@vellumai/cli 0.12.2 → 0.12.3-staging.2

package/node_modules/@vellumai/environments/src/shell.test.ts

@@ -2,6 +2,7 @@ import { describe, expect, test } from "bun:test";
 
 import {
   buildShellInvocation,
+  buildShellSpawnFlags,
   pathListDelimiter,
   prependUniquePathEntries,
 } from "./shell.js";
@@ -38,6 +39,26 @@ describe("buildShellInvocation", () => {
   });
 });
 
+describe("buildShellSpawnFlags", () => {
+  test("creates a POSIX process group and hides Windows consoles", () => {
+    expect(buildShellSpawnFlags("linux")).toEqual({
+      detached: true,
+      windowsHide: true,
+    });
+    expect(buildShellSpawnFlags("darwin")).toEqual({
+      detached: true,
+      windowsHide: true,
+    });
+  });
+
+  test("does not detach Windows children that use piped stdio", () => {
+    expect(buildShellSpawnFlags("win32")).toEqual({
+      detached: false,
+      windowsHide: true,
+    });
+  });
+});
+
 describe("path list handling", () => {
   test("uses the platform delimiter", () => {
     expect(pathListDelimiter("win32")).toBe(";");

package/node_modules/@vellumai/environments/src/shell.ts

@@ -5,6 +5,11 @@ export interface ShellInvocation {
   args: string[];
 }
 
+export interface ShellSpawnFlags {
+  detached: boolean;
+  windowsHide: true;
+}
+
 const WINDOWS_UTF8_PREAMBLE =
   "try { [Console]::OutputEncoding = [System.Text.Encoding]::UTF8 } catch {}; " +
   "$OutputEncoding = [System.Text.Encoding]::UTF8; " +
@@ -43,6 +48,25 @@ export function buildShellInvocation(
   return { command: "bash", args: ["-c", "--", command] };
 }
 
+/**
+ * Spawn flags for assistant-owned shell children (sandbox bash, local
+ * host_bash fallback, sanitized CLI bash, skill runners, scheduled scripts).
+ *
+ * POSIX uses a new process group so timeout/abort can SIGKILL the tree via
+ * `-pid`. Windows process trees are torn down with `taskkill /T`, which does
+ * not need a detached process. Combining `DETACHED_PROCESS`,
+ * `CREATE_NO_WINDOW`, and piped stdio on Windows can emit `close` with exit
+ * 0 and empty pipes without running the encoded command.
+ */
+export function buildShellSpawnFlags(
+  hostPlatform: NodeJS.Platform = process.platform,
+): ShellSpawnFlags {
+  return {
+    detached: hostPlatform !== "win32",
+    windowsHide: true,
+  };
+}
+
 export function pathListDelimiter(
   hostPlatform: NodeJS.Platform = process.platform,
 ): string {

package/node_modules/@vellumai/local-mode/node_modules/@vellumai/environments/src/shell.test.ts

@@ -2,6 +2,7 @@ import { describe, expect, test } from "bun:test";
 
 import {
   buildShellInvocation,
+  buildShellSpawnFlags,
   pathListDelimiter,
   prependUniquePathEntries,
 } from "./shell.js";
@@ -38,6 +39,26 @@ describe("buildShellInvocation", () => {
   });
 });
 
+describe("buildShellSpawnFlags", () => {
+  test("creates a POSIX process group and hides Windows consoles", () => {
+    expect(buildShellSpawnFlags("linux")).toEqual({
+      detached: true,
+      windowsHide: true,
+    });
+    expect(buildShellSpawnFlags("darwin")).toEqual({
+      detached: true,
+      windowsHide: true,
+    });
+  });
+
+  test("does not detach Windows children that use piped stdio", () => {
+    expect(buildShellSpawnFlags("win32")).toEqual({
+      detached: false,
+      windowsHide: true,
+    });
+  });
+});
+
 describe("path list handling", () => {
   test("uses the platform delimiter", () => {
     expect(pathListDelimiter("win32")).toBe(";");

package/node_modules/@vellumai/local-mode/node_modules/@vellumai/environments/src/shell.ts

