@vellumai/cli 0.4.31 → 0.4.33

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vellumai/cli",
-  "version": "0.4.31",
+  "version": "0.4.33",
   "description": "CLI tools for vellum-assistant",
   "type": "module",
   "exports": {

package/src/commands/client.ts

@@ -1,6 +1,3 @@
-import { readFileSync } from "fs";
-import { join } from "path";
-
 import {
   findAssistantByName,
   loadLatestAssistant,
@@ -60,21 +57,8 @@ function parseArgs(): ParsedArgs {
     process.env.RUNTIME_URL || entry?.runtimeUrl || FALLBACK_RUNTIME_URL;
   let assistantId =
     process.env.ASSISTANT_ID || entry?.assistantId || FALLBACK_ASSISTANT_ID;
-  let bearerToken =
+  const bearerToken =
     process.env.RUNTIME_PROXY_BEARER_TOKEN || entry?.bearerToken || undefined;
-
-  // For local assistants, read the daemon's http-token file as a fallback
-  // when the lockfile doesn't include a bearer token.
-  if (!bearerToken && entry?.cloud === "local") {
-    const tokenDir =
-      entry.baseDataDir ?? join(process.env.HOME ?? "", ".vellum");
-    try {
-      const token = readFileSync(join(tokenDir, "http-token"), "utf-8").trim();
-      if (token) bearerToken = token;
-    } catch {
-      // Token file may not exist
-    }
-  }
   const species: Species = (entry?.species as Species) ?? "vellum";
 
   for (let i = 0; i < flagArgs.length; i++) {

package/src/commands/contacts.ts

@@ -1,7 +1,3 @@
-import { existsSync, readFileSync } from "node:fs";
-import { homedir } from "node:os";
-import { join } from "node:path";
-
 import { loadLatestAssistant } from "../lib/assistant-config";
 import { GATEWAY_PORT } from "../lib/constants.js";
 
@@ -17,21 +13,7 @@ function getGatewayUrl(): string {
 
 function getBearerToken(): string | undefined {
   const entry = loadLatestAssistant();
-  if (entry?.bearerToken) return entry.bearerToken;
-  try {
-    const tokenPath = join(
-      process.env.BASE_DATA_DIR?.trim() || homedir(),
-      ".vellum",
-      "http-token",
-    );
-    if (existsSync(tokenPath)) {
-      const token = readFileSync(tokenPath, "utf-8").trim();
-      if (token) return token;
-    }
-  } catch {
-    // ignore
-  }
-  return undefined;
+  return entry?.bearerToken;
 }
 
 function buildHeaders(): Record<string, string> {

package/src/commands/hatch.ts

@@ -756,8 +756,8 @@ async function hatchLocal(
     throw error;
   }
 
-  // Read the bearer token written by the daemon so the client can authenticate
-  // with the gateway (which requires auth by default).
+  // Read the bearer token (JWT) written by the daemon so the CLI can
+  // authenticate with the gateway.
   let bearerToken: string | undefined;
   try {
     const token = readFileSync(join(baseDataDir, "http-token"), "utf-8").trim();

package/src/commands/ps.ts

@@ -403,7 +403,7 @@ async function listAllAssistants(): Promise<void> {
 
   await Promise.all(
     assistants.map(async (a, rowIndex) => {
-      const health = await checkHealth(a.runtimeUrl);
+      const health = await checkHealth(a.runtimeUrl, a.bearerToken);
 
       const infoParts = [a.runtimeUrl];
       if (a.cloud) infoParts.push(`cloud: ${a.cloud}`);

package/src/commands/retire.ts

@@ -56,9 +56,10 @@ async function retireLocal(name: string, entry: AssistantEntry): Promise<void> {
     socketFile,
   ]);
 
-  // Stop gateway via PID file
+  // Stop gateway via PID file — use a longer timeout because the gateway has a
+  // configurable drain window (GATEWAY_SHUTDOWN_DRAIN_MS, default 5s) before it exits.
   const gatewayPidFile = join(vellumDir, "gateway.pid");
-  await stopProcessByPidFile(gatewayPidFile, "gateway");
+  await stopProcessByPidFile(gatewayPidFile, "gateway", undefined, 7000);
 
   // If the PID file didn't track a running daemon, scan for orphaned
   // daemon processes that may have been started without writing a PID.

package/src/commands/sleep.ts

@@ -27,8 +27,14 @@ export async function sleep(): Promise<void> {
     console.log("Assistant stopped.");
   }
 
