [4812, 0],
+      [-4812, "SIGKILL"],
+      [4812, "SIGKILL"],
+    ]);
+  } finally {
+    process.kill = originalKill;
+  }
+});
+
+// Widening a signal to a process group requires proving the PID still names
+// the same process after the grace wait. A PID recycled mid-wait must never
+// receive a group-wide SIGKILL, only the single-PID kill this has always sent.
+test("a PID recycled during the wait never gets a group kill", async () => {
+  const calls: Array<[number, NodeJS.Signals | number | undefined]> = [];
+  const originalKill = process.kill.bind(process);
+  process.kill = ((pid: number, signal?: NodeJS.Signals | number) => {
+    calls.push([pid, signal]);
+    return true;
+  }) as typeof process.kill;
+
+  let read = 0;
+  const identities = [
+    "bun run /app/daemon/main.ts",
+    "/usr/bin/postgres -D /data",
+  ];
+
+  try {
+    await stopProcess(
+      4812,
+      "test process",
+      0,
+      "darwin",
+      undefined,
+      () => identities[Math.min(read++, identities.length - 1)] ?? null,
+    );
+    expect(calls).not.toContainEqual([-4812, "SIGKILL"]);
+    expect(calls).toContainEqual([4812, "SIGKILL"]);
+  } finally {
+    process.kill = originalKill;
+  }
+});
+
+test("an unreadable identity after the wait never gets a group kill", async () => {
+  const calls: Array<[number, NodeJS.Signals | number | undefined]> = [];
+  const originalKill = process.kill.bind(process);
+  process.kill = ((pid: number, signal?: NodeJS.Signals | number) => {
+    calls.push([pid, signal]);
+    return true;
+  }) as typeof process.kill;
+
+  let read = 0;
+  try {
+    await stopProcess(4812, "test process", 0, "darwin", undefined, () =>
+      read++ === 0 ? "bun run /app/daemon/main.ts" : null,
+    );
+    expect(calls).not.toContainEqual([-4812, "SIGKILL"]);
+    expect(calls).toContainEqual([4812, "SIGKILL"]);
   } finally {
     process.kill = originalKill;
   }

package/src/adapters/openclaw-http-server.ts

@@ -51,11 +51,13 @@ const server = http.createServer(async (req, res) => {
         encoding: "utf-8",
         timeout: 120000,
         env: npmEnv,
+        windowsHide: true,
       });
       const child = spawn("vellum-openclaw-adapter", [], {
         detached: true,
         stdio: "ignore",
         env: npmEnv,
+        windowsHide: true,
       });
       child.unref();
       const responseBody = JSON.stringify({
@@ -91,6 +93,7 @@ const server = http.createServer(async (req, res) => {
         encoding: "utf-8",
         timeout: 10000,
         env: execEnv,
+        windowsHide: true,
       });
       const health = JSON.parse(output.trim()) as Record<string, unknown>;
       const result: Record<string, unknown> = {
@@ -108,6 +111,7 @@ const server = http.createServer(async (req, res) => {
             encoding: "utf-8",
             timeout: 10000,
             env: execEnv,
+            windowsHide: true,
           });
           result.message = `${result.message}\n\nGateway Status:\n${gatewayOutput.trim()}`;
         } catch (gatewayErr) {
@@ -138,6 +142,7 @@ const server = http.createServer(async (req, res) => {
             encoding: "utf-8",
             timeout: 10000,
             env: execEnv,
+            windowsHide: true,
           });
           result.message = `${result.message}\n\nGateway Status:\n${gatewayOutput.trim()}`;
         } catch (gatewayErr) {

package/src/commands/client.ts

@@ -408,6 +408,20 @@ async function maybeHydratePlatformAssistantName(
 
 const SPA_BASE = "/assistant/";
 
+/**
+ * Cache policy for hashed build output under `dist/assets/`: the content hash
+ * is part of the filename, so a new build emits new names and a stored copy can
+ * never be stale.
+ */
+const IMMUTABLE_CACHE_CONTROL = "public, max-age=31536000, immutable";
+
+/**
+ * Cache policy for everything whose name is stable across builds: the HTML
+ * shell and unhashed `public/` files. Storing is allowed, serving without
+ * revalidating is not, so an assistant update is never masked by a cached copy.
+ */
+const REVALIDATE_CACHE_CONTROL = "no-cache";
+
 /**
  * Locate the clients/web source directory for running the Vite dev server.
  * Only works from a source checkout (not npm-installed).
@@ -1303,6 +1317,17 @@ async function runWebInterface(
     `<script>window.__VELLUM_CONFIG__=${configJson}${flagOverridesSnippet}</script></head>`,
   );
 
