@vellumai/cli 0.4.43 → 0.4.45

package/src/lib/docker.ts

@@ -10,7 +10,12 @@ import type { Species } from "./constants";
 import { discoverPublicUrl } from "./local";
 import { generateRandomSuffix } from "./random-name";
 import { exec, execOutput } from "./step-runner";
-import { closeLogFile, openLogFile, writeToLogFile } from "./xdg-log";
+import {
+  closeLogFile,
+  openLogFile,
+  resetLogFile,
+  writeToLogFile,
+} from "./xdg-log";
 
 const _require = createRequire(import.meta.url);
 
@@ -50,6 +55,12 @@ function findDockerRoot(): DockerRoot {
     dir = parent;
   }
 
+  // macOS app bundle: Contents/MacOS/vellum-cli -> Contents/Resources/Dockerfile
+  const appResourcesDir = join(dirname(process.execPath), "..", "Resources");
+  if (existsSync(join(appResourcesDir, "Dockerfile"))) {
+    return { root: appResourcesDir, dockerfileDir: "." };
+  }
+
   // Fall back to Node module resolution for the `vellum` package
   try {
     const vellumPkgPath = _require.resolve("vellum/package.json");
@@ -152,14 +163,38 @@ export async function hatchDocker(
   name: string | null,
   watch: boolean,
 ): Promise<void> {
-  const { root: repoRoot, dockerfileDir } = findDockerRoot();
+  resetLogFile("hatch.log");
+
+  let repoRoot: string;
+  let dockerfileDir: string;
+  try {
+    ({ root: repoRoot, dockerfileDir } = findDockerRoot());
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    const logFd = openLogFile("hatch.log");
+    writeToLogFile(
+      logFd,
+      `[docker-hatch] ${new Date().toISOString()} ERROR\n${message}\n`,
+    );
+    closeLogFile(logFd);
+    console.error(message);
+    throw err;
+  }
+
   const instanceName = name ?? `${species}-${generateRandomSuffix()}`;
   const dockerfileName = watch ? "Dockerfile.development" : "Dockerfile";
   const dockerfile = join(dockerfileDir, dockerfileName);
   const dockerfilePath = join(repoRoot, dockerfile);
 
   if (!existsSync(dockerfilePath)) {
-    console.error(`Error: ${dockerfile} not found at ${dockerfilePath}`);
+    const message = `Error: ${dockerfile} not found at ${dockerfilePath}`;
+    const logFd = openLogFile("hatch.log");
+    writeToLogFile(
+      logFd,
+      `[docker-hatch] ${new Date().toISOString()} ERROR\n${message}\n`,
+    );
+    closeLogFile(logFd);
+    console.error(message);
     process.exit(1);
   }
 
@@ -180,7 +215,10 @@ export async function hatchDocker(
     });
   } catch (err) {
     const message = err instanceof Error ? err.message : String(err);
-    writeToLogFile(logFd, `[docker-build] ${new Date().toISOString()} ERROR\n${message}\n`);
+    writeToLogFile(
+      logFd,
+      `[docker-build] ${new Date().toISOString()} ERROR\n${message}\n`,
+    );
     closeLogFile(logFd);
     throw err;
   }
@@ -242,13 +280,21 @@ export async function hatchDocker(
   // requires an extra argument the Dockerfile doesn't include.
   const containerCmd: string[] =
     species !== "vellum"
-      ? ["vellum", "hatch", species, ...(watch ? ["--watch"] : []), "--keep-alive"]
+      ? [
+          "vellum",
+          "hatch",
+          species,
+          ...(watch ? ["--watch"] : []),
+          "--keep-alive",
+        ]
       : [];
 
   // Always start the container detached so it keeps running after the CLI exits.
   runArgs.push("-d");
   console.log("🚀 Starting Docker container...");
-  await exec("docker", [...runArgs, imageTag, ...containerCmd], { cwd: repoRoot });
+  await exec("docker", [...runArgs, imageTag, ...containerCmd], {
+    cwd: repoRoot,
+  });
 
   if (detached) {
     console.log("\n✅ Docker assistant hatched!\n");
@@ -302,7 +348,13 @@ export async function hatchDocker(
       child.on("close", (code) => {
         // The log tail may exit if the container stops before the sentinel
         // is seen, or we killed it after detecting the sentinel.
-        if (code === 0 || code === null || code === 130 || code === 137 || code === 143) {
+        if (
+          code === 0 ||
+          code === null ||
+          code === 130 ||
+          code === 137 ||
+          code === 143
+        ) {
           resolve();
         } else {
           reject(new Error(`Docker container exited with code ${code}`));

