@vellumai/cli 0.12.1 → 0.12.2-dev.202609162214.308bda0

package/src/lib/local.ts

@@ -606,6 +606,24 @@ type DaemonStartOptions = {
   signingKey?: string;
 };
 
+/**
+ * Directory that holds the local CES Unix socket (`ces.sock`).
+ *
+ * Matches CES's local data root: `{CREDENTIAL_SECURITY_DIR}/credential-executor`.
+ * Local CLI and managed sidecars share `CES_BOOTSTRAP_SOCKET_DIR`; this is the
+ * writable per-instance directory used outside containers.
+ */
+function resolveCesBootstrapSocketDir(
+  resources?: LocalInstanceResources,
+  env?: Record<string, string | undefined>,
+): string {
+  const securityDir = resources
+    ? join(resources.instanceDir, ".vellum", "protected")
+    : env?.CREDENTIAL_SECURITY_DIR?.trim() ||
+      join(homedir(), ".vellum", "protected");
+  return join(securityDir, "credential-executor");
+}
+
 /**
  * Apply per-instance resource overrides and shared daemon options to an
  * environment object. Called from all daemon spawn paths (source, watch,
@@ -644,11 +662,10 @@ function applyDaemonEnvOverrides(
     env.VELLUM_DEFAULT_WORKSPACE_CONFIG_PATH =
       options.defaultWorkspaceConfigPath;
   }
-  // Pin the daemon to the exact socket the sibling binds so the two agree
-  // regardless of any stale CES_LOCAL_SOCKET inherited from the parent
-  // environment. The assistant connects to the sibling instead of spawning
-  // its own CES.
-  env.CES_LOCAL_SOCKET = resolveCesSocketPath(resources);
+  // CES and the assistant resolve the socket from CES_BOOTSTRAP_SOCKET_DIR.
+  const bootstrapDir = resolveCesBootstrapSocketDir(resources, env);
+  env.CES_BOOTSTRAP_SOCKET_DIR = bootstrapDir;
+  mkdirSync(bootstrapDir, { recursive: true });
   applyIpcSocketDirOverride(env);
 }
 
@@ -1022,26 +1039,18 @@ function resolveCesDir(resources?: LocalInstanceResources): string {
 
 /**
  * Resolve the local IPC endpoint shared by the CLI-launched CES sibling and
- * assistant. Windows uses a named pipe. POSIX uses a Unix socket, including
- * the existing short macOS fallback.
+ * assistant. CES binds this path from `CES_BOOTSTRAP_SOCKET_DIR` via the same
+ * `resolveIpcEndpoint("ces")` helper. Windows uses a named pipe. POSIX uses
+ * a Unix socket, including the shared macOS AF_UNIX fallback.
  */
 export function resolveCesSocketPath(
   resources?: LocalInstanceResources,
   hostPlatform: NodeJS.Platform = platform(),
 ): string {
-  const workspaceDir = resources
-    ? join(resources.instanceDir, ".vellum", "workspace")
-    : join(homedir(), ".vellum", "workspace");
-  if (hostPlatform === "win32") {
-    return resolveIpcEndpoint("ces", {
-      workspaceDir,
-      platform: hostPlatform,
-    }).path;
-  }
-  const override = computeIpcSocketDirOverride(workspaceDir);
-  const socketDir = override ?? workspaceDir;
-  mkdirSync(socketDir, { recursive: true });
-  return join(socketDir, "ces.sock");
+  return resolveIpcEndpoint("ces", {
+    workspaceDir: resolveCesBootstrapSocketDir(resources),
+    platform: hostPlatform,
+  }).path;
 }
 
 async function isIpcEndpointReady(endpointPath: string): Promise<boolean> {
@@ -1101,13 +1110,15 @@ export async function startCes(
   const workspaceDir = resources
     ? join(resources.instanceDir, ".vellum", "workspace")
     : join(homedir(), ".vellum", "workspace");
+  const bootstrapDir = resolveCesBootstrapSocketDir(resources);
   mkdirSync(securityDir, { recursive: true });
+  mkdirSync(bootstrapDir, { recursive: true });
 
   const cesEnv: Record<string, string | undefined> = {
     ...process.env,
-    CES_LOCAL_SOCKET: socketPath,
     CREDENTIAL_SECURITY_DIR: securityDir,
     VELLUM_WORKSPACE_DIR: workspaceDir,
+    CES_BOOTSTRAP_SOCKET_DIR: bootstrapDir,
   };
 
   let ces;

package/src/lib/platform-client.ts

@@ -528,20 +528,8 @@ export async function injectCredentialsIntoAssistant(
     promises.push(inject("vellum:assistant_api_key", params.assistantApiKey));
   }
 
