@vellumai/cli 0.12.1-dev.202609161913.e2258d9 → 0.12.1-dev.202609162016.c36c1d1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vellumai/cli",
-  "version": "0.12.1-dev.202609161913.e2258d9",
+  "version": "0.12.1-dev.202609162016.c36c1d1",
   "description": "CLI tools for vellum-assistant",
   "type": "module",
   "exports": {

package/src/lib/__tests__/docker.test.ts

@@ -83,6 +83,7 @@ describe("buildServiceRunArgs — assistant", () => {
     const args = buildAssistantArgs();
     expect(args).toContain("IS_CONTAINERIZED=true");
     expect(args).toContain("VELLUM_WORKSPACE_DIR=/workspace");
+    expect(args).toContain("CES_BOOTSTRAP_SOCKET_DIR=/run/ces-bootstrap");
     expect(args).toContain(`VELLUM_ASSISTANT_NAME=${instanceName}`);
   });
 

package/src/lib/__tests__/local-ces.test.ts

@@ -9,6 +9,8 @@ import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { afterAll, beforeAll, describe, expect, mock, test } from "bun:test";
 
+import { resolveIpcEndpoint } from "@vellumai/ipc-server-utils";
+
 import { resolveCesSocketPath, startCes } from "../local.js";
 
 // ---------------------------------------------------------------------------
@@ -106,7 +108,7 @@ describe("startCes", () => {
     // startCes unlinks the stale socket, then polls for it. We create it with
     // a slight delay so the poll catches it.
     setTimeout(() => {
-      const socketDir = join(vellumDir, "workspace");
+      const socketDir = join(vellumDir, "protected", "credential-executor");
       mkdirSync(socketDir, { recursive: true });
       writeFileSync(join(socketDir, "ces.sock"), "");
     }, 50);
@@ -126,7 +128,9 @@ describe("startCes", () => {
 
     // Verify env vars
     const env = lastSpawnCall!.options.env!;
-    expect(env["CES_LOCAL_SOCKET"]).toBeDefined();
+    expect(env["CES_BOOTSTRAP_SOCKET_DIR"]).toBe(
+      join(tempDir, ".vellum", "protected", "credential-executor"),
+    );
     expect(env["CREDENTIAL_SECURITY_DIR"]).toBeDefined();
     expect(env["VELLUM_WORKSPACE_DIR"]).toBeDefined();
 
@@ -143,4 +147,23 @@ describe("startCes", () => {
     expect(socketPath.startsWith("\\\\.\\pipe\\vellum-ces-")).toBe(true);
     expect(socketPath).not.toContain("Example");
   });
+
+  test("POSIX local CES seam matches resolveIpcEndpoint", () => {
+    const resources = {
+      instanceDir: "/tmp/assistant-123",
+    } as Parameters<typeof resolveCesSocketPath>[0];
+
+    const socketPath = resolveCesSocketPath(resources, "linux");
+    expect(socketPath).toBe(
+      resolveIpcEndpoint("ces", {
+        workspaceDir: join(
+          "/tmp/assistant-123",
+          ".vellum",
+          "protected",
+          "credential-executor",
+        ),
+        platform: "linux",
+      }).path,
+    );
+  });
 });

package/src/lib/local.ts

@@ -606,6 +606,24 @@ type DaemonStartOptions = {
   signingKey?: string;
 };
 
+/**
+ * Directory that holds the local CES Unix socket (`ces.sock`).
+ *
+ * Matches CES's local data root: `{CREDENTIAL_SECURITY_DIR}/credential-executor`.
+ * Local CLI and managed sidecars share `CES_BOOTSTRAP_SOCKET_DIR`; this is the
+ * writable per-instance directory used outside containers.
+ */
+function resolveCesBootstrapSocketDir(
+  resources?: LocalInstanceResources,
+  env?: Record<string, string | undefined>,
+): string {
+  const securityDir = resources
+    ? join(resources.instanceDir, ".vellum", "protected")
+    : env?.CREDENTIAL_SECURITY_DIR?.trim() ||
+      join(homedir(), ".vellum", "protected");
+  return join(securityDir, "credential-executor");
+}
+
 /**
  * Apply per-instance resource overrides and shared daemon options to an
  * environment object. Called from all daemon spawn paths (source, watch,
@@ -644,11 +662,10 @@ function applyDaemonEnvOverrides(
     env.VELLUM_DEFAULT_WORKSPACE_CONFIG_PATH =
       options.defaultWorkspaceConfigPath;
   }
-  // Pin the daemon to the exact socket the sibling binds so the two agree
-  // regardless of any stale CES_LOCAL_SOCKET inherited from the parent
-  // environment. The assistant connects to the sibling instead of spawning
-  // its own CES.
-  env.CES_LOCAL_SOCKET = resolveCesSocketPath(resources);
+  // CES and the assistant resolve the socket from CES_BOOTSTRAP_SOCKET_DIR.
+  const bootstrapDir = resolveCesBootstrapSocketDir(resources, env);
+  env.CES_BOOTSTRAP_SOCKET_DIR = bootstrapDir;
+  mkdirSync(bootstrapDir, { recursive: true });
   applyIpcSocketDirOverride(env);
 }
 