package/src/lib/gcp.ts

@@ -441,45 +441,6 @@ async function recoverFromCurlFailure(
   } catch {}
 }
 
-async function fetchRemoteBearerToken(
-  instanceName: string,
-  project: string,
-  zone: string,
-  sshUser: string,
-  account?: string,
-): Promise<string | null> {
-  try {
-    const remoteCmd =
-      'cat ~/.vellum.lock.json 2>/dev/null || cat ~/.vellum.lockfile.json 2>/dev/null || echo "{}"';
-    const args = [
-      "compute",
-      "ssh",
-      `${sshUser}@${instanceName}`,
-      `--project=${project}`,
-      `--zone=${zone}`,
-      "--quiet",
-      "--ssh-flag=-o StrictHostKeyChecking=no",
-      "--ssh-flag=-o UserKnownHostsFile=/dev/null",
-      "--ssh-flag=-o ConnectTimeout=10",
-      "--ssh-flag=-o LogLevel=ERROR",
-      `--command=${remoteCmd}`,
-    ];
-    if (account) args.push(`--account=${account}`);
-    const output = await execOutput("gcloud", args);
-    const data = JSON.parse(output.trim());
-    const assistants = data.assistants;
-    if (Array.isArray(assistants) && assistants.length > 0) {
-      const token = assistants[0].bearerToken;
-      if (typeof token === "string" && token) {
-        return token;
-      }
-    }
-    return null;
-  } catch {
-    return null;
-  }
-}
-
 export async function hatchGcp(
   species: Species,
   detached: boolean,
@@ -629,7 +590,6 @@ export async function hatchGcp(
     const gcpEntry: AssistantEntry = {
       assistantId: instanceName,
       runtimeUrl,
-      bearerToken,
       cloud: "gcp",
       project,
       zone,
@@ -694,18 +654,6 @@ export async function hatchGcp(
         }
       }
 
-      const remoteBearerToken = await fetchRemoteBearerToken(
-        instanceName,
-        project,
-        zone,
-        sshUser,
-        account,
-      );
-      if (remoteBearerToken) {
-        gcpEntry.bearerToken = remoteBearerToken;
-        saveAssistantEntry(gcpEntry);
-      }
-
       console.log("Instance details:");
       console.log(`  Name: ${instanceName}`);
       console.log(`  Project: ${project}`);

package/src/lib/local.ts

@@ -1,6 +1,5 @@
 import { execFileSync, execSync, spawn } from "child_process";
 import {
-  closeSync,
   existsSync,
   mkdirSync,
   readFileSync,
@@ -258,16 +257,13 @@ async function startDaemonFromSource(
     delete env.QDRANT_URL;
   }
 
-  // Use fd inheritance instead of pipes so the daemon's stdout/stderr survive
-  // after the parent (hatch) exits. Bun does not ignore SIGPIPE, so piped
-  // stdio would kill the daemon on its first write after the parent closes.
-  const logFd = openLogFile("hatch.log");
+  const daemonLogFd = openLogFile("hatch.log");
   const child = spawn("bun", ["run", daemonMainPath], {
     detached: true,
-    stdio: ["ignore", logFd, logFd],
+    stdio: ["ignore", "pipe", "pipe"],
     env,
   });
-  if (typeof logFd === "number") closeSync(logFd);
+  pipeToLogFile(child, daemonLogFd, "daemon");
   child.unref();
 
   if (child.pid) {
@@ -472,7 +468,9 @@ function recoverPidFile(
   return pid;
 }
 
-export async function discoverPublicUrl(port?: number): Promise<string | undefined> {
+export async function discoverPublicUrl(
+  port?: number,
+): Promise<string | undefined> {
   const effectivePort = port ?? GATEWAY_PORT;
   const cloud = process.env.VELLUM_CLOUD;
 
@@ -714,18 +712,14 @@ export async function startLocalDaemon(
         delete daemonEnv.QDRANT_URL;
       }
 
-      // Use fd inheritance instead of pipes so the daemon's stdout/stderr
-      // survive after the parent (hatch) exits. Bun does not ignore SIGPIPE,
-      // so piped stdio would kill the daemon on its first write after the
-      // parent closes.
       const daemonLogFd = openLogFile("hatch.log");
       const child = spawn(daemonBinary, [], {
         cwd: dirname(daemonBinary),
         detached: true,
-        stdio: ["ignore", daemonLogFd, daemonLogFd],
+        stdio: ["ignore", "pipe", "pipe"],
         env: daemonEnv,
       });
-      if (typeof daemonLogFd === "number") closeSync(daemonLogFd);
+      pipeToLogFile(child, daemonLogFd, "daemon");
       child.unref();
       const daemonPid = child.pid;
 
@@ -816,6 +810,16 @@ export async function startGateway(
 ): Promise<string> {
   const effectiveGatewayPort = resources?.gatