@vellumai/cli 0.11.8-staging.2 → 0.11.9-staging.1

package/src/lib/platform-client.ts

@@ -1,3 +1,7 @@
+import {
+  type PlatformCredentialVerificationStatus,
+  PlatformVerifyCredentialResponseSchema,
+} from "@vellumai/service-contracts/platform-credential";
 import {
   chmodSync,
   readFileSync,
@@ -289,7 +293,10 @@ export interface ReprovisionApiKeyResponse {
  * Reprovision (rotate) the API key for a self-hosted local assistant.
  *
  * Calls `POST /v1/assistants/self-hosted-local/reprovision-api-key/`.
- * Returns a fresh API key. The previous key is revoked server-side.
+ * Returns a fresh API key. The platform keeps the previous key valid for a
+ * grace period rather than revoking it on the spot, so a rotation whose
+ * replacement never gets stored leaves the assistant on a key that still
+ * works until that window closes.
  */
 export async function reprovisionAssistantApiKey(
   token: string,
@@ -349,6 +356,51 @@ export interface GatewayCredentialResult {
   unreachable: boolean;
 }
 
+/**
+ * Ask a running assistant to check its stored managed credential against the
+ * platform, via the gateway-proxied `POST /v1/platform/verify-credential`.
+ *
+ * Returns `"rejected"` only when the platform settled that answer. Every other
+ * case, including a daemon too old to serve the route and any failure to reach
+ * one, returns null: the answer decides whether a key is rotated, so an absent
+ * answer must never read as a rejection.
+ *
+ * Never throws.
+ */
+export async function verifyGatewayManagedCredential(
+  gatewayUrl: string,
+  bearerToken?: string,
+): Promise<PlatformCredentialVerificationStatus | null> {
+  try {
+    const headers: Record<string, string> = { Accept: "application/json" };
+    if (bearerToken) {
+      headers["Authorization"] = `Bearer ${bearerToken}`;
+    }
+
+    const response = await loopbackSafeFetch(
+      `${gatewayUrl}/v1/platform/verify-credential`,
+      {
+        method: "POST",
+        headers,
+        signal: AbortSignal.timeout(10_000),
+      },
+    );
+    if (!response.ok) {
+      return null;
+    }
+
+    const parsed = PlatformVerifyCredentialResponseSchema.safeParse(
+      await response.json(),
+    );
+    if (parsed.success) {
+      return parsed.data.status;
+    }
+    return null;
+  } catch {
+    return null;
+  }
+}
+
 /**
  * Read an existing credential from the assistant's secret store via the
  * gateway-proxied `POST /v1/secrets/read` endpoint (with `reveal: true`).
@@ -356,9 +408,10 @@ export interface GatewayCredentialResult {
  * Returns a result distinguishing "key not found" (`value: null,
  * unreachable: false`) from "gateway unreachable" (`value: null,
  * unreachable: true`). Callers should only reprovision when the gateway
- * is reachable but the key is genuinely missing — reprovisioning while
- * the gateway is down would revoke the old key server-side without being
- * able to inject the replacement.
+ * is reachable: the platform keeps the outgoing key valid for a grace
+ * period, so reprovisioning while the gateway is down does not break the
+ * assistant immediately, but it starts a clock on a key the caller cannot
+ * yet replace.
  *
  * Never throws.
  */
@@ -385,7 +438,7 @@ export async function readGatewayCredential(
 
     if (!response.ok) {
       // 5xx means the gateway/daemon backend is down — treat as unreachable
-      // so callers don't revoke a potentially valid key.
+      // so callers don't rotate away from a working key they cannot replace.
       return { value: null, unreachable: response.status >= 500 };
     }
 

