@vellumai/cli 0.11.8-staging.2 → 0.11.9-staging.1

package/src/commands/hatch.ts

@@ -1,9 +1,6 @@
-import { randomBytes } from "crypto";
-
 // Direct import — bun embeds this at compile time so it works in compiled binaries.
 import cliPkg from "../../package.json";
 
-import { buildOpenclawStartupScript } from "../adapters/openclaw";
 import {
   saveAssistantEntry,
   setActiveAssistant,
@@ -14,10 +11,8 @@ import {
   VALID_SPECIES,
 } from "../lib/constants";
 import type { RemoteHost, Species } from "../lib/constants";
-import { buildNestedConfig } from "../lib/config-utils";
 import { hatchDocker } from "../lib/docker";
 import { parseFeatureFlagArgs, readAmbientFlagEnvVars } from "../lib/flag-args";
-import type { PollResult, WatchHatchingResult } from "../lib/gcp";
 import { hatchLocal } from "../lib/hatch-local";
 import {
   getPlatformUrl,
@@ -26,149 +21,9 @@ import {
 } from "../lib/platform-client";
 import { validateAssistantName } from "../lib/retire-archive";
 
-export type { PollResult, WatchHatchingResult } from "../lib/gcp";
-
-const INSTALL_SCRIPT_REMOTE_PATH = "/tmp/vellum-install.sh";
-
-const HATCH_TIMEOUT_MS: Record<Species, number> = {
-  vellum: 5 * 60 * 1000,
-  openclaw: 10 * 60 * 1000,
-};
 const DEFAULT_SPECIES: Species = "vellum";
 