+  // The shell names this build's hashed chunks and carries the host's injected
+  // config snippet, so every route that falls back to it serves the same body
+  // under the same revalidating policy.
+  const spaShellResponse = () =>
+    new Response(indexHtml, {
+      headers: {
+        "Content-Type": "text/html; charset=utf-8",
+        "Cache-Control": REVALIDATE_CACHE_CONTROL,
+      },
+    });
+
   const fetchHandler: WebFetchHandler = async (req, server) => {
     const url = new URL(req.url);
     const { pathname } = url;
@@ -1399,19 +1424,21 @@ async function runWebInterface(
         const filePath = path.join(distDir, relPath);
         const file = Bun.file(filePath);
         if (await file.exists()) {
-          return new Response(file);
+          return new Response(file, {
+            headers: {
+              "Cache-Control": relPath.startsWith("assets/")
+                ? IMMUTABLE_CACHE_CONTROL
+                : REVALIDATE_CACHE_CONTROL,
+            },
+          });
         }
       }
-      return new Response(indexHtml, {
-        headers: { "Content-Type": "text/html; charset=utf-8" },
-      });
+      return spaShellResponse();
     }
 
     // SPA fallback for /account/* routes (login, callback, etc.)
     if (pathname.startsWith("/account/")) {
-      return new Response(indexHtml, {
-        headers: { "Content-Type": "text/html; charset=utf-8" },
-      });
+      return spaShellResponse();
     }
 
     return new Response("Not Found", { status: 404 });
@@ -1479,6 +1506,7 @@ async function runViteDevServer(
   const child = spawn("bun", ["run", "dev"], {
     cwd: webSourceDir,
     stdio: "inherit",
+    windowsHide: true,
     env: {
       ...process.env,
       ...flagEnvVars,

package/src/commands/exec.ts

@@ -156,7 +156,10 @@ export async function exec(): Promise<void> {
   const cloud = entry.cloud;
 
   if (cloud === "local") {
-    const child = spawn(command[0], command.slice(1), { stdio: "inherit" });
+    const child = spawn(command[0], command.slice(1), {
+      stdio: "inherit",
+      windowsHide: true,
+    });
     await new Promise<void>((resolve) => {
       child.on("close", (code) => {
         process.exitCode = code ?? 0;
@@ -187,7 +190,10 @@ export async function exec(): Promise<void> {
       ? ["exec", "-it", container, ...command]
       : ["exec", container, ...command];
 
-    const child = spawn("docker", dockerArgs, { stdio: "inherit" });
+    const child = spawn("docker", dockerArgs, {
+      stdio: "inherit",
+      windowsHide: true,
+    });
     await new Promise<void>((resolve, reject) => {
       child.on("close", (code) => {
         if (code === 0) resolve();

package/src/commands/logs.ts

@@ -329,7 +329,10 @@ async function showDockerLogs(
     // Single container — stream directly to stdout/stderr
     const target = targets[0];
     const args = buildDockerArgs(target.containerName);
-    const child = spawn("docker", args, { stdio: "inherit" });
+    const child = spawn("docker", args, {
+      stdio: "inherit",
+      windowsHide: true,
+    });
 
     await new Promise<void>((resolve, reject) => {
       child.on("close", (code) => {
@@ -356,6 +359,7 @@ async function showDockerLogs(
       const args = buildDockerArgs(target.containerName);
       const child = spawn("docker", args, {
         stdio: ["ignore", "pipe", "pipe"],
+        windowsHide: true,
       });
 
       const prefix = `[${target.name}] `;
@@ -466,7 +470,10 @@ async function showGcpLogs(
 