-  promises.push(
-    inject("vellum:platform_assistant_id", params.platformAssistantId),
-  );
-
   promises.push(inject("vellum:platform_base_url", params.platformBaseUrl));
 
-  promises.push(
-    inject("vellum:platform_organization_id", params.organizationId),
-  );
-
-  if (params.userId) {
-    promises.push(inject("vellum:platform_user_id", params.userId));
-  }
-
   if (params.webhookSecret) {
     promises.push(inject("vellum:webhook_secret", params.webhookSecret));
   }

package/src/lib/provider-secrets.ts

@@ -77,6 +77,7 @@ const PROVIDER_LABELS: Record<LlmProviderId, string> = {
   opencode: "OpenCode",
   baseten: "Baseten",
   poolside: "Poolside",
+  jev: "Jev",
 };
 
 // litellm and opencode are deliberately excluded: they have no fixed default
@@ -246,6 +247,9 @@ export function inferProviderFromModel(model: string): string | undefined {
   if (model.startsWith("poolside/")) {
     return "poolside";
   }
+  if (model === "jev-latest" || model.startsWith("jev-")) {
+    return "jev";
+  }
   if (model === "qwen/qwen3-8b") {
     // The only qwen/* ID the Vellum hosted provider carries; the rest are
     // OpenRouter's.

package/src/lib/statefulset.ts

@@ -187,6 +187,7 @@ export const DOCKER_STATEFUL_SET_SPEC: DockerStatefulSetSpec = {
         { kind: "static", name: "VELLUM_BACKUP_DIR",         value: "/workspace/.backups" },
         { kind: "static", name: "VELLUM_BACKUP_KEY_PATH",    value: "/workspace/.backup.key" },
         { kind: "static", name: "CES_CREDENTIAL_URL",        value: "http://localhost:8090" },
+        { kind: "static", name: "CES_BOOTSTRAP_SOCKET_DIR",  value: "/run/ces-bootstrap" },
         { kind: "static", name: "GATEWAY_IPC_SOCKET_DIR",    value: "/run/gateway-ipc" },
         { kind: "static", name: "ASSISTANT_IPC_SOCKET_DIR",  value: "/run/assistant-ipc" },
         { kind: "secret", name: "CES_SERVICE_TOKEN",         secret: "cesServiceToken" },