-const SPINNER_FRAMES = ["⠋", "⠙", "⠹", "⠸", "⠼", "⠴", "⠦", "⠧", "⠇", "⠏"];
-
-const IS_DESKTOP = !!process.env.VELLUM_DESKTOP_APP;
-
-function desktopLog(msg: string): void {
-  process.stdout.write(msg + "\n");
-}
-
-function buildTimestampRedirect(logPath: string): string {
-  return `exec > >(while IFS= read -r line; do printf '[%s] %s\\n' "$(date -u '+%Y-%m-%dT%H:%M:%SZ')" "$line"; done > ${logPath}) 2>&1`;
-}
-
-function buildUserSetup(sshUser: string): string {
-  return `
-SSH_USER="${sshUser}"
-if ! id "$SSH_USER" &>/dev/null; then
-  useradd -m -s /bin/bash "$SSH_USER"
-fi
-SSH_USER_HOME=$(eval echo "~$SSH_USER")
-mkdir -p "$SSH_USER_HOME"
-export HOME="$SSH_USER_HOME"
-`;
-}
-
-function buildOwnershipFixup(): string {
-  return `
-chown -R "$SSH_USER:$SSH_USER" "$SSH_USER_HOME" 2>/dev/null || true
-`;
-}
-
-export async function buildStartupScript(
-  species: Species,
-  sshUser: string,
-  providerApiKeys: Record<string, string>,
-  instanceName: string,
-  cloud: RemoteHost,
-  configValues: Record<string, string> = {},
-): Promise<{ script: string; laptopBootstrapSecret: string }> {
-  const platformUrl = getPlatformUrl();
-  const logPath =
-    cloud === "custom"
-      ? "/tmp/vellum-startup.log"
-      : "/var/log/startup-script.log";
-  const errorPath =
-    cloud === "custom" ? "/tmp/vellum-startup-error" : "/var/log/startup-error";
-  const timestampRedirect = buildTimestampRedirect(logPath);
-  const userSetup = buildUserSetup(sshUser);
-  const ownershipFixup = buildOwnershipFixup();
-
-  if (species === "openclaw") {
-    const script = await buildOpenclawStartupScript(
-      sshUser,
-      providerApiKeys,
-      timestampRedirect,
-      userSetup,
-      ownershipFixup,
-    );
-    return { script, laptopBootstrapSecret: "" };
-  }
-
-  // Generate a bootstrap secret for the laptop that initiated this remote
-  // hatch. The startup script exports it as GUARDIAN_BOOTSTRAP_SECRET so
-  // that when `vellum hatch --remote docker` runs on the VM, the docker
-  // hatch detects the pre-set env var and appends its own secret.
-  const laptopBootstrapSecret = randomBytes(32).toString("hex");
-
-  // Build bash lines that set each provider API key as a shell variable
-  // and corresponding dotenv lines for the env file.
-  // Include the laptop bootstrap secret so that when the remote runs
-  // `vellum hatch --remote docker`, the docker hatch detects the pre-set
-  // env var and appends its own secret for multi-secret guardian init.
-  const allEnvEntries: Record<string, string> = {
-    ...providerApiKeys,
-    GUARDIAN_BOOTSTRAP_SECRET: laptopBootstrapSecret,
-  };
-  const envSetLines = Object.entries(allEnvEntries)
-    .map(([envVar, value]) => `${envVar}=${value}`)