@@ -5,6 +5,11 @@ export interface ShellInvocation {
   args: string[];
 }
 
+export interface ShellSpawnFlags {
+  detached: boolean;
+  windowsHide: true;
+}
+
 const WINDOWS_UTF8_PREAMBLE =
   "try { [Console]::OutputEncoding = [System.Text.Encoding]::UTF8 } catch {}; " +
   "$OutputEncoding = [System.Text.Encoding]::UTF8; " +
@@ -43,6 +48,25 @@ export function buildShellInvocation(
   return { command: "bash", args: ["-c", "--", command] };
 }
 
+/**
+ * Spawn flags for assistant-owned shell children (sandbox bash, local
+ * host_bash fallback, sanitized CLI bash, skill runners, scheduled scripts).
+ *
+ * POSIX uses a new process group so timeout/abort can SIGKILL the tree via
+ * `-pid`. Windows process trees are torn down with `taskkill /T`, which does
+ * not need a detached process. Combining `DETACHED_PROCESS`,
+ * `CREATE_NO_WINDOW`, and piped stdio on Windows can emit `close` with exit
+ * 0 and empty pipes without running the encoded command.
+ */
+export function buildShellSpawnFlags(
+  hostPlatform: NodeJS.Platform = process.platform,
+): ShellSpawnFlags {
+  return {
+    detached: hostPlatform !== "win32",
+    windowsHide: true,
+  };
+}
+
 export function pathListDelimiter(
   hostPlatform: NodeJS.Platform = process.platform,
 ): string {

package/node_modules/@vellumai/local-mode/node_modules/@vellumai/service-contracts/package.json

@@ -27,7 +27,8 @@
     "./reactions": "./src/reactions.ts",
     "./guardian-requests": "./src/guardian-requests.ts",
     "./platform-credential": "./src/platform-credential.ts",
-    "./plan-credit": "./src/plan-credit.ts"
+    "./plan-credit": "./src/plan-credit.ts",
+    "./integration-categories": "./src/integration-categories.ts"
   },
   "scripts": {
     "typecheck": "bunx tsc --noEmit",

package/node_modules/@vellumai/local-mode/node_modules/@vellumai/service-contracts/src/__tests__/secret-detection.test.ts

@@ -63,6 +63,7 @@ const FIXTURES: Record<string, string> = {
   "Perplexity API Key": `pplx-${filler(40)}`,
   "Tavily API Key": `tvly-${filler(20)}`,
   "Firecrawl API Key": `fc-${filler(20)}`,
+  "Resend API Key": `re_${filler(8)}_${filler(24)}`,
 };
 
 describe("subpath export", () => {

package/node_modules/@vellumai/local-mode/node_modules/@vellumai/service-contracts/src/index.ts

@@ -29,6 +29,7 @@ export * from "./trust-rules.js";
 export * from "./ingress.js";
 export * from "./no-response.js";
 export * from "./plan-credit.js";
+export * from "./integration-categories.js";
 export * from "./platform-credential.js";
 export * from "./remote-web-pairing.js";
 export * from "./twilio-ingress.js";

package/node_modules/@vellumai/local-mode/node_modules/@vellumai/service-contracts/src/integration-categories.ts

@@ -0,0 +1,36 @@
+/**
+ * Category vocabulary for the integrations catalog, shared by the assistant
+ * daemon (which stamps it on OAuth providers and marketplace MCP entries) and
+ * the clients (which draw the category filter from it).
+ *
+ * The order here is the order clients show the categories in. The slug is the
+ * wire value; the user-facing label is the client's, so it can be translated.
+ */
+export const INTEGRATION_CATEGORIES = [
+  "productivity",
+  "communication",
+  "meetings",
+  "sales",
+  "marketing",
+  "finance",
+  "commerce",
+  "engineering",
+  "knowledge",
+  "recruiting",
+] as const;
+
+export type IntegrationCategory = (typeof INTEGRATION_CATEGORIES)[number];
+
+const INTEGRATION_CATEGORY_SET: ReadonlySet<string> = new Set(
+  INTEGRATION_CATEGORIES,
+);
+
+/**
+ * Whether `value` names a category this build knows. A client reading a newer
+ * catalog treats an unknown slug as uncategorized rather than failing.
+ */
+export function isIntegrationCategory(
+  value: unknown,
+): value is IntegrationCategory {
+  return typeof value === "string" && INTEGRATION_CATEGORY_SET.has(value);
+}

package/node_modules/@vellumai/local-mode/node_modules/@vellumai/service-contracts/src/secret-detection.ts

@@ -230,6 +230,9 @@ export const PREFIX_PATTERNS: SecretPrefixPattern[] = [
 
   // -- Firecrawl --
   { label: "Firecrawl API Key", regex: /fc-[A-Za-z0-9]{20,}/ },
+  // Resend documents only the `re_` prefix; the segment shape is the observed
+  // key format. Strict on purpose: bare `re_` prefixes ordinary identifiers.
+  { label: "Resend API Key", regex: /re_[A-Za-z0-9]{8}_[A-Za-z0-9]{24,}/ },
 ];
 
 /**
@@ -362,7 +365,7 @@ export function isPlaceholderValue(value: string): boolean {
   // Strip known prefixes to isolate the variable part
   const variablePart = value
     .replace(
-      /^(?:AKIA|gh[pousr]_|github_pat_|glpat-|sk_live_|rk_live_|xoxb-|xoxp-|xapp-|sk-ant-|sk-proj-|sk-or-v1-|AIza|GOCSPX-|SK|SG\.|npm_|pypi-|key-|lin_api_|ntn_|fw_|pplx-|-----BEGIN [A-Z ]*PRIVATE KEY-----)/,
+      /^(?:AKIA|gh[pousr]_|github_pat_|glpat-|sk_live_|rk_live_|xoxb-|xoxp-|xapp-|sk-ant-|sk-proj-|sk-or-v1-|AIza|GOCSPX-|SK|SG\.|npm_|pypi-|key-|lin_api_|ntn_|fw_|pplx-|re_|-----BEGIN [A-Z ]*PRIVATE KEY-----)/,
       "",
     )
     .replace(/[^A-Za-z0-9]/g, "");

package/node_modules/@vellumai/local-mode/src/status.ts

@@ -222,13 +222,6 @@ function defaultPorts(env: Record<string, string | undefined>): {
   };
 }
 
-function defaultInstanceDir(
-  env: Record<string, string | undefined>,
-  assistantId: string,
-): string {
-  return resolveInstanceDir(env, assistantId);
-}
-
 function firstString(...values: unknown[]): string | undefined {
   for (const value of values) {
     if (typeof value === "string" && value.length > 0) return value;
@@ -302,7 +295,7 @@ export function resolveLockfileInstanceDir(
       ok: true,
       instanceDir:
         lockfileInstanceDir(entry, rawEntry) ??
-        defaultInstanceDir(env, assistantId),
+        resolveInstanceDir(env, assistantId),
     };
   } catch {
     return { ok: true };
@@ -320,7 +313,7 @@ function resolveStatusResources(
   const ports = defaultPorts(env);
   const instanceDir =
     lockfileInstanceDir(entry, rawEntry) ??
-    defaultInstanceDir(env, entry.assistantId);
+    resolveInstanceDir(env, entry.assistantId);
   return {
     instanceDir,
     daemonPort:

package/node_modules/@vellumai/service-contracts/package.json

@@ -27,7 +27,8 @@
     "./reactions": "./src/reactions.ts",
     "./guardian-requests": "./src/guardian-requests.ts",
     "./platform-credential": "./src/platform-credential.ts",
-    "./plan-credit": "./src/plan-credit.ts"
+    "./plan-credit": "./src/plan-credit.ts",
+    "./integration-categories": "./src/integration-categories.ts"
   },
   "scripts": {
     "typecheck": "bunx tsc --noEmit",

package/node_modules/@vellumai/service-contracts/src/__tests__/secret-detection.test.ts