package/src/__tests__/ssh-user-guard.test.ts

@@ -1,28 +0,0 @@
-import { describe, test, expect } from "bun:test";
-import { readFileSync } from "fs";
-import { join } from "path";
-
-// Regression guard for PR #25292: hatchAws/hatchGcp must abort before
-// launching a cloud instance when sshUser is empty. Otherwise `useradd ""`
-// in the generated startup script fails after billable resources are live.
-describe("sshUser empty-string guard", () => {
-  const files = [
-    join(import.meta.dir, "..", "lib", "aws.ts"),
-    join(import.meta.dir, "..", "lib", "gcp.ts"),
-  ];
-
-  for (const file of files) {
-    test(`${file.split("/").slice(-2).join("/")} aborts on empty sshUser`, () => {
-      const source = readFileSync(file, "utf8");
-      const fallbackIdx = source.indexOf('sshUser = process.env.USER ?? ""');
-      expect(fallbackIdx).toBeGreaterThan(-1);
-
-      const afterFallback = source.slice(fallbackIdx);
-      const guardIdx = afterFallback.search(/if\s*\(\s*!sshUser\s*\)/);
-      expect(guardIdx).toBeGreaterThan(-1);
-
-      const guardBlock = afterFallback.slice(guardIdx, guardIdx + 400);
-      expect(guardBlock).toContain("process.exit(1)");
-    });
-  }
-});

