@vellumai/cli 0.4.25 → 0.4.29

package/src/lib/local.ts

@@ -1,5 +1,6 @@
 import { execFileSync, spawn } from "child_process";
 import {
+  closeSync,
   existsSync,
   mkdirSync,
   readFileSync,
@@ -78,6 +79,18 @@ function findGatewaySourceFromCwd(): string | undefined {
   }
 }
 
+function isOutboundProxySourceDir(dir: string): boolean {
+  const pkgPath = join(dir, "package.json");
+  if (!existsSync(pkgPath) || !existsSync(join(dir, "src", "main.ts")))
+    return false;
+  try {
+    const pkg = JSON.parse(readFileSync(pkgPath, "utf-8"));
+    return pkg.name === "@vellumai/outbound-proxy";
+  } catch {
+    return false;
+  }
+}
+
 function resolveAssistantIndexPath(): string | undefined {
   // Source tree layout: cli/src/lib/ -> ../../.. -> repo root -> assistant/src/index.ts
   const sourceTreeIndex = join(
@@ -153,6 +166,49 @@ function resolveDaemonMainPath(assistantIndex: string): string {
 }
 
 async function startDaemonFromSource(assistantIndex: string): Promise<void> {
+  const daemonMainPath = resolveDaemonMainPath(assistantIndex);
+
+  const vellumDir = join(homedir(), ".vellum");
+  mkdirSync(vellumDir, { recursive: true });
+
+  const pidFile = join(vellumDir, "vellum.pid");
+  const socketFile = join(vellumDir, "vellum.sock");
+
+  // --- Lifecycle guard: prevent split-brain daemon state ---
+  if (existsSync(pidFile)) {
+    try {
+      const pid = parseInt(readFileSync(pidFile, "utf-8").trim(), 10);
+      if (!isNaN(pid)) {
+        try {
+          process.kill(pid, 0);
+          console.log(`   Assistant already running (pid ${pid})\n`);
+          return;
+        } catch {
+          try {
+            unlinkSync(pidFile);
+          } catch {}
+        }
+      }
+    } catch {}
+  }
+
+  if (await isSocketResponsive(socketFile)) {
+    const ownerPid = findSocketOwnerPid(socketFile);
+    if (ownerPid) {
+      writeFileSync(pidFile, String(ownerPid), "utf-8");
+      console.log(
+        `   Assistant socket is responsive (pid ${ownerPid}) — skipping restart\n`,
+      );
+    } else {
+      console.log("   Assistant socket is responsive — skipping restart\n");
+    }
+    return;
+  }
+
+  try {
+    unlinkSync(socketFile);
+  } catch {}
+
   const env: Record<string, string | undefined> = {
     ...process.env,
     RUNTIME_HTTP_PORT: process.env.RUNTIME_HTTP_PORT || "7821",
@@ -163,28 +219,30 @@ async function startDaemonFromSource(assistantIndex: string): Promise<void> {
       process.env.VELLUM_DAEMON_TCP_ENABLED || "1";
   }
 
-  const child = spawn("bun", ["run", assistantIndex, "daemon", "start"], {
-    stdio: "inherit",
+  // Use fd inheritance instead of pipes so the daemon's stdout/stderr survive
+  // after the parent (hatch) exits. Bun does not ignore SIGPIPE, so piped
+  // stdio would kill the daemon on its first write after the parent closes.
+  const logFd = openLogFile("hatch.log");
+  const child = spawn("bun", ["run", daemonMainPath], {
+    detached: true,
+    stdio: ["ignore", logFd, logFd],
     env,
   });
+  if (typeof logFd === "number") closeSync(logFd);
+  child.unref();
 
-  await new Promise<void>((resolve, reject) => {
-    child.on("close", (code) => {
-      if (code === 0) {
-        resolve();
-      } else {
-        reject(new Error(`Daemon start exited with code ${code}`));
-      }
-    });
-    child.on("error", reject);
-  });
+  if (child.pid) {
+    writeFileSync(pidFile, String(child.pid), "utf-8");
+  }
 }
 