@@ -63,6 +63,7 @@ const FIXTURES: Record<string, string> = {
   "Perplexity API Key": `pplx-${filler(40)}`,
   "Tavily API Key": `tvly-${filler(20)}`,
   "Firecrawl API Key": `fc-${filler(20)}`,
+  "Resend API Key": `re_${filler(8)}_${filler(24)}`,
 };
 
 describe("subpath export", () => {

package/node_modules/@vellumai/service-contracts/src/index.ts

@@ -29,6 +29,7 @@ export * from "./trust-rules.js";
 export * from "./ingress.js";
 export * from "./no-response.js";
 export * from "./plan-credit.js";
+export * from "./integration-categories.js";
 export * from "./platform-credential.js";
 export * from "./remote-web-pairing.js";
 export * from "./twilio-ingress.js";

package/node_modules/@vellumai/service-contracts/src/integration-categories.ts

@@ -0,0 +1,36 @@
+/**
+ * Category vocabulary for the integrations catalog, shared by the assistant
+ * daemon (which stamps it on OAuth providers and marketplace MCP entries) and
+ * the clients (which draw the category filter from it).
+ *
+ * The order here is the order clients show the categories in. The slug is the
+ * wire value; the user-facing label is the client's, so it can be translated.
+ */
+export const INTEGRATION_CATEGORIES = [
+  "productivity",
+  "communication",
+  "meetings",
+  "sales",
+  "marketing",
+  "finance",
+  "commerce",
+  "engineering",
+  "knowledge",
+  "recruiting",
+] as const;
+
+export type IntegrationCategory = (typeof INTEGRATION_CATEGORIES)[number];
+
+const INTEGRATION_CATEGORY_SET: ReadonlySet<string> = new Set(
+  INTEGRATION_CATEGORIES,
+);
+
+/**
+ * Whether `value` names a category this build knows. A client reading a newer
+ * catalog treats an unknown slug as uncategorized rather than failing.
+ */
+export function isIntegrationCategory(
+  value: unknown,
+): value is IntegrationCategory {
+  return typeof value === "string" && INTEGRATION_CATEGORY_SET.has(value);
+}

package/node_modules/@vellumai/service-contracts/src/secret-detection.ts

@@ -230,6 +230,9 @@ export const PREFIX_PATTERNS: SecretPrefixPattern[] = [
 
   // -- Firecrawl --
   { label: "Firecrawl API Key", regex: /fc-[A-Za-z0-9]{20,}/ },
+  // Resend documents only the `re_` prefix; the segment shape is the observed
+  // key format. Strict on purpose: bare `re_` prefixes ordinary identifiers.
+  { label: "Resend API Key", regex: /re_[A-Za-z0-9]{8}_[A-Za-z0-9]{24,}/ },
 ];
 
 /**
@@ -362,7 +365,7 @@ export function isPlaceholderValue(value: string): boolean {
   // Strip known prefixes to isolate the variable part
   const variablePart = value
     .replace(
-      /^(?:AKIA|gh[pousr]_|github_pat_|glpat-|sk_live_|rk_live_|xoxb-|xoxp-|xapp-|sk-ant-|sk-proj-|sk-or-v1-|AIza|GOCSPX-|SK|SG\.|npm_|pypi-|key-|lin_api_|ntn_|fw_|pplx-|-----BEGIN [A-Z ]*PRIVATE KEY-----)/,
+      /^(?:AKIA|gh[pousr]_|github_pat_|glpat-|sk_live_|rk_live_|xoxb-|xoxp-|xapp-|sk-ant-|sk-proj-|sk-or-v1-|AIza|GOCSPX-|SK|SG\.|npm_|pypi-|key-|lin_api_|ntn_|fw_|pplx-|re_|-----BEGIN [A-Z ]*PRIVATE KEY-----)/,
       "",
     )
     .replace(/[^A-Za-z0-9]/g, "");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vellumai/cli",
-  "version": "0.12.2",
+  "version": "0.12.3-staging.2",
   "description": "CLI tools for vellum-assistant",
   "type": "module",
   "exports": {

package/src/commands/roadmap.ts

@@ -21,13 +21,20 @@ function printUsage(): void {
   console.log("  upvote   <slug>");
   console.log("  unvote   <slug>");
   console.log("");
+  console.log(
+    "update: --status and --tag are staff-only. Anyone else can edit only the",
+  );
+  console.log(
+    "title and description of an item they filed, while it is still open.",
+  );
+  console.log("");
   console.log("Examples:");
   console.log('  $ vellum roadmap list --query "dark mode"');
   console.log("  $ vellum roadmap list --status planned --sort upvotes");
   console.log("  $ vellum roadmap get my-feature-slug");
   console.log('  $ vellum roadmap create --title "Add dark mode"');
   console.log(
-    "  $ vellum roadmap update my-feature --status planned --tag integrations",
+    '  $ vellum roadmap update my-feature --description "Follow the OS setting"',
   );
   console.log("  $ vellum roadmap upvote my-feature-slug");
 }