package/src/lib/teleport-backup.ts

@@ -0,0 +1,139 @@
+/**
+ * Platform (cloud="vellum") half of the pre-teleport safety backup.
+ *
+ * A platform source is snapshotted through Django's user-facing backup
+ * endpoint, which cuts a PVC VolumeSnapshot via vembda. The POST returns as
+ * soon as the snapshot object exists; it becomes restorable asynchronously,
+ * so {@link createPlatformBackup} polls the listing until the new snapshot
+ * reports `ready_to_use` before returning. A snapshot that never becomes
+ * ready within the timeout is a backup failure, not a success.
+ *
+ * Local and docker sources are backed up host-side by `backup-ops` instead,
+ * so the restore point survives the source's retirement. Policy shared with
+ * the web teleport lives in `@vellumai/local-mode/teleport-backup-policy`.
+ */
+
+import {
+  MANAGED_BACKUP_READY_POLL_INTERVAL_MS,
+  MANAGED_BACKUP_READY_TIMEOUT_MS,
+  managedBackupIsReady,
+  readyManagedBackupCreatedAts,
+  type ManagedBackupEntry,
+} from "@vellumai/local-mode/teleport-backup-policy";
+
+import type { AssistantEntry } from "./assistant-config.js";
+import { loopbackSafeFetch } from "./loopback-fetch.js";
+import { authHeaders, invalidateOrgIdCache } from "./platform-client.js";
+
+type PlatformEntry = Pick<AssistantEntry, "runtimeUrl" | "assistantId">;
+
+function platformBackupsUrl(entry: PlatformEntry): string {
+  return `${entry.runtimeUrl}/v1/assistants/${entry.assistantId}/backups/`;
+}
+
+async function errorSuffix(response: Response): Promise<string> {
+  const body = await response.text().catch(() => "");
+  return `(${response.status})${body ? `: ${body}` : ""}`;
+}
+
+/**
+ * Send a platform backup request with user-session auth, refreshing the
+ * cached organization id once on 401 (the same recovery the runtime identity
+ * probe applies).
+ */
+async function platformBackupRequest(
+  entry: PlatformEntry,
+  token: string,
+  method: "GET" | "POST",
+): Promise<Response> {
+  const doRequest = async (): Promise<Response> =>
+    loopbackSafeFetch(platformBackupsUrl(entry), {
+      method,
+      headers: {
+        ...(await authHeaders(token, entry.runtimeUrl)),
+        Accept: "application/json",
+      },
+    });
+  let response = await doRequest();
+  if (response.status === 401) {
+    invalidateOrgIdCache(token, entry.runtimeUrl);
+    response = await doRequest();
+  }
+  return response;
+}
+
+async function fetchPlatformBackups(
+  entry: PlatformEntry,
+  token: string,
+): Promise<ManagedBackupEntry[]> {
+  const response = await platformBackupRequest(entry, token, "GET");
+  if (!response.ok) {
+    throw new Error(
+      `Platform backup list failed ${await errorSuffix(response)}`,
+    );
+  }
+  const body = (await response.json()) as { backups?: ManagedBackupEntry[] };
+  return body.backups ?? [];
+}
+
+/**
+ * `created_at` of every restorable PVC snapshot of a platform assistant:
+ * `GET /v1/assistants/<id>/backups/`.
+ */
+export async function listPlatformBackups(
+  entry: PlatformEntry,
+  token: string,
+): Promise<Array<string | undefined>> {
+  return readyManagedBackupCreatedAts(await fetchPlatformBackups(entry, token));
+}
+
+export interface CreatePlatformBackupOptions {
+  timeoutMs?: number;
+  pollIntervalMs?: number;
+}
+
+/**
+ * Take a PVC snapshot of a platform assistant and wait until it is
+ * restorable: `POST /v1/assistants/<id>/backups/`, then re-list until the
+ * returned `snapshot_name` reports `ready_to_use`. Throws if the POST fails
+ * or the snapshot is not ready within `timeoutMs`.
+ */
+export async function createPlatformBackup(
+  entry: PlatformEntry,
+  token: string,
+  options: CreatePlatformBackupOptions = {},
+): Promise<void> {
+  const timeoutMs = options.timeoutMs ?? MANAGED_BACKUP_READY_TIMEOUT_MS;
+  const pollIntervalMs =
+    options.pollIntervalMs ?? MANAGED_BACKUP_READY_POLL_INTERVAL_MS;
+
+  const response = await platformBackupRequest(entry, token, "POST");
+  if (!response.ok) {
+    throw new Error(
+      `Platform backup create failed ${await errorSuffix(response)}`,
+    );
+  }
+  const created = (await response.json().catch(() => null)) as {
+    snapshot_name?: string;
+    ready_to_use?: boolean;
+  } | null;
+  const snapshotName = created?.snapshot_name;
+  if (!snapshotName) {
+    throw new Error("Platform backup create returned no snapshot name");
+  }
+  if (created?.ready_to_use === true) {
+    return;
+  }
+
+  const deadline = Date.now() + timeoutMs;
+  while (Date.now() < deadline) {
+    await new Promise((resolve) => setTimeout(resolve, pollIntervalMs));
+    const backups = await fetchPlatformBackups(entry, token);
+    if (managedBackupIsReady(backups, snapshotName)) {
+      return;
+    }
+  }
+  throw new Error(
+    `Platform backup ${snapshotName} was not ready after ${Math.round(timeoutMs / 1000)}s`,
+  );
+}

package/src/shared/provider-env-vars.ts

@@ -34,6 +34,7 @@ export const LLM_PROVIDER_ENV_VAR_NAMES: Record<string, string> = {
   opencode: "OPENCODE_API_KEY",
   baseten: "BASETEN_API_KEY",
   poolside: "POOLSIDE_API_KEY",
+  jev: "TYPESAFE_API_KEY",
 };
 
 /** Search-provider env var names. Mirrors `SEARCH_PROVIDER_CATALOG` BYOK entries. */