   if (opts.follow) {
     // For follow mode, stream output directly to terminal
-    const child = spawn("gcloud", args, { stdio: "inherit" });
+    const child = spawn("gcloud", args, {
+      stdio: "inherit",
+      windowsHide: true,
+    });
     await new Promise<void>((resolve, reject) => {
       child.on("close", (code) => {
         if (code !== 0 && code !== null) {
@@ -503,6 +510,7 @@ async function showCustomLogs(
   if (opts.follow) {
     const child = spawn("ssh", [...SSH_OPTS, sshTarget, remoteCmd], {
       stdio: "inherit",
+      windowsHide: true,
     });
     await new Promise<void>((resolve, reject) => {
       child.on("close", (code) => {
@@ -544,6 +552,7 @@ async function showAwsLogs(
   if (opts.follow) {
     const child = spawn("ssh", [...SSH_OPTS, sshTarget, remoteCmd], {
       stdio: "inherit",
+      windowsHide: true,
     });
     await new Promise<void>((resolve, reject) => {
       child.on("close", (code) => {

package/src/commands/sleep.ts

@@ -17,7 +17,11 @@ import {
   stopContainerTunnelEdge,
   stopIngressNginx,
 } from "../lib/nginx-ingress.js";
-import { isProcessAlive, stopProcessByPidFile } from "../lib/process";
+import {
+  DAEMON_STOP_TIMEOUT_MS,
+  isProcessAlive,
+  stopProcessByPidFile,
+} from "../lib/process";
 import { resolveFreshBearerToken } from "./client.js";
 
 const ACTIVE_CALL_LEASES_FILE = "active-call-leases.json";
@@ -208,18 +212,11 @@ export async function sleep(): Promise<void> {
     }
   }
 
-  // Stop assistant — use a generous timeout. On SIGTERM the daemon runs a
-  // WAL checkpoint before exiting, which can take several seconds on a
-  // multi-GB database. The default 2s grace in stopProcess() would SIGKILL a
-  // healthy daemon mid-checkpoint, forcing a costly multi-minute WAL recovery
-  // on the next start. The timeout is only a SIGKILL ceiling — stopProcess
-  // returns as soon as the process exits, so this adds no delay in the common
-  // case and only applies when the daemon is genuinely wedged.
   const assistantStopped = await stopProcessByPidFile(
     assistantPidFile,
     "assistant",
     undefined,
-    120_000,
+    DAEMON_STOP_TIMEOUT_MS,
   );
   if (!assistantStopped) {
     console.log("Assistant is not running.");

package/src/commands/ssh.ts

@@ -73,7 +73,7 @@ export async function ssh(): Promise<void> {
     child = spawn(
       "docker",
       ["exec", "-it", res.assistantContainer, "/bin/sh"],
-      { stdio: "inherit" },
+      { stdio: "inherit", windowsHide: true },
     );
   } else if (cloud === "gcp") {
     const project = entry.project;
@@ -94,7 +94,7 @@ export async function ssh(): Promise<void> {
     child = spawn(
       "gcloud",
       ["compute", "ssh", sshTarget, `--project=${project}`, `--zone=${zone}`],
-      { stdio: "inherit" },
+      { stdio: "inherit", windowsHide: true },
     );
   } else if (cloud === "vellum") {
     const token = readPlatformToken();
@@ -117,7 +117,10 @@ export async function ssh(): Promise<void> {
 
     console.log(`🔗 Connecting to ${entry.assistantId} via ssh...\n`);
 
-    child = spawn("ssh", [...SSH_OPTS, sshTarget], { stdio: "inherit" });
+    child = spawn("ssh", [...SSH_OPTS, sshTarget], {
+      stdio: "inherit",
+      windowsHide: true,
+    });
   } else {
     console.error(`Error: Unknown cloud type '${cloud}'.`);
     process.exit(1);

package/src/commands/teleport.ts

@@ -47,7 +47,10 @@ import {
 import { hatchLocal } from "../lib/hatch-local.js";
 import { retireLocal } from "../lib/retire-local.js";
 import { validateAssistantName } from "../lib/retire-archive.js";
-import { stopProcessByPidFile } from "../lib/process.js";
+import {
+  DAEMON_STOP_TIMEOUT_MS,
+  stopProcessByPidFile,
+} from "../lib/process.js";
 import {
   fetchAssistantIngressUrl,
   fetchCurrentVersion,
@@ -1497,6 +1500,8 @@ export async function teleport(): Promise<void> {
       await stopProcessByPidFile(
         getDaemonPidPath(fromEntry.resources),
         "assistant",
+        undefined,
+        DAEMON_STOP_TIMEOUT_MS,
       );
       await stopProcessByPidFile(gatewayPidFile, "gateway", undefined, 7000);
     }