package/src/lib/__tests__/docker.test.ts

@@ -83,6 +83,7 @@ describe("buildServiceRunArgs — assistant", () => {
     const args = buildAssistantArgs();
     expect(args).toContain("IS_CONTAINERIZED=true");
     expect(args).toContain("VELLUM_WORKSPACE_DIR=/workspace");
+    expect(args).toContain("CES_BOOTSTRAP_SOCKET_DIR=/run/ces-bootstrap");
     expect(args).toContain(`VELLUM_ASSISTANT_NAME=${instanceName}`);
   });
 

package/src/lib/__tests__/local-ces.test.ts

@@ -9,6 +9,8 @@ import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { afterAll, beforeAll, describe, expect, mock, test } from "bun:test";
 
+import { resolveIpcEndpoint } from "@vellumai/ipc-server-utils";
+
 import { resolveCesSocketPath, startCes } from "../local.js";
 
 // ---------------------------------------------------------------------------
@@ -106,7 +108,7 @@ describe("startCes", () => {
     // startCes unlinks the stale socket, then polls for it. We create it with
     // a slight delay so the poll catches it.
     setTimeout(() => {
-      const socketDir = join(vellumDir, "workspace");
+      const socketDir = join(vellumDir, "protected", "credential-executor");
       mkdirSync(socketDir, { recursive: true });
       writeFileSync(join(socketDir, "ces.sock"), "");
     }, 50);
@@ -126,7 +128,9 @@ describe("startCes", () => {
 
     // Verify env vars
     const env = lastSpawnCall!.options.env!;
-    expect(env["CES_LOCAL_SOCKET"]).toBeDefined();
+    expect(env["CES_BOOTSTRAP_SOCKET_DIR"]).toBe(
+      join(tempDir, ".vellum", "protected", "credential-executor"),
+    );
     expect(env["CREDENTIAL_SECURITY_DIR"]).toBeDefined();
     expect(env["VELLUM_WORKSPACE_DIR"]).toBeDefined();
 
@@ -143,4 +147,23 @@ describe("startCes", () => {
     expect(socketPath.startsWith("\\\\.\\pipe\\vellum-ces-")).toBe(true);
     expect(socketPath).not.toContain("Example");
   });
+
+  test("POSIX local CES seam matches resolveIpcEndpoint", () => {
+    const resources = {
+      instanceDir: "/tmp/assistant-123",
+    } as Parameters<typeof resolveCesSocketPath>[0];
+
+    const socketPath = resolveCesSocketPath(resources, "linux");
+    expect(socketPath).toBe(
+      resolveIpcEndpoint("ces", {
+        workspaceDir: join(
+          "/tmp/assistant-123",
+          ".vellum",
+          "protected",
+          "credential-executor",
+        ),
+        platform: "linux",
+      }).path,
+    );
+  });
 });

package/src/lib/local.ts

@@ -606,6 +606,24 @@ type DaemonStartOptions = {
   signingKey?: string;
 };
 