-  // Stop gateway
-  const gatewayStopped = await stopProcessByPidFile(gatewayPidFile, "gateway");
+  // Stop gateway — use a longer timeout because the gateway has a configurable
+  // drain window (GATEWAY_SHUTDOWN_DRAIN_MS, default 5s) before it exits.
+  const gatewayStopped = await stopProcessByPidFile(
+    gatewayPidFile,
+    "gateway",
+    undefined,
+    7000,
+  );
   if (!gatewayStopped) {
     console.log("Gateway is not running.");
   } else {

package/src/lib/gcp.ts

@@ -198,58 +198,6 @@ export async function syncFirewallRules(
   }
 }
 
-export async function fetchFirewallRules(
-  project: string,
-  tag: string,
-): Promise<string> {
-  const output = await execOutput("gcloud", [
-    "compute",
-    "firewall-rules",
-    "list",
-    `--project=${project}`,
-    "--format=json",
-  ]);
-  const rules = JSON.parse(output) as Array<{ targetTags?: string[] }>;
-  const filtered = rules.filter((r) => r.targetTags?.includes(tag));
-  return JSON.stringify(filtered, null, 2);
-}
-
-export interface GcpInstance {
-  name: string;
-  zone: string;
-  externalIp: string | null;
-  species: string | null;
-}
-
-export async function listAssistantInstances(
-  project: string,
-): Promise<GcpInstance[]> {
-  const output = await execOutput("gcloud", [
-    "compute",
-    "instances",
-    "list",
-    `--project=${project}`,
-    "--filter=labels.vellum-assistant=true",
-    "--format=json(name,zone,networkInterfaces[0].accessConfigs[0].natIP,labels)",
-  ]);
-  const parsed = JSON.parse(output) as Array<{
-    name: string;
-    zone: string;
-    networkInterfaces?: Array<{ accessConfigs?: Array<{ natIP?: string }> }>;
-    labels?: Record<string, string>;
-  }>;
-  return parsed.map((inst) => {
-    const zoneParts = (inst.zone ?? "").split("/");
-    return {
-      name: inst.name,
-      zone: zoneParts[zoneParts.length - 1] || "",
-      externalIp:
-        inst.networkInterfaces?.[0]?.accessConfigs?.[0]?.natIP ?? null,
-      species: inst.labels?.species ?? null,
-    };
-  });
-}
-
 export async function instanceExists(
   instanceName: string,
   project: string,
@@ -281,27 +229,6 @@ export async function instanceExists(
   }
 }
 
-export async function sshCommand(
-  instanceName: string,
-  project: string,
-  zone: string,
-  command: string,
-): Promise<string> {
-  return execOutput("gcloud", [
-    "compute",
-    "ssh",
-    instanceName,
-    `--project=${project}`,
-    `--zone=${zone}`,
-    "--quiet",
-    "--ssh-flag=-o StrictHostKeyChecking=no",
-    "--ssh-flag=-o UserKnownHostsFile=/dev/null",
-    "--ssh-flag=-o ConnectTimeout=5",
-    "--ssh-flag=-o LogLevel=ERROR",
-    `--command=${command}`,
-  ]);
-}
-
 export async function fetchAndDisplayStartupLogs(
   instanceName: string,
   project: string,

package/src/lib/health-check.ts

@@ -12,18 +12,26 @@ export interface HealthCheckResult {
 
 export async function checkHealth(
   runtimeUrl: string,
+  bearerToken?: string,
 ): Promise<HealthCheckResult> {
   try {
-    const url = `${runtimeUrl}/healthz`;
+    const url = `${runtimeUrl}/v1/health`;
     const controller = new AbortController();
     const timeoutId = setTimeout(
       () => controller.abort(),
       HEALTH_CHECK_TIMEOUT_MS,
     );
 
+    const headers: Record<string, string> = {
+      "Content-Type": "application/json",
+    };
+    if (bearerToken) {
+      headers["Authorization"] = `Bearer ${bearerToken}`;
+    }
+
     const response = await fetch(url, {
       signal: controller.signal,
-      headers: { "Content-Type": "application/json" },
+      headers,
     });
 
     clearTimeout(timeoutId);

package/src/lib/local.ts

@@ -1,4 +1,4 @@
-import { execFileSync, spawn } from "child_process";
+import { execFileSync, execSync, spawn } from "child_process";
 import {
   closeSync,
   existsSync,
@@ -149,6 +149,63 @@ async function waitForSocketFile(
   return existsSync(socketPath);
 }
 