@@ -1022,26 +1039,18 @@ function resolveCesDir(resources?: LocalInstanceResources): string {
 
 /**
  * Resolve the local IPC endpoint shared by the CLI-launched CES sibling and
- * assistant. Windows uses a named pipe. POSIX uses a Unix socket, including
- * the existing short macOS fallback.
+ * assistant. CES binds this path from `CES_BOOTSTRAP_SOCKET_DIR` via the same
+ * `resolveIpcEndpoint("ces")` helper. Windows uses a named pipe. POSIX uses
+ * a Unix socket, including the shared macOS AF_UNIX fallback.
  */
 export function resolveCesSocketPath(
   resources?: LocalInstanceResources,
   hostPlatform: NodeJS.Platform = platform(),
 ): string {
-  const workspaceDir = resources
-    ? join(resources.instanceDir, ".vellum", "workspace")
-    : join(homedir(), ".vellum", "workspace");
-  if (hostPlatform === "win32") {
-    return resolveIpcEndpoint("ces", {
-      workspaceDir,
-      platform: hostPlatform,
-    }).path;
-  }
-  const override = computeIpcSocketDirOverride(workspaceDir);
-  const socketDir = override ?? workspaceDir;
-  mkdirSync(socketDir, { recursive: true });
-  return join(socketDir, "ces.sock");
+  return resolveIpcEndpoint("ces", {
+    workspaceDir: resolveCesBootstrapSocketDir(resources),
+    platform: hostPlatform,
+  }).path;
 }
 
 async function isIpcEndpointReady(endpointPath: string): Promise<boolean> {
@@ -1101,13 +1110,15 @@ export async function startCes(
   const workspaceDir = resources
     ? join(resources.instanceDir, ".vellum", "workspace")
     : join(homedir(), ".vellum", "workspace");
+  const bootstrapDir = resolveCesBootstrapSocketDir(resources);
   mkdirSync(securityDir, { recursive: true });
+  mkdirSync(bootstrapDir, { recursive: true });
 
   const cesEnv: Record<string, string | undefined> = {
     ...process.env,
-    CES_LOCAL_SOCKET: socketPath,
     CREDENTIAL_SECURITY_DIR: securityDir,
     VELLUM_WORKSPACE_DIR: workspaceDir,
+    CES_BOOTSTRAP_SOCKET_DIR: bootstrapDir,
   };
 
   let ces;

package/src/lib/statefulset.ts

@@ -187,6 +187,7 @@ export const DOCKER_STATEFUL_SET_SPEC: DockerStatefulSetSpec = {
         { kind: "static", name: "VELLUM_BACKUP_DIR",         value: "/workspace/.backups" },
         { kind: "static", name: "VELLUM_BACKUP_KEY_PATH",    value: "/workspace/.backup.key" },
         { kind: "static", name: "CES_CREDENTIAL_URL",        value: "http://localhost:8090" },
+        { kind: "static", name: "CES_BOOTSTRAP_SOCKET_DIR",  value: "/run/ces-bootstrap" },
         { kind: "static", name: "GATEWAY_IPC_SOCKET_DIR",    value: "/run/gateway-ipc" },
         { kind: "static", name: "ASSISTANT_IPC_SOCKET_DIR",  value: "/run/assistant-ipc" },
         { kind: "secret", name: "CES_SERVICE_TOKEN",         secret: "cesServiceToken" },