package/src/commands/upgrade.ts

@@ -6,8 +6,10 @@ import cliPkg from "../../package.json";
 
 import {
   findAssistantByName,
+  formatAssistantLookupError,
   getActiveAssistant,
   loadAllAssistants,
+  lookupAssistantByIdentifier,
   saveAssistantEntry,
   type AssistantEntry,
 } from "../lib/assistant-config";
@@ -42,6 +44,7 @@ import {
   restoreBackup,
 } from "../lib/backup-ops.js";
 import { emitCliError, categorizeUpgradeError } from "../lib/cli-error.js";
+import { parseAssistantTargetArg } from "../lib/assistant-target-args.js";
 import { exec } from "../lib/step-runner.js";
 import {
   broadcastUpgradeEvent,
@@ -89,9 +92,14 @@ interface UpgradeArgs {
   force: boolean;
 }
 
+// Flags that consume the following argv token as a value, rather than a
+// boolean switch. Passed to `parseAssistantTargetArg` so an unquoted
+// multi-word display name is not truncated at a flag's value.
+const UPGRADE_FLAGS_WITH_VALUES = ["--version"];
+
 function parseArgs(): UpgradeArgs {
   const args = process.argv.slice(3);
-  let name: string | null = null;
+  const name = parseAssistantTargetArg(args, UPGRADE_FLAGS_WITH_VALUES) ?? null;
   let version: string | null = null;
   let latest = false;
   let prepare = false;
@@ -166,7 +174,8 @@ function parseArgs(): UpgradeArgs {
     } else if (arg === "--force") {
       force = true;
     } else if (!arg.startsWith("-")) {
-      name = arg;
+      // Positional token, part of a possibly multi-word display name.
+      // Collected up front via `parseAssistantTargetArg` above.
     } else {
       console.error(`Error: Unknown option '${arg}'.`);
       emitCliError("UNKNOWN", `Unknown option '${arg}'`);
@@ -202,22 +211,22 @@ function parseArgs(): UpgradeArgs {
 
 /**
  * Resolve which assistant to target for the upgrade command. Priority:
- * 1. Explicit name argument
+ * 1. Explicit name argument (exact assistant ID wins over a display-name
+ *    match; a unique display-name match resolves; an ambiguous display
+ *    name is an error listing the matching IDs)
  * 2. Active assistant set via `vellum use`
  * 3. Sole assistant (when exactly one exists)
  */
 function resolveTargetAssistant(nameArg: string | null): AssistantEntry {
   if (nameArg) {
-    const entry = findAssistantByName(nameArg);
-    if (!entry) {
-      console.error(`No assistant found with name '${nameArg}'.`);
-      emitCliError(
-        "ASSISTANT_NOT_FOUND",
-        `No assistant found with name '${nameArg}'.`,
-      );
+    const result = lookupAssistantByIdentifier(nameArg);
+    if (result.status !== "found") {
+      const msg = formatAssistantLookupError(nameArg, result);
+      console.error(msg);
+      emitCliError("ASSISTANT_NOT_FOUND", msg);
       process.exit(1);
     }
-    return entry;
+    return result.entry;
   }
 
   const active = getActiveAssistant();
@@ -1518,7 +1527,7 @@ async function resolveLatestAndMaybeSelfUpdate(
     const installResult = spawnSync(
       "bun",
       ["install", "-g", `vellum@${stripVersionPrefix(latestTag)}`],
-      { stdio: "inherit" },
+      { stdio: "inherit", windowsHide: true },
     );
     if (installResult.error || installResult.status !== 0) {
       const detail =
@@ -1542,6 +1551,7 @@ async function resolveLatestAndMaybeSelfUpdate(
     console.log(`🚀 Re-running upgrade with updated CLI...\n`);
     const reexecResult = spawnSync("vellum", reexecArgs, {
       stdio: "inherit",
+      windowsHide: true,
     });
     process.exit(reexecResult.status ?? 1);
   }