+function ensureBunInstalled(): void {
+  const bunBinDir = join(homedir(), ".bun", "bin");
+  const pathWithBun = [
+    bunBinDir,
+    process.env.PATH || "/usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin",
+  ].join(":");
+
+  try {
+    execFileSync("bun", ["--version"], {
+      stdio: "pipe",
+      env: { ...process.env, PATH: pathWithBun },
+    });
+    return;
+  } catch {
+    // bun not found, try to install
+  }
+
+  console.log("   Installing bun...");
+  try {
+    const installEnv: Record<string, string> = {
+      HOME: process.env.HOME || homedir(),
+      PATH: process.env.PATH || "/usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin",
+      TMPDIR: process.env.TMPDIR || "/tmp",
+      USER: process.env.USER || "",
+      LANG: process.env.LANG || "",
+    };
+    // Preserve proxy/TLS env vars so curl works in proxied/corporate environments
+    for (const key of [
+      "HTTP_PROXY",
+      "http_proxy",
+      "HTTPS_PROXY",
+      "https_proxy",
+      "ALL_PROXY",
+      "all_proxy",
+      "NO_PROXY",
+      "no_proxy",
+      "SSL_CERT_FILE",
+      "SSL_CERT_DIR",
+      "CURL_CA_BUNDLE",
+    ]) {
+      if (process.env[key]) {
+        installEnv[key] = process.env[key]!;
+      }
+    }
+    execSync("curl -fsSL https://bun.sh/install | bash", {
+      stdio: "pipe",
+      timeout: 60_000,
+      env: installEnv,
+    });
+    console.log("   Bun installed successfully");
+  } catch {
+    console.log(
+      "   ⚠️  Failed to install bun — some features may be unavailable",
+    );
+  }
+}
+
 function resolveDaemonMainPath(assistantIndex: string): string {
   return join(dirname(assistantIndex), "daemon", "main.ts");
 }
@@ -605,6 +662,9 @@ export async function startLocalDaemon(watch: boolean = false): Promise<void> {
         } else {
           console.log("   Assistant socket is responsive — skipping restart\n");
         }
+        // Ensure bun is available for runtime features (browser, skills install)
+        // even when reusing an existing daemon.
+        ensureBunInstalled();
         return;
       }
 
@@ -615,6 +675,9 @@ export async function startLocalDaemon(watch: boolean = false): Promise<void> {
 
       console.log("🔨 Starting assistant...");
 
+      // Ensure bun is available for runtime features (browser, skills install)
+      ensureBunInstalled();
+
       // Ensure ~/.vellum/ exists for PID/socket files
       mkdirSync(vellumDir, { recursive: true });
 
@@ -622,10 +685,12 @@ export async function startLocalDaemon(watch: boolean = false): Promise<void> {
       // macOS app the CLI inherits a huge environment (XPC_SERVICE_NAME,
       // __CFBundleIdentifier, CLAUDE_CODE_ENTRYPOINT, etc.) that can cause
       // the daemon to take 50+ seconds to start instead of ~1s.
+      const bunBinDir = join(homedir(), ".bun", "bin");
+      const basePath =
+        process.env.PATH || "/usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin";
       const daemonEnv: Record<string, string> = {
         HOME: process.env.HOME || homedir(),
-        PATH:
-          process.env.PATH || "/usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin",
+        PATH: `${bunBinDir}:${basePath}`,
         VELLUM_DAEMON_TCP_ENABLED: "1",
       };
       // Forward optional config env vars the daemon may need
@@ -647,14 +712,18 @@ export async function startLocalDaemon(watch: boolean = false): Promise<void> {
         }
       }
 
+      // Use fd inheritance instead of pipes so the daemon's stdout/stderr
+      // survive after the parent (hatch) exits. Bun does not ignore SIGPIPE,
+      // so piped stdio would kill the daemon on its first write after the
+      // parent closes.
       const daemonLogFd = openLogFile("hatch.log");
       const child = spawn(daemonBinary, [], {
         cwd: dirname(daemonBinary),
         detached: true,
-        stdio: ["ignore", "pipe", "pipe"],
+        stdio: ["ignore", daemonLogFd, daemonLogFd],
         env: daemonEnv,
       });
-      pipeToLogFile(child, daemonLogFd, "daemon");
+      if (typeof daemonLogFd === "number") closeSync(daemonLogFd);
       child.unref();
       const daemonPid = child.pid;
 
@@ -665,6 +734,13 @@ export async function startLocalDaemon(watch: boolean = false): Promise<void> {
       }
     }
 