 // NOTE: startDaemonWatchFromSource() is the CLI-side watch-mode daemon
 // launcher. Its lifecycle guards should eventually converge with
 // assistant/src/daemon/daemon-control.ts::startDaemon which is the
 // assistant-side equivalent.
-async function startDaemonWatchFromSource(assistantIndex: string): Promise<void> {
+async function startDaemonWatchFromSource(
+  assistantIndex: string,
+): Promise<void> {
   const mainPath = resolveDaemonMainPath(assistantIndex);
   if (!existsSync(mainPath)) {
     throw new Error(`Daemon main.ts not found at ${mainPath}`);
@@ -204,11 +262,13 @@ async function startDaemonWatchFromSource(assistantIndex: string): Promise<void>
       if (!isNaN(pid)) {
         try {
           process.kill(pid, 0); // Check if alive
-          console.log(`   Daemon already running (pid ${pid})\n`);
+          console.log(`   Assistant already running (pid ${pid})\n`);
           return;
         } catch {
           // Process doesn't exist, clean up stale PID file
-          try { unlinkSync(pidFile); } catch {}
+          try {
+            unlinkSync(pidFile);
+          } catch {}
         }
       }
     } catch {}
@@ -221,16 +281,18 @@ async function startDaemonWatchFromSource(assistantIndex: string): Promise<void>
     if (ownerPid) {
       writeFileSync(pidFile, String(ownerPid), "utf-8");
       console.log(
-        `   Daemon socket is responsive (pid ${ownerPid}) — skipping restart\n`,
+        `   Assistant socket is responsive (pid ${ownerPid}) — skipping restart\n`,
       );
     } else {
-      console.log("   Daemon socket is responsive — skipping restart\n");
+      console.log("   Assistant socket is responsive — skipping restart\n");
     }
     return;
   }
 
   // Socket is unresponsive or missing — safe to clean up and start fresh.
-  try { unlinkSync(socketFile); } catch {}
+  try {
+    unlinkSync(socketFile);
+  } catch {}
 
   const env: Record<string, string | undefined> = {
     ...process.env,
@@ -251,7 +313,7 @@ async function startDaemonWatchFromSource(assistantIndex: string): Promise<void>
     writeFileSync(pidFile, String(daemonPid), "utf-8");
   }
 
-  console.log("   Daemon started in watch mode (bun --watch)");
+  console.log("   Assistant started in watch mode (bun --watch)");
 }
 
 function resolveGatewayDir(): string {
@@ -292,6 +354,21 @@ function resolveGatewayDir(): string {
   }
 }
 
+function resolveOutboundProxyDir(): string | undefined {
+  // Compiled binary: outbound-proxy/ bundled adjacent to the CLI executable.
+  const binProxy = join(dirname(process.execPath), "outbound-proxy");
+  if (isOutboundProxySourceDir(binProxy)) {
+    return binProxy;
+  }
+
+  try {
+    const pkgPath = _require.resolve("@vellumai/outbound-proxy/package.json");
+    return dirname(pkgPath);
+  } catch {
+    return undefined;
+  }
+}
+
 function normalizeIngressUrl(value: unknown): string | undefined {
   if (typeof value !== "string") return undefined;
   const normalized = value.trim().replace(/\/+$/, "");
@@ -528,7 +605,7 @@ export async function startLocalDaemon(watch: boolean = false): Promise<void> {
           try {
             process.kill(pid, 0); // Check if alive
             daemonAlive = true;
-            console.log(`   Daemon already running (pid ${pid})\n`);
+            console.log(`   Assistant already running (pid ${pid})\n`);
           } catch {
             // Process doesn't exist, clean up stale PID file
             try {
@@ -550,10 +627,10 @@ export async function startLocalDaemon(watch: boolean = false): Promise<void> {
         if (ownerPid) {
           writeFileSync(pidFile, String(ownerPid), "utf-8");
           console.log(
-            `   Daemon socket is responsive (pid ${ownerPid}) — skipping restart\n`,
+            `   Assistant socket is responsive (pid ${ownerPid}) — skipping restart\n`,
           );
         } else {
-          console.log("   Daemon socket is responsive — skipping restart\n");
+          console.log("   Assistant socket is responsive — skipping restart\n");
         }
         return;
       }
@@ -563,7 +640,7 @@ export async function startLocalDaemon(watch: boolean = false): Promise<void> {
         unlinkSync(socketFile);
       } catch {}
 
-      console.log("🔨 Starting daemon...");
+      console.log("🔨 Starting assistant...");
 