package/src/adapters/openclaw-http-server.ts

@@ -1,209 +0,0 @@
-import crypto from "node:crypto";
-import { execSync, spawn } from "node:child_process";
-import http from "node:http";
-
-const PORT = parseInt(process.env.PORT || "7830", 10);
-
-interface StoredMessage {
-  id: string;
-  role: "user" | "assistant";
-  content: string;
-  timestamp: string;
-}
-
-const messages: Record<string, StoredMessage[]> = {};
-
-function parseBody(
-  req: http.IncomingMessage,
-): Promise<Record<string, unknown>> {
-  return new Promise((resolve, reject) => {
-    let body = "";
-    req.on("data", (chunk: Buffer) => (body += chunk.toString()));
-    req.on("end", () => {
-      try {
-        resolve(JSON.parse(body));
-      } catch (e) {
-        reject(e);
-      }
-    });
-    req.on("error", reject);
-  });
-}
-
-function log(method: string, path: string, status: number): void {
-  const ts = new Date().toISOString();
-  console.log(`[${ts}] ${method} ${path} -> ${status}`);
-}
-
-const server = http.createServer(async (req, res) => {
-  const url = new URL(req.url ?? "/", `http://localhost:${PORT}`);
-  const method = req.method ?? "UNKNOWN";
-
-  res.setHeader("Content-Type", "application/json");
-
-  if (req.method === "POST" && url.pathname === "/upgrade") {
-    try {
-      const npmEnv = {
-        ...process.env,
-        PATH: `${process.env.HOME || "/root"}/.npm-global/bin:${process.env.HOME || "/root"}/.local/bin:/usr/local/bin:${process.env.PATH}`,
-      };
-      execSync("npm install -g @vellum/openclaw-adapter@latest", {
-        encoding: "utf-8",
-        timeout: 120000,
-        env: npmEnv,
-        windowsHide: true,
-      });
-      const child = spawn("vellum-openclaw-adapter", [], {
-        detached: true,
-        stdio: "ignore",
-        env: npmEnv,
-        windowsHide: true,
-      });
-      child.unref();
-      const responseBody = JSON.stringify({
-        status: "success",
-        message:
-          "HTTPS adapter installed and started. HTTP adapter shutting down.",
-      });
-      res.writeHead(200);
-      res.end(responseBody, () => {
-        log(method, url.pathname, 200);
-        server.close(() => process.exit(0));
-      });
-    } catch (e) {
-      const responseBody = JSON.stringify({
-        status: "error",
-        message: e instanceof Error ? e.message : String(e),
-      });
-      res.writeHead(500);
-      res.end(responseBody);
-      log(method, url.pathname, 500);
-    }
-    return;
-  }
-
-  if (req.method === "GET" && url.pathname === "/healthz") {
-    const execEnv = {
-      ...process.env,
-      PATH: `${process.env.HOME || "/root"}/.npm-global/bin:${process.env.HOME || "/root"}/.local/bin:/usr/local/bin:${process.env.PATH}`,
-    };
-    let responseBody: string;
-    try {
-      const output = execSync("openclaw health --json", {
-        encoding: "utf-8",
-        timeout: 10000,
-        env: execEnv,
-        windowsHide: true,
-      });
-      const health = JSON.parse(output.trim()) as Record<string, unknown>;
-      const result: Record<string, unknown> = {
-        status: health.status ?? "healthy",
-        message: health.message,
-      };
-
-      const healthStr = JSON.stringify(health);
-      if (
-        healthStr.includes("1006") ||
-        healthStr.includes("abnormal closure")
-      ) {
-        try {
-          const gatewayOutput = execSync("openclaw gateway status", {
-            encoding: "utf-8",
-            timeout: 10000,
-            env: execEnv,
-            windowsHide: true,
-          });
-          result.message = `${result.message}\n\nGateway Status:\n${gatewayOutput.trim()}`;
-        } catch (gatewayErr) {
-          const gatewayErrMsg =
-            gatewayErr instanceof Error
-              ? gatewayErr.message
-              : String(gatewayErr);
-          result.message = `${result.message}\n\nGateway Status Error:\n${gatewayErrMsg}`;
-        }
-      }
-
-      responseBody = JSON.stringify(result);
-      res.writeHead(200);
-      res.end(responseBody);
-    } catch (e) {
-      const errorMessage = e instanceof Error ? e.message : String(e);
-      const result: Record<string, unknown> = {
-        status: "unhealthy",
-        message: errorMessage,
-      };
-
-      if (
-        errorMessage.includes("1006") ||
-        errorMessage.includes("abnormal closure")
-      ) {
-        try {
-          const gatewayOutput = execSync("openclaw gateway status", {
-            encoding: "utf-8",
-            timeout: 10000,
-            env: execEnv,
-            windowsHide: true,
-          });
-          result.message = `${result.message}\n\nGateway Status:\n${gatewayOutput.trim()}`;
-        } catch (gatewayErr) {
-          const gatewayErrMsg =
-            gatewayErr instanceof Error
-              ? gatewayErr.message
-              : String(gatewayErr);
-          result.message = `${result.message}\n\nGateway Status Error:\n${gatewayErrMsg}`;
-        }
-      }
-
-      responseBody = JSON.stringify(result);
-      res.writeHead(200);
-      res.end(responseBody);
-    }
-    log(method, url.pathname, 200);
-    return;
-  }
-
-  const messagesMatch = url.pathname.match(
-    /^\/v1\/assistants\/([^/]+)\/messages$/,
-  );
-  if (messagesMatch) {
-    const assistantId = messagesMatch[1];
-
-    if (req.method === "GET") {
-      const key = url.searchParams.get("conversationKey") ?? assistantId;
-      const msgs = messages[key] ?? [];
-      res.writeHead(200);
-      res.end(JSON.stringify({ messages: msgs }));
-      return;
-    }
-
-    if (req.method === "POST") {
-      try {
-        const parsed = await parseBody(req);
-        const key = (parsed.conversationKey as string) || assistantId;
-        if (!messages[key]) messages[key] = [];
-        const messageId = crypto.randomUUID();
-        messages[key].push({
-          id: messageId,
-          role: "user",
-          content: parsed.content as string,
-          timestamp: new Date().toISOString(),
-        });
-        res.writeHead(200);
-        res.end(JSON.stringify({ accepted: true, messageId }));
-      } catch {
-        res.writeHead(400);
-        res.end(JSON.stringify({ error: "Invalid request body" }));
-      }
-      return;
-    }
-  }
-
-  const notFoundBody = JSON.stringify({ error: "Not found" });
-  res.writeHead(404);
-  res.end(notFoundBody);
-  log(method, url.pathname, 404);
-});
-
-server.listen(PORT, "0.0.0.0", () => {
-  console.log(`OpenClaw runtime server listening on port ${PORT}`);
-});

package/src/adapters/openclaw.ts

@@ -1,131 +0,0 @@
-import { GATEWAY_PORT } from "../lib/constants";
-import { buildOpenclawRuntimeServer } from "../lib/openclaw-runtime-server";
-
-export async function buildOpenclawStartupScript(
-  sshUser: string,
-  providerApiKeys: Record<string, string>,
-  timestampRedirect: string,
-  userSetup: string,
-  ownershipFixup: string,
-): Promise<string> {
-  const runtimeServer = await buildOpenclawRuntimeServer();
-
-  return `#!/bin/bash
-set -e
-
-${timestampRedirect}
-
-trap 'EXIT_CODE=\$?; if [ \$EXIT_CODE -ne 0 ]; then echo "Startup script failed with exit code \$EXIT_CODE" > /var/log/startup-error; fi' EXIT
-${userSetup}
-
-export OPENCLAW_NPM_LOGLEVEL=verbose
-export OPENCLAW_NO_ONBOARD=1
-export OPENCLAW_NO_PROMPT=1
-
-echo "=== Pre-install diagnostics ==="
-echo "Date: $(date -u)"
-echo "Disk:" && df -h / 2>&1 || true
-echo "Memory:" && free -m 2>&1 || true
-echo "DNS:" && nslookup registry.npmjs.org 2>&1 || true
-echo "Registry ping:" && curl -sSf --max-time 10 https://registry.npmjs.org/-/ping 2>&1 || echo "WARN: npm registry unreachable"
-echo "=== End pre-install diagnostics ==="
-
-echo "=== Installing build dependencies ==="
-apt-get update -y
-apt-get install -y build-essential python3 python3-pip git
-pip3 install cmake
-echo "cmake version: $(cmake --version | head -1)"
-echo "=== Build dependencies installed ==="
-
-curl -fsSL https://openclaw.ai/install.sh -o /tmp/openclaw-install.sh
-chmod +x /tmp/openclaw-install.sh
-
-set +e
-bash /tmp/openclaw-install.sh
-INSTALL_EXIT_CODE=\$?
-set -e
-
-if [ \$INSTALL_EXIT_CODE -ne 0 ]; then
-  echo "=== OpenClaw install failed (exit code: \$INSTALL_EXIT_CODE) ==="
-  echo "=== npm debug logs ==="
-  find \$HOME/.npm/_logs -name '*.log' -type f 2>/dev/null | sort | while read -r logfile; do
-    echo "--- \$logfile ---"
-    tail -n 200 "\$logfile" 2>/dev/null || true
-  done
-  echo "=== Post-failure diagnostics ==="
-  echo "Disk:" && df -h / 2>&1 || true
-  echo "Memory:" && free -m 2>&1 || true
-  echo "node version:" && node --version 2>&1 || echo "node not found"
-  echo "npm version:" && npm --version 2>&1 || echo "npm not found"
-  echo "npm config:" && npm config list 2>&1 || true
-  echo "cmake version:" && cmake --version 2>&1 || echo "cmake not found"
-  echo "PATH: \$PATH"
-  echo "=== End diagnostics ==="
-  exit \$INSTALL_EXIT_CODE
-fi
-
-export PATH="\$HOME/.npm-global/bin:\$HOME/.local/bin:/usr/local/bin:\$PATH"
-
-if ! command -v openclaw >/dev/null 2>&1; then
-  echo "ERROR: openclaw CLI installation failed. The 'openclaw' command is not available."
-  echo "PATH: \$PATH"
-  echo "which openclaw:" && which openclaw 2>&1 || true
-  echo "npm global bin:" && npm bin -g 2>&1 || true
-  echo "npm global list:" && npm list -g --depth=0 2>&1 || true
-  exit 1
-fi
-
-export XDG_RUNTIME_DIR="/run/user/\$(id -u)"