+    // Ensure bun is available for runtime features (browser, skills install)
+    // Runs after daemon-reuse checks so the fast attach path is not blocked
+    // by a potentially slow bun install when the daemon is already alive.
+    if (daemonAlive) {
+      ensureBunInstalled();
+    }
+
     // Wait for socket at ~/.vellum/vellum.sock (up to 60s — fresh installs
     // may need 30-60s for Qdrant download, migrations, and first-time init)
     let socketReady = await waitForSocketFile(socketFile, 60000);
@@ -753,74 +829,16 @@ export async function startGateway(
     process.env.GATEWAY_DEFAULT_ASSISTANT_ID ||
     loadLatestAssistant()?.assistantId;
 
-  // Read the bearer token so the gateway can authenticate proxied requests
-  // (e.g. from paired iOS devices). Respect VELLUM_HTTP_TOKEN_PATH and
-  // BASE_DATA_DIR for consistency with gateway/config.ts and the daemon.
-  const httpTokenPath =
-    process.env.VELLUM_HTTP_TOKEN_PATH ??
-    join(
-      process.env.BASE_DATA_DIR?.trim() || homedir(),
-      ".vellum",
-      "http-token",
-    );
-  let runtimeProxyBearerToken: string | undefined;
-  try {
-    const tok = readFileSync(httpTokenPath, "utf-8").trim();
-    if (tok) runtimeProxyBearerToken = tok;
-  } catch {
-    // Token file doesn't exist yet — daemon hasn't written it.
-  }
-
-  // If no token is available (first startup — daemon hasn't written it yet),
-  // poll for the file to appear. On fresh installs the daemon may take 60s+
-  // for Qdrant download, migrations, and first-time init. Starting the
-  // gateway without auth is a security risk since the config is loaded once
-  // at startup and never reloads, so we fail rather than silently disabling auth.
-  if (!runtimeProxyBearerToken) {
-    console.log("   Waiting for bearer token file...");
-    const maxWait = 60000;
-    const pollInterval = 500;
-    const start = Date.now();
-    const pidFile = join(
-      process.env.BASE_DATA_DIR?.trim() || homedir(),
-      ".vellum",
-      "vellum.pid",
-    );
-    while (Date.now() - start < maxWait) {
-      await new Promise((r) => setTimeout(r, pollInterval));
-      try {
-        const tok = readFileSync(httpTokenPath, "utf-8").trim();
-        if (tok) {
-          runtimeProxyBearerToken = tok;
-          break;
-        }
-      } catch {
-        // File still doesn't exist, keep polling.
-      }
-      // Check if the daemon process is still alive — no point waiting if it crashed
-      try {
-        const pid = parseInt(readFileSync(pidFile, "utf-8").trim(), 10);
-        if (pid) process.kill(pid, 0); // throws if process doesn't exist
-      } catch {
-        break; // daemon process is gone
-      }
-    }
-  }
-
-  if (!runtimeProxyBearerToken) {
-    throw new Error(
-      `Bearer token file not found at ${httpTokenPath} after 60s.\n` +
-        "  The gateway cannot start without authentication — this would leave the proxy permanently unauthenticated.\n" +
-        "  Ensure the daemon is running and has written the token file, or set VELLUM_HTTP_TOKEN_PATH to the correct path.",
-    );
-  }
-
   const gatewayEnv: Record<string, string> = {
     ...(process.env as Record<string, string>),
     GATEWAY_RUNTIME_PROXY_ENABLED: "true",
     GATEWAY_RUNTIME_PROXY_REQUIRE_AUTH: "true",
-    RUNTIME_PROXY_BEARER_TOKEN: runtimeProxyBearerToken,
     RUNTIME_HTTP_PORT: process.env.RUNTIME_HTTP_PORT || "7821",
+    // Skip the drain window for locally-launched gateways — there is no load
+    // balancer draining connections, so waiting serves no purpose and causes
+    // `vellum sleep` to SIGKILL the gateway when the CLI timeout is shorter
+    // than the drain window.  Respect an explicit env override.
+    GATEWAY_SHUTDOWN_DRAIN_MS: process.env.GATEWAY_SHUTDOWN_DRAIN_MS || "0",
   };
 
   if (process.env.GATEWAY_UNMAPPED_POLICY) {
@@ -856,13 +874,15 @@ export async function startGateway(
       );
     }
 