       // Ensure ~/.vellum/ exists for PID/socket files
       mkdirSync(vellumDir, { recursive: true });
@@ -625,7 +702,7 @@ export async function startLocalDaemon(watch: boolean = false): Promise<void> {
       const assistantIndex = resolveAssistantIndexPath();
       if (assistantIndex) {
         console.log(
-          "   Bundled daemon socket not ready after 60s — falling back to source daemon...",
+          "   Bundled assistant socket not ready after 60s — falling back to source assistant...",
         );
         // Kill the bundled daemon to avoid two processes competing for the same socket/port
         await stopProcessByPidFile(pidFile, "bundled daemon", [socketFile]);
@@ -639,14 +716,14 @@ export async function startLocalDaemon(watch: boolean = false): Promise<void> {
     }
 
     if (socketReady) {
-      console.log("   Daemon socket ready\n");
+      console.log("   Assistant socket ready\n");
     } else {
       console.log(
-        "   ⚠️  Daemon socket did not appear within 60s — continuing anyway\n",
+        "   ⚠️  Assistant socket did not appear within 60s — continuing anyway\n",
       );
     }
   } else {
-    console.log("🔨 Starting local daemon...");
+    console.log("🔨 Starting local assistant...");
 
     const assistantIndex = resolveAssistantIndexPath();
     if (!assistantIndex) {
@@ -662,17 +739,33 @@ export async function startLocalDaemon(watch: boolean = false): Promise<void> {
       const socketFile = join(vellumDir, "vellum.sock");
       const socketReady = await waitForSocketFile(socketFile, 60000);
       if (socketReady) {
-        console.log("   Daemon socket ready\n");
+        console.log("   Assistant socket ready\n");
       } else {
-        console.log("   ⚠️  Daemon socket did not appear within 60s — continuing anyway\n");
+        console.log(
+          "   ⚠️  Assistant socket did not appear within 60s — continuing anyway\n",
+        );
       }
     } else {
       await startDaemonFromSource(assistantIndex);
+
+      const vellumDir = join(homedir(), ".vellum");
+      const socketFile = join(vellumDir, "vellum.sock");
+      const socketReady = await waitForSocketFile(socketFile, 60000);
+      if (socketReady) {
+        console.log("   Assistant socket ready\n");
+      } else {
+        console.log(
+          "   ⚠️  Assistant socket did not appear within 60s — continuing anyway\n",
+        );
+      }
     }
   }
 }
 
-export async function startGateway(assistantId?: string, watch: boolean = false): Promise<string> {
+export async function startGateway(
+  assistantId?: string,
+  watch: boolean = false,
+): Promise<string> {
   const publicUrl = await discoverPublicUrl();
   if (publicUrl) {
     console.log(`   Public URL: ${publicUrl}`);
@@ -856,10 +949,130 @@ export async function startGateway(assistantId?: string, watch: boolean = false)
   return gatewayUrl;
 }
 