-export DBUS_SESSION_BUS_ADDRESS="unix:path=\$XDG_RUNTIME_DIR/bus"
-mkdir -p "\$XDG_RUNTIME_DIR"
-loginctl enable-linger root 2>/dev/null || true
-systemctl --user daemon-reexec 2>/dev/null || true
-
-if ! command -v bun >/dev/null 2>&1; then
-  echo "=== Installing bun ==="
-  if ! command -v unzip >/dev/null 2>&1; then
-    echo "Installing unzip (required by bun)..."
-    apt-get install -y unzip
-  fi
-  # Pinned. Keep in sync with .tool-versions.
-  curl -fsSL https://bun.sh/install | bash -s "bun-v1.3.11"
-  export BUN_INSTALL="\$HOME/.bun"
-  export PATH="\$BUN_INSTALL/bin:\$PATH"
-  echo "bun version: $(bun --version)"
-  echo "=== Bun installed ==="
-else
-  echo "bun already installed: $(bun --version)"
-fi
-
-set +e
-openclaw gateway install
-GATEWAY_INSTALL_EXIT=\$?
-set -e
-
-if [ \$GATEWAY_INSTALL_EXIT -ne 0 ]; then
-  echo "WARN: openclaw gateway install exited with \$GATEWAY_INSTALL_EXIT (expected systemd mismatch), continuing with user-level systemd setup"
-fi
-
-OPENCLAW_GW_TOKEN=$(openssl rand -hex 32)
-echo -n "\$OPENCLAW_GW_TOKEN" > /tmp/openclaw-gateway-token
-chmod 600 /tmp/openclaw-gateway-token
-
-mkdir -p /root/.openclaw
-${Object.entries(providerApiKeys)
-  .map(([envVar, value]) => `openclaw config set env.${envVar} "${value}"`)
-  .join("\n")}
-openclaw config set agents.defaults.model.primary "anthropic/claude-opus-4-6"
-openclaw config set gateway.auth.token "\$OPENCLAW_GW_TOKEN"
-
-echo "=== Starting openclaw gateway at user level ==="
-systemctl --user daemon-reload
-systemctl --user enable --now openclaw-gateway.service
-
-export PORT=${GATEWAY_PORT}
-
-echo "=== Starting OpenClaw runtime server ==="
-${runtimeServer}
-echo "=== OpenClaw runtime server started ==="
-${ownershipFixup}
-`;
-}

package/src/lib/openclaw-runtime-server.ts

@@ -1,28 +0,0 @@
-// Read source file using Bun.file() with string concatenation (not join())
-// so Bun's bundler can statically analyze the path and embed the file
-// in the compiled binary ($bunfs). The file must also be passed via --embed
-// in the bun build --compile invocation.
-
-export async function buildOpenclawRuntimeServer(): Promise<string> {
-  try {
-    const serverSource = await Bun.file(
-      import.meta.dir + "/../adapters/openclaw-http-server.ts",
-    ).text();
-
-    return `
-cat > /opt/openclaw-runtime-server.ts << 'RUNTIME_SERVER_EOF'
-${serverSource}
-RUNTIME_SERVER_EOF
-
-mkdir -p "\$HOME/.vellum"
-nohup bun run /opt/openclaw-runtime-server.ts >> "\$HOME/.vellum/http-gateway.log" 2>&1 &
-echo "OpenClaw runtime server started (PID: \$!)"
-`;
-  } catch (err) {
-    console.warn(
-      "⚠️  Could not embed openclaw runtime server (expected in compiled binary without --embed):",
-      (err as Error).message,
-    );
-    return "# openclaw-runtime-server: skipped (source files not available in compiled binary)";
-  }
-}