+    // Use fd inheritance (not pipes) so the gateway survives after the
+    // hatch CLI exits — Bun does not ignore SIGPIPE.
     const gatewayLogFd = openLogFile("hatch.log");
     gateway = spawn(gatewayBinary, [], {
       detached: true,
-      stdio: ["ignore", "pipe", "pipe"],
+      stdio: ["ignore", gatewayLogFd, gatewayLogFd],
       env: gatewayEnv,
     });
-    pipeToLogFile(gateway, gatewayLogFd, "gateway");
+    if (typeof gatewayLogFd === "number") closeSync(gatewayLogFd);
   } else {
     // Source tree / bunx: resolve the gateway source directory and run via bun.
     const gatewayDir = resolveGatewayDir();
@@ -873,10 +893,10 @@ export async function startGateway(
     gateway = spawn("bun", bunArgs, {
       cwd: gatewayDir,
       detached: true,
-      stdio: ["ignore", "pipe", "pipe"],
+      stdio: ["ignore", gwLogFd, gwLogFd],
       env: gatewayEnv,
     });
-    pipeToLogFile(gateway, gwLogFd, "gateway");
+    if (typeof gwLogFd === "number") closeSync(gwLogFd);
     if (watch) {
       console.log("   Gateway started in watch mode (bun --watch)");
     }
@@ -934,6 +954,5 @@ export async function stopLocalProcesses(): Promise<void> {
   await stopProcessByPidFile(daemonPidFile, "daemon", [socketFile]);
 
   const gatewayPidFile = join(vellumDir, "gateway.pid");
-  await stopProcessByPidFile(gatewayPidFile, "gateway");
-
+  await stopProcessByPidFile(gatewayPidFile, "gateway", undefined, 7000);
 }

package/src/lib/process.ts

@@ -45,12 +45,13 @@ export function isProcessAlive(pidFile: string): {
 }
 
 /**
- * Stop a process by PID: SIGTERM, wait up to 2s, then SIGKILL if still alive.
+ * Stop a process by PID: SIGTERM, wait up to `timeoutMs`, then SIGKILL if still alive.
  * Returns true if the process was stopped, false if it wasn't alive.
  */
 export async function stopProcess(
   pid: number,
   label: string,
+  timeoutMs: number = 2000,
 ): Promise<boolean> {
   try {
     process.kill(pid, 0);
@@ -61,7 +62,7 @@ export async function stopProcess(
   console.log(`Stopping ${label} (pid ${pid})...`);
   process.kill(pid, "SIGTERM");
 
-  const deadline = Date.now() + 2000;
+  const deadline = Date.now() + timeoutMs;
   while (Date.now() < deadline) {
     try {
       process.kill(pid, 0);
@@ -90,6 +91,7 @@ export async function stopProcessByPidFile(
   pidFile: string,
   label: string,
   cleanupFiles?: string[],
+  timeoutMs?: number,
 ): Promise<boolean> {
   const { alive, pid } = isProcessAlive(pidFile);
 
@@ -129,7 +131,7 @@ export async function stopProcessByPidFile(
     return false;
   }
 
-  const stopped = await stopProcess(pid, label);
+  const stopped = await stopProcess(pid, label, timeoutMs);
 
   try {
     unlinkSync(pidFile);

package/src/lib/step-runner.ts

@@ -1,46 +1,5 @@
 import { spawn } from "child_process";
 
-const SPINNER_FRAMES = ["⠋", "⠙", "⠹", "⠸", "⠼", "⠴", "⠦", "⠧", "⠇", "⠏"];
-
-interface Step {
-  name: string;
-  run: () => Promise<void>;
-}
-
-export function clearLine(): void {
-  process.stdout.write("\r\x1b[K");
-}
-
-export function showSpinner(name: string): NodeJS.Timeout {
-  let frameIndex = 0;
-  return setInterval(() => {
-    clearLine();
-    process.stdout.write(`  ${SPINNER_FRAMES[frameIndex]} ${name}...`);
-    frameIndex = (frameIndex + 1) % SPINNER_FRAMES.length;
-  }, 80);
-}
-
-export async function runSteps(steps: Step[]): Promise<void> {
-  for (let i = 0; i < steps.length; i++) {
-    const step = steps[i];
-    const label = `[${i + 1}/${steps.length}] ${step.name}`;
-
-    const spinner = showSpinner(label);
-
-    try {
-      await step.run();
-      clearInterval(spinner);
-      clearLine();
-      console.log(`  ✔ ${label}`);
-    } catch (error) {
-      clearInterval(spinner);
-      clearLine();
-      console.log(`  ✖ ${label}`);
-      throw error;
-    }
-  }
-}
-
 export function exec(
   command: string,
   args: string[],