+export async function startOutboundProxy(
+  watch: boolean = false,
+): Promise<void> {
+  const proxyDir = resolveOutboundProxyDir();
+  if (!proxyDir) {
+    console.log("   ⚠️  Outbound proxy not found — skipping");
+    return;
+  }
+
+  console.log("🔒 Starting outbound proxy...");
+
+  const vellumDir = join(homedir(), ".vellum");
+  mkdirSync(vellumDir, { recursive: true });
+
+  const pidFile = join(vellumDir, "outbound-proxy.pid");
+
+  // Check if already running
+  if (existsSync(pidFile)) {
+    try {
+      const pid = parseInt(readFileSync(pidFile, "utf-8").trim(), 10);
+      if (!isNaN(pid)) {
+        try {
+          process.kill(pid, 0);
+          console.log(`   Outbound proxy already running (pid ${pid})\n`);
+          return;
+        } catch {
+          try {
+            unlinkSync(pidFile);
+          } catch {}
+        }
+      }
+    } catch {}
+  }
+
+  const proxyEnv: Record<string, string> = {
+    ...(process.env as Record<string, string>),
+    PROXY_PORT: process.env.PROXY_PORT || "7829",
+    PROXY_HEALTH_PORT: process.env.PROXY_HEALTH_PORT || "7828",
+  };
+
+  const proxyLogFd = openLogFile("hatch.log");
+
+  let proxy;
+  if (process.env.VELLUM_DESKTOP_APP && !watch) {
+    const proxyBinary = join(
+      dirname(process.execPath),
+      "vellum-outbound-proxy",
+    );
+    if (!existsSync(proxyBinary)) {
+      console.log(
+        "   ⚠️  Outbound proxy binary not found — falling back to source",
+      );
+      const bunArgs = watch
+        ? ["--watch", "run", "src/main.ts"]
+        : ["run", "src/main.ts"];
+      proxy = spawn("bun", bunArgs, {
+        cwd: proxyDir,
+        detached: true,
+        stdio: ["ignore", "pipe", "pipe"],
+        env: proxyEnv,
+      });
+    } else {
+      proxy = spawn(proxyBinary, [], {
+        detached: true,
+        stdio: ["ignore", "pipe", "pipe"],
+        env: proxyEnv,
+      });
+    }
+  } else {
+    const bunArgs = watch
+      ? ["--watch", "run", "src/main.ts"]
+      : ["run", "src/main.ts"];
+    proxy = spawn("bun", bunArgs, {
+      cwd: proxyDir,
+      detached: true,
+      stdio: ["ignore", "pipe", "pipe"],
+      env: proxyEnv,
+    });
+  }
+
+  pipeToLogFile(proxy, proxyLogFd, "outbound-proxy");
+  proxy.unref();
+
+  if (proxy.pid) {
+    writeFileSync(pidFile, String(proxy.pid), "utf-8");
+  }
+
+  if (watch) {
+    console.log("   Outbound proxy started in watch mode (bun --watch)");
+  }
+
+  // Wait for the health endpoint to respond
+  const healthPort = Number(process.env.PROXY_HEALTH_PORT) || 7828;
+  const start = Date.now();
+  const timeoutMs = 15000;
+  let ready = false;
+  while (Date.now() - start < timeoutMs) {
+    try {
+      const res = await fetch(`http://localhost:${healthPort}/healthz`, {
+        signal: AbortSignal.timeout(2000),
+      });
+      if (res.ok) {
+        ready = true;
+        break;
+      }
+    } catch {
+      // Not ready yet
+    }
+    await new Promise((r) => setTimeout(r, 250));
+  }
+
+  if (!ready) {
+    console.warn(
+      "   ⚠️  Outbound proxy started but health check did not respond within 15s",
+    );
+  }
+
+  console.log("✅ Outbound proxy started\n");
+}
+
 /**
- * Stop any locally-running daemon and gateway processes and clean up
- * PID/socket files. Called when hatch fails partway through so we don't
- * leave orphaned processes with no lock file entry.
+ * Stop any locally-running daemon, gateway, and outbound-proxy processes
+ * and clean up PID/socket files. Called when hatch fails partway through
+ * so we don't leave orphaned processes with no lock file entry.
  */
 export async function stopLocalProcesses(): Promise<void> {
   const vellumDir = join(homedir(), ".vellum");
@@ -869,4 +1082,7 @@ export async function stopLocalProcesses(): Promise<void> {
 
   const gatewayPidFile = join(vellumDir, "gateway.pid");
   await stopProcessByPidFile(gatewayPidFile, "gateway");
+
+  const outboundProxyPidFile = join(vellumDir, "outbound-proxy.pid");
+  await stopProcessByPidFile(outboundProxyPidFile, "outbound-proxy");
 }

package/src/lib/ngrok.ts

@@ -158,9 +158,7 @@ export async function runNgrokTunnel(): Promise<void> {
     console.error("  macOS:  brew install ngrok/ngrok/ngrok");
     console.error("  Linux:  sudo snap install ngrok");
     console.error("");
-    console.error(
-      "Then authenticate: ngrok config add-authtoken <your-token>",
-    );
+    console.error("Then authenticate: ngrok config add-authtoken <your-token>");
     console.error(
       "  Get your token at: https://dashboard.ngrok.com/get-started/your-authtoken",
     );

package/src/lib/openclaw-runtime-server.ts

@@ -5,7 +5,9 @@
 
 export async function buildOpenclawRuntimeServer(): Promise<string> {
   try {
-    const serverSource = await Bun.file(import.meta.dir + "/../adapters/openclaw-http-server.ts").text();
+    const serverSource = await Bun.file(
+      import.meta.dir + "/../adapters/openclaw-http-server.ts",
+    ).text();
 