+/**
+ * Directory that holds the local CES Unix socket (`ces.sock`).
+ *
+ * Matches CES's local data root: `{CREDENTIAL_SECURITY_DIR}/credential-executor`.
+ * Local CLI and managed sidecars share `CES_BOOTSTRAP_SOCKET_DIR`; this is the
+ * writable per-instance directory used outside containers.
+ */
+function resolveCesBootstrapSocketDir(
+  resources?: LocalInstanceResources,
+  env?: Record<string, string | undefined>,
+): string {
+  const securityDir = resources
+    ? join(resources.instanceDir, ".vellum", "protected")
+    : env?.CREDENTIAL_SECURITY_DIR?.trim() ||
+      join(homedir(), ".vellum", "protected");
+  return join(securityDir, "credential-executor");
+}
+
 /**
  * Apply per-instance resource overrides and shared daemon options to an
  * environment object. Called from all daemon spawn paths (source, watch,
@@ -644,11 +662,10 @@ function applyDaemonEnvOverrides(
     env.VELLUM_DEFAULT_WORKSPACE_CONFIG_PATH =
       options.defaultWorkspaceConfigPath;
   }
-  // Pin the daemon to the exact socket the sibling binds so the two agree
-  // regardless of any stale CES_LOCAL_SOCKET inherited from the parent
-  // environment. The assistant connects to the sibling instead of spawning
-  // its own CES.
-  env.CES_LOCAL_SOCKET = resolveCesSocketPath(resources);
+  // CES and the assistant resolve the socket from CES_BOOTSTRAP_SOCKET_DIR.
+  const bootstrapDir = resolveCesBootstrapSocketDir(resources, env);
+  env.CES_BOOTSTRAP_SOCKET_DIR = bootstrapDir;
+  mkdirSync(bootstrapDir, { recursive: true });
   applyIpcSocketDirOverride(env);
 }
 
@@ -1022,26 +1039,18 @@ function resolveCesDir(resources?: LocalInstanceResources): string {
 
 /**
  * Resolve the local IPC endpoint shared by the CLI-launched CES sibling and
- * assistant. Windows uses a named pipe. POSIX uses a Unix socket, including
- * the existing short macOS fallback.
+ * assistant. CES binds this path from `CES_BOOTSTRAP_SOCKET_DIR` via the same
+ * `resolveIpcEndpoint("ces")` helper. Windows uses a named pipe. POSIX uses
+ * a Unix socket, including the shared macOS AF_UNIX fallback.
  */
 export function resolveCesSocketPath(
   resources?: LocalInstanceResources,
   hostPlatform: NodeJS.Platform = platform(),
 ): string {
-  const workspaceDir = resources
-    ? join(resources.instanceDir, ".vellum", "workspace")
-    : join(homedir(), ".vellum", "workspace");
-  if (hostPlatform === "win32") {
-    return resolveIpcEndpoint("ces", {
-      workspaceDir,
-      platform: hostPlatform,
-    }).path;
-  }
-  const override = computeIpcSocketDirOverride(workspaceDir);
-  const socketDir = override ?? workspaceDir;
-  mkdirSync(socketDir, { recursive: true });
-  return join(socketDir, "ces.sock");
+  return resolveIpcEndpoint("ces", {
+    workspaceDir: resolveCesBootstrapSocketDir(resources),
+    platform: hostPlatform,
+  }).path;
 }
 
 async function isIpcEndpointReady(endpointPath: string): Promise<boolean> {
@@ -1101,13 +1110,15 @@ export async function startCes(
   const workspaceDir = resources
     ? join(resources.instanceDir, ".vellum", "workspace")
     : join(homedir(), ".vellum", "workspace");
+  const bootstrapDir = resolveCesBootstrapSocketDir(resources);
   mkdirSync(securityDir, { recursive: true });
+  mkdirSync(bootstrapDir, { recursive: true });
 
   const cesEnv: Record<string, string | undefined> = {
     ...process.env,
-    CES_LOCAL_SOCKET: socketPath,
     CREDENTIAL_SECURITY_DIR: securityDir,
     VELLUM_WORKSPACE_DIR: workspaceDir,
+    CES_BOOTSTRAP_SOCKET_DIR: bootstrapDir,
   };
 
   let ces;
@@ -1170,14 +1181,6 @@ export async function startCes(
   }
 }
 
-/**
- * Check if the daemon is responsive by hitting its HTTP `/healthz` endpoint.
- * This replaces the socket-based `isSocketResponsive()` check.
- */
-async function isDaemonResponsive(daemonPort: number): Promise<boolean> {
-  return httpHealthCheck(daemonPort);
-}
-
 /**
  * Find the PID of the process listening on the given TCP port.
  * Uses `lsof` on macOS/Linux. Returns undefined if no listener is found
@@ -1273,7 +1276,7 @@ async function checkOrphanedDaemon(
   pidFile: string,
   daemonPort: number,
 ): Promise<boolean> {
-  if (!(await isDaemonResponsive(daemonPort))) return false;
+  if (!(await httpHealthCheck(daemonPort))) return false;
 
   const recoveredPid = recoverPidFile(pidFile, daemonPort);
   if (recoveredPid) {
@@ -1671,7 +1674,7 @@ export async function startLocalDaemon(
       const daemonSpawnEnv = envWithCompiledRuntimeNodePath(daemonEnv);
 