-    .join("\n");
-  const dotenvLines = Object.keys(providerApiKeys)
-    .map((envVar) => `${envVar}=\$${envVar}`)
-    .join("\n");
-
-  // Write --config key=value pairs to a temp JSON file on the remote host
-  // and export the env var so the daemon reads it on first boot.
-  let configWriteBlock = "";
-  if (Object.keys(configValues).length > 0) {
-    const configJson = JSON.stringify(buildNestedConfig(configValues), null, 2);
-    configWriteBlock = `
-echo "Writing default workspace config..."
-VELLUM_DEFAULT_WORKSPACE_CONFIG_PATH="/tmp/vellum-initial-config-$$.json"
-cat > "\$VELLUM_DEFAULT_WORKSPACE_CONFIG_PATH" << 'VELLUM_CONFIG_EOF'
-${configJson}
-VELLUM_CONFIG_EOF
-export VELLUM_DEFAULT_WORKSPACE_CONFIG_PATH
-echo "Default workspace config written to \$VELLUM_DEFAULT_WORKSPACE_CONFIG_PATH"
-`;
-  }
-
-  return {
-    laptopBootstrapSecret,
-    script: `#!/bin/bash
-set -e
-
-${timestampRedirect}
-
-trap 'EXIT_CODE=\$?; if [ \$EXIT_CODE -ne 0 ]; then echo "Startup script failed with exit code \$EXIT_CODE at line \$LINENO" > ${errorPath}; echo "Last 20 log lines:" >> ${errorPath}; tail -20 ${logPath} >> ${errorPath} 2>/dev/null || true; fi' EXIT
-${userSetup}
-${envSetLines}
-VELLUM_ASSISTANT_NAME=${instanceName}
-mkdir -p "\$HOME/.config/vellum"
-cat > "\$HOME/.config/vellum/.env" << DOTENV_EOF
-${dotenvLines}
-RUNTIME_HTTP_PORT=7821
-DOTENV_EOF
-
-${ownershipFixup}
-${configWriteBlock}
-export GUARDIAN_BOOTSTRAP_SECRET
-export VELLUM_SSH_USER="\$SSH_USER"
-export VELLUM_ASSISTANT_NAME="\$VELLUM_ASSISTANT_NAME"
-export VELLUM_CLOUD="${cloud}"
-echo "Downloading install script from ${platformUrl}/install.sh..."
-curl -fsSL ${platformUrl}/install.sh -o ${INSTALL_SCRIPT_REMOTE_PATH}
-echo "Install script downloaded (\$(wc -c < ${INSTALL_SCRIPT_REMOTE_PATH}) bytes)"
-chmod +x ${INSTALL_SCRIPT_REMOTE_PATH}
-echo "Running install script..."
-source ${INSTALL_SCRIPT_REMOTE_PATH}
-`,
-  };
-}
-
 const DEFAULT_REMOTE: RemoteHost = "local";
-const UNSUPPORTED_REMOTE_HATCH_TARGETS = new Set<RemoteHost>(["aws", "gcp"]);
 
 interface HatchArgs {
   species: Species;
@@ -226,7 +81,7 @@ function parseArgs(): HatchArgs {
       console.log("  -d                        Run in detached mode");
       console.log("  --name <name>             Custom instance name");
       console.log(
-        "  --remote <host>           Remote host (local, gcp, aws, docker, custom, vellum)",
+        "  --remote <host>           Remote host (local, docker, custom, vellum)",
       );
       console.log(
         "  --watch                   Run assistant and gateway in watch mode (hot reload on source changes)",
@@ -379,217 +234,6 @@ function parseArgs(): HatchArgs {
   };
 }
 