     return `
 cat > /opt/openclaw-runtime-server.ts << 'RUNTIME_SERVER_EOF'
@@ -17,7 +19,10 @@ nohup bun run /opt/openclaw-runtime-server.ts >> "\$HOME/.vellum/http-gateway.lo
 echo "OpenClaw runtime server started (PID: \$!)"
 `;
   } catch (err) {
-    console.warn("⚠️  Could not embed openclaw runtime server (expected in compiled binary without --embed):", (err as Error).message);
+    console.warn(
+      "⚠️  Could not embed openclaw runtime server (expected in compiled binary without --embed):",
+      (err as Error).message,
+    );
     return "# openclaw-runtime-server: skipped (source files not available in compiled binary)";
   }
 }

package/src/lib/platform-client.ts

@@ -1,4 +1,11 @@
-import { chmodSync, readFileSync, writeFileSync, unlinkSync, existsSync, mkdirSync } from "fs";
+import {
+  chmodSync,
+  readFileSync,
+  writeFileSync,
+  unlinkSync,
+  existsSync,
+  mkdirSync,
+} from "fs";
 import { homedir } from "os";
 import { join, dirname } from "path";
 
@@ -63,10 +70,16 @@ export async function fetchCurrentUser(token: string): Promise<PlatformUser> {
   });
 
   if (!response.ok) {
-    if (response.status === 401 || response.status === 403 || response.status === 410) {
+    if (
+      response.status === 401 ||
+      response.status === 403 ||
+      response.status === 410
+    ) {
       throw new Error("Invalid or expired token. Please login again.");
     }
-    throw new Error(`Platform API error: ${response.status} ${response.statusText}`);
+    throw new Error(
+      `Platform API error: ${response.status} ${response.statusText}`,
+    );
   }
 
   const body = (await response.json()) as AllauthSessionResponse;

package/src/lib/xdg-log.ts

@@ -26,14 +26,22 @@ export function openLogFile(name: string): number | "ignore" {
 /** Close a file descriptor returned by openLogFile (no-op for "ignore"). */
 export function closeLogFile(fd: number | "ignore"): void {
   if (typeof fd === "number") {
-    try { closeSync(fd); } catch { /* best-effort */ }
+    try {
+      closeSync(fd);
+    } catch {
+      /* best-effort */
+    }
   }
 }
 
 /** Write a string to a file descriptor returned by openLogFile (no-op for "ignore"). */
 export function writeToLogFile(fd: number | "ignore", msg: string): void {
   if (typeof fd === "number") {
-    try { writeSync(fd, msg); } catch { /* best-effort */ }
+    try {
+      writeSync(fd, msg);
+    } catch {
+      /* best-effort */
+    }
   }
 }
 
@@ -41,7 +49,11 @@ export function writeToLogFile(fd: number | "ignore", msg: string): void {
  *  prefixing each line with a tag (e.g. "[daemon]" or "[gateway]").
  *  Streams are unref'd so they don't prevent the parent from exiting.
  *  The fd is closed automatically when both streams end. */
-export function pipeToLogFile(child: ChildProcess, fd: number | "ignore", tag: string): void {
+export function pipeToLogFile(
+  child: ChildProcess,
+  fd: number | "ignore",
+  tag: string,
+): void {
   if (fd === "ignore") return;
   const numFd: number = fd;
   const tagLabel = `[${tag}]`;
@@ -51,7 +63,11 @@ export function pipeToLogFile(child: ChildProcess, fd: number | "ignore", tag: s
   function onDone() {
     ended++;
     if (ended >= streams.length) {
-      try { closeSync(numFd); } catch { /* best-effort */ }
+      try {
+        closeSync(numFd);
+      } catch {
+        /* best-effort */
+      }
     }
   }
 
@@ -65,7 +81,11 @@ export function pipeToLogFile(child: ChildProcess, fd: number | "ignore", tag: s
         if (i === lines.length - 1 && lines[i] === "") break;
         const nl = i < lines.length - 1 ? "\n" : "";
         const prefix = `${new Date().toISOString()} ${tagLabel} `;
-        try { writeSync(numFd, prefix + lines[i] + nl); } catch { /* best-effort */ }
+        try {
+          writeSync(numFd, prefix + lines[i] + nl);
+        } catch {
+          /* best-effort */
+        }
       }
     });
     stream.on("end", onDone);