       // Write a sentinel PID file before spawning so concurrent hatch() calls
-      // see the file and fall through to the isDaemonResponsive() port check
+      // see the file and fall through to the httpHealthCheck() port check
       // instead of racing to spawn a duplicate daemon.
       writeFileSync(pidFile, "starting", "utf-8");
 

package/src/lib/platform-client.ts

@@ -528,20 +528,8 @@ export async function injectCredentialsIntoAssistant(
     promises.push(inject("vellum:assistant_api_key", params.assistantApiKey));
   }
 
-  promises.push(
-    inject("vellum:platform_assistant_id", params.platformAssistantId),
-  );
-
   promises.push(inject("vellum:platform_base_url", params.platformBaseUrl));
 
-  promises.push(
-    inject("vellum:platform_organization_id", params.organizationId),
-  );
-
-  if (params.userId) {
-    promises.push(inject("vellum:platform_user_id", params.userId));
-  }
-
   if (params.webhookSecret) {
     promises.push(inject("vellum:webhook_secret", params.webhookSecret));
   }

package/src/lib/provider-secrets.ts

@@ -77,6 +77,7 @@ const PROVIDER_LABELS: Record<LlmProviderId, string> = {
   opencode: "OpenCode",
   baseten: "Baseten",
   poolside: "Poolside",
+  typesafe: "TypeSafe",
 };
 
 // litellm and opencode are deliberately excluded: they have no fixed default
@@ -246,6 +247,9 @@ export function inferProviderFromModel(model: string): string | undefined {
   if (model.startsWith("poolside/")) {
     return "poolside";
   }
+  if (model === "jev-latest" || model.startsWith("jev-")) {
+    return "typesafe";
+  }
   if (model === "qwen/qwen3-8b") {
     // The only qwen/* ID the Vellum hosted provider carries; the rest are
     // OpenRouter's.

package/src/lib/statefulset.ts

@@ -187,6 +187,7 @@ export const DOCKER_STATEFUL_SET_SPEC: DockerStatefulSetSpec = {
         { kind: "static", name: "VELLUM_BACKUP_DIR",         value: "/workspace/.backups" },
         { kind: "static", name: "VELLUM_BACKUP_KEY_PATH",    value: "/workspace/.backup.key" },
         { kind: "static", name: "CES_CREDENTIAL_URL",        value: "http://localhost:8090" },
+        { kind: "static", name: "CES_BOOTSTRAP_SOCKET_DIR",  value: "/run/ces-bootstrap" },
         { kind: "static", name: "GATEWAY_IPC_SOCKET_DIR",    value: "/run/gateway-ipc" },
         { kind: "static", name: "ASSISTANT_IPC_SOCKET_DIR",  value: "/run/assistant-ipc" },
         { kind: "secret", name: "CES_SERVICE_TOKEN",         secret: "cesServiceToken" },

package/src/shared/provider-env-vars.ts

@@ -34,6 +34,7 @@ export const LLM_PROVIDER_ENV_VAR_NAMES: Record<string, string> = {
   opencode: "OPENCODE_API_KEY",
   baseten: "BASETEN_API_KEY",
   poolside: "POOLSIDE_API_KEY",
+  typesafe: "TYPESAFE_API_KEY",
 };
 
 /** Search-provider env var names. Mirrors `SEARCH_PROVIDER_CATALOG` BYOK entries. */
@@ -44,6 +45,8 @@ export const SEARCH_PROVIDER_ENV_VAR_NAMES: Record<string, string> = {
   firecrawl: "FIRECRAWL_API_KEY",
   keenable: "KEENABLE_API_KEY",
   fastcrw: "FASTCRW_API_KEY",
+  searxng: "SEARXNG_API_KEY",
+  tinyfish: "TINYFISH_API_KEY",
 };
 
 /**