-function formatElapsed(ms: number): string {
-  const secs = Math.floor(ms / 1000);
-  const m = Math.floor(secs / 60);
-  const s = secs % 60;
-  return m > 0 ? `${m}m ${s.toString().padStart(2, "0")}s` : `${s}s`;
-}
-
-function pickMessage(messages: string[], elapsedMs: number): string {
-  const idx = Math.floor(elapsedMs / 15000) % messages.length;
-  return messages[idx];
-}
-
-function getPhaseIcon(
-  hasLogs: boolean,
-  elapsedMs: number,
-  species: Species,
-): string {
-  if (!hasLogs) {
-    return elapsedMs < 30000 ? "🥚" : "🪺";
-  }
-  return elapsedMs < 120000 ? "🐣" : SPECIES_CONFIG[species].hatchedEmoji;
-}
-
-export async function watchHatching(
-  pollFn: () => Promise<PollResult>,
-  instanceName: string,
-  startTime: number,
-  species: Species,
-): Promise<WatchHatchingResult> {
-  if (IS_DESKTOP) {
-    return watchHatchingDesktop(pollFn, instanceName, startTime, species);
-  }
-
-  let spinnerIdx = 0;
-  let lastLogLine: string | null = null;
-  let linesDrawn = 0;
-  let finished = false;
-  let failed = false;
-  let lastErrorContent = "";
-  let pollInFlight = false;
-  let nextPollAt = Date.now() + 15000;
-
-  function draw(): void {
-    if (linesDrawn > 0) {
-      process.stdout.write(`\x1b[${linesDrawn}A`);
-    }
-
-    const elapsed = Date.now() - startTime;
-
-    const hasLogs = lastLogLine !== null;
-    const icon = finished
-      ? failed
-        ? "💀"
-        : SPECIES_CONFIG[species].hatchedEmoji
-      : getPhaseIcon(hasLogs, elapsed, species);
-    const spinner = finished
-      ? failed
-        ? "✘"
-        : "✔"
-      : SPINNER_FRAMES[spinnerIdx % SPINNER_FRAMES.length];
-    const config = SPECIES_CONFIG[species];
-    const message = finished
-      ? failed
-        ? "❌ Startup script failed"
-        : "✨ Your assistant has hatched!"
-      : hasLogs
-        ? lastLogLine!.length > 68
-          ? lastLogLine!.substring(0, 65) + "..."
-          : lastLogLine!
-        : pickMessage(config.waitingMessages, elapsed);
-    spinnerIdx++;
-
-    const lines = [
-      "",
-      `   ${icon} ${spinner}  ${message}  ⏱  ${formatElapsed(elapsed)}`,
-      "",
-    ];
-
-    for (const line of lines) {
-      process.stdout.write(`\x1b[K${line}\n`);
-    }
-    linesDrawn = lines.length;
-  }
-
-  async function poll(): Promise<void> {
-    if (pollInFlight || finished) return;
-    pollInFlight = true;
-    try {
-      const result = await pollFn();
-      if (result.lastLine) {
-        lastLogLine = result.lastLine;
-      }
-      if (result.errorContent) {
-        lastErrorContent = result.errorContent;
-      }
-      if (result.done) {
-        finished = true;
-        failed = result.failed;
-      }
-    } finally {
-      pollInFlight = false;
-      nextPollAt = Date.now() + 5000;
-    }
-  }
-
-  return new Promise<WatchHatchingResult>((resolve) => {
-    const interval = setInterval(() => {
-      if (finished) {
-        draw();
-        clearInterval(interval);
-        resolve({ success: !failed, errorContent: lastErrorContent });
-        return;
-      }
-
-      const elapsed = Date.now() - startTime;
-      if (elapsed >= HATCH_TIMEOUT_MS[species]) {
-        clearInterval(interval);
-        console.log("");
-        console.log(
-          `   ⏰ Timed out after ${formatElapsed(elapsed)}. Instance is still running.`,
-        );
-        console.log(`   Monitor with: vel logs ${instanceName}`);
-        console.log("");
-        resolve({ success: false, errorContent: lastErrorContent });
-        return;
-      }
-
-      if (Date.now() >= nextPollAt) {
-        poll();
-      }
-
-      draw();
-    }, 80);
-
-    process.on("SIGINT", () => {
-      clearInterval(interval);
-      console.log("");
-      console.log(`   ⚠️  Detaching. Instance is still running.`);
-      console.log(`   Monitor with: vel logs ${instanceName}`);
-      console.log("");
-      process.exit(0);
-    });
-  });
-}
-
-function watchHatchingDesktop(
-  pollFn: () => Promise<PollResult>,
-  instanceName: string,
-  startTime: number,
-  species: Species,
-): Promise<WatchHatchingResult> {
-  return new Promise<WatchHatchingResult>((resolve) => {
-    let prevLogLine: string | null = null;
-    let lastErrorContent = "";
-    let pollInFlight = false;
-    let nextPollAt = Date.now() + 15000;
-
-    desktopLog("Waiting for instance to start...");
-
-    const interval = setInterval(async () => {
-      const elapsed = Date.now() - startTime;
-
-      if (elapsed >= HATCH_TIMEOUT_MS[species]) {
-        clearInterval(interval);
-        desktopLog(
-          `Timed out after ${formatElapsed(elapsed)}. Instance is still running.`,
-        );
-        desktopLog(`Monitor with: vel logs ${instanceName}`);
-        resolve({ success: false, errorContent: lastErrorContent });
-        return;
-      }
-
-      if (Date.now() < nextPollAt || pollInFlight) return;
-
-      pollInFlight = true;
-      try {
-        const result = await pollFn();
-
-        if (result.lastLine && result.lastLine !== prevLogLine) {
-          prevLogLine = result.lastLine;
-          desktopLog(result.lastLine);
-        }
-
-        if (result.errorContent) {
-          lastErrorContent = result.errorContent;
-        }
-
-        if (result.done) {
-          clearInterval(interval);
-          if (result.failed) {
-            desktopLog("Startup script failed");
-          } else {
-            desktopLog("Your assistant has hatched!");
-          }
-          resolve({ success: !result.failed, errorContent: lastErrorContent });
-        }
-      } finally {
-        pollInFlight = false;
-        nextPollAt = Date.now() + 5000;
-      }
-    }, 5000);
-
-    process.on("SIGINT", () => {
-      clearInterval(interval);
-      desktopLog("Detaching. Instance is still running.");
-      desktopLog(`Monitor with: vel logs ${instanceName}`);
-      process.exit(0);
-    });
-  });
-}
-
 export { hatchLocal };
 
 function getCliVersion(): string {
@@ -656,16 +300,6 @@ export async function hatch(): Promise<void> {
     process.exit(1);
   }
 
-  if (UNSUPPORTED_REMOTE_HATCH_TARGETS.has(remote)) {
-    console.error(
-      `Error: \`vellum hatch --remote ${remote}\` is not a supported provisioning target yet.`,
-    );
-    console.error(
-      "No cloud resources were created. To self-host on AWS/GCP, SSH into the VM and run `vellum hatch` or `vellum hatch --remote docker` there.",
-    );
-    process.exit(1);
-  }
-
   if (remote === "local") {
     await hatchLocal(
       species,

package/src/commands/login.ts

@@ -10,6 +10,7 @@ import {
   saveAssistantEntry,
   setActiveAssistant,
 } from "../lib/assistant-config";
+import { resolveAssistantApiKeyForInjection } from "../lib/assistant-api-key-resolution";
 import { computeDeviceId } from "../lib/guardian-token";
 import { openBrowser } from "../lib/open-browser";
 import {
@@ -20,9 +21,7 @@ import {
   fetchPlatformAssistants,
   getPlatformUrl,
   injectCredentialsIntoAssistant,
-  readGatewayCredential,
   readPlatformToken,
-  reprovisionAssistantApiKey,
   savePlatformToken,
 } from "../lib/platform-client";
 import { syncCloudAssistants } from "../lib/sync-cloud-assistants";
@@ -405,33 +404,21 @@ export async function login(): Promise<void> {
           `Registered assistant: ${registration.assistant.name} (${registration.assistant.id})`,
         );
 
-        // Resolve the API key to inject, mirroring the macOS app's
-        // LocalAssistantBootstrapService 3-step flow:
-        // 1. Use fresh key from registration (first-time only)
-        // 2. Use existing key from the daemon's credential store
-        // 3. Reprovision (rotate) as a last resort — this revokes the
-        //    old key server-side, so we only do it when the gateway
-        //    confirms no key exists (not when it's merely unreachable).
-        let assistantApiKey = registration.assistant_api_key;
-        if (!assistantApiKey) {
-          const cached = await readGatewayCredential(
-            entry.runtimeUrl,
-            "vellum:assistant_api_key",
-            entry.bearerToken,
-          );
-          if (cached.value) {
-            assistantApiKey = cached.value;
-          } else if (!cached.unreachable) {
-            console.log("No API key available locally — reprovisioning...");
-            const reprovision = await reprovisionAssistantApiKey(
-              token,
-              orgId,
-              clientInstallationId,
-              entry.assistantId,
-              "cli",
-            );
-            assistantApiKey = reprovision.provisioning.assistant_api_key;
-          }
+        // Which key to hand the assistant, and why. Shared with teleport so
+        // the two injection paths cannot drift.
+        const resolved = await resolveAssistantApiKeyForInjection({
+          registrationApiKey: registration.assistant_api_key,
+          runtimeUrl: entry.runtimeUrl,
+          bearerToken: entry.bearerToken,
+          token,
+          organizationId: orgId,
+          clientInstallationId,
+          runtimeAssistantId: entry.assistantId,
+          clientPlatform: "cli",
+        });
+        const assistantApiKey = resolved.apiKey;
+        if (resolved.source === "reprovisioned") {
+          console.log("Provisioning a replacement API key...");
         }
 
         // Inject credentials into the running assistant via the gateway,

package/src/commands/teleport.ts

@@ -1,3 +1,4 @@
+import { resolveAssistantApiKeyForInjection } from "../lib/assistant-api-key-resolution";
 import {
   findAssistantByName,
   loadAllAssistants,
@@ -23,8 +24,6 @@ import {
   platformRequestSignedUrl,
   VersionMismatchError,
   ensureSelfHostedLocalRegistration,
-  readGatewayCredential,
-  reprovisionAssistantApiKey,
   injectCredentialsIntoAssistant,
   fetchCurrentUser,
   fetchOrganizationId,
@@ -1154,30 +1153,19 @@ async function tryInjectPlatformCredentials(
       platformOrganizationId: orgId,
     });
 
-    // Resolve the API key: 1) fresh from registration, 2) existing from
-    // daemon credential store, 3) reprovision as last resort (revokes old key).
-    // Only reprovision when the gateway confirms no key exists — not when
-    // the gateway is merely unreachable (would revoke without injecting).
-    let assistantApiKey = registration.assistant_api_key;
-    if (!assistantApiKey) {
-      const cached = await readGatewayCredential(
-        entry.runtimeUrl,
-        "vellum:assistant_api_key",
-        entry.bearerToken,
-      );
-      if (cached.value) {
-        assistantApiKey = cached.value;
-      } else if (!cached.unreachable) {
-        const reprovision = await reprovisionAssistantApiKey(
-          token,
-          orgId,
-          clientInstallationId,
-          entry.assistantId,
-          "cli",
-        );
-        assistantApiKey = reprovision.provisioning.assistant_api_key;
-      }
-    }
+    // Which key to hand the assistant, and why. Shared with login so the two
+    // injection paths cannot drift.
+    const resolvedKey = await resolveAssistantApiKeyForInjection({
+      registrationApiKey: registration.assistant_api_key,
+      runtimeUrl: entry.runtimeUrl,
+      bearerToken: entry.bearerToken,
+      token,
+      organizationId: orgId,
+      clientInstallationId,
+      runtimeAssistantId: entry.assistantId,
+      clientPlatform: "cli",
+    });
+    const assistantApiKey = resolvedKey.apiKey;
 
     const allInjected = await injectCredentialsIntoAssistant({
       gatewayUrl: entry.runtimeUrl,

package/src/lib/assistant-api-key-resolution.ts

@@ -0,0 +1,89 @@
+/**
+ * Resolve which assistant API key to inject into a running assistant.
+ *
+ * The one place that decides, for every flow that hands a local assistant its
+ * platform credentials (`login`, `teleport`). Keeping the decision here means a
+ * rule about which stored key is usable holds in all of them at once.
+ */
+import {
+  readGatewayCredential,
+  reprovisionAssistantApiKey,
+  verifyGatewayManagedCredential,
+} from "./platform-client.js";
+
+/** Where the key came from, so callers can report what they did. */
+export type AssistantApiKeySource =
+  | "registration"
+  | "stored"
+  | "reprovisioned"
+  | "unavailable";
+
+export interface ResolveAssistantApiKeyArgs {
+  /** Key the registration returned, set only when it had none before. */
+  registrationApiKey: string | null;
+  runtimeUrl: string;
+  bearerToken?: string;
+  token: string;
+  organizationId: string;
+  clientInstallationId: string;
+  runtimeAssistantId: string;
+  clientPlatform: string;
+}
+
+export interface ResolvedAssistantApiKey {
+  apiKey: string | null;
+  source: AssistantApiKeySource;
+}
+
+/**
+ * Three steps, in order: the key the registration just issued, the key the
+ * assistant already holds, then a rotation.
+ *
+ * A stored key the platform has rejected is skipped, because reinjecting it
+ * repairs nothing while looking like a repair. The verdict is asked for
+ * before the key is read, so the key returned is one the verdict covers: a
+ * repair that lands between the two requests is then read, not overwritten
+ * by the value it replaced. Rotation is still withheld when the gateway is
+ * merely unreachable: rotating without being able to store the replacement
+ * would start the platform's grace clock on a key the assistant still needs,
+ * with nothing to hand it in exchange.
+ */
+export async function resolveAssistantApiKeyForInjection(
+  args: ResolveAssistantApiKeyArgs,
+): Promise<ResolvedAssistantApiKey> {
+  if (args.registrationApiKey) {
+    return { apiKey: args.registrationApiKey, source: "registration" };
+  }
+
+  const status = await verifyGatewayManagedCredential(
+    args.runtimeUrl,
+    args.bearerToken,
+  );
+  // A settled rejection came from a gateway that answered, so the
+  // replacement can be stored; the rejected key is not worth reading.
+  if (status !== "rejected") {
+    const cached = await readGatewayCredential(
+      args.runtimeUrl,
+      "vellum:assistant_api_key",
+      args.bearerToken,
+    );
+    if (cached.value) {
+      return { apiKey: cached.value, source: "stored" };
+    }
+    if (cached.unreachable) {
+      return { apiKey: null, source: "unavailable" };
+    }
+  }
+
+  const reprovision = await reprovisionAssistantApiKey(
+    args.token,
+    args.organizationId,
+    args.clientInstallationId,
+    args.runtimeAssistantId,
+    args.clientPlatform,
+  );
+  return {
+    apiKey: reprovision.provisioning.assistant_api_key,
+    source: "reprovisioned",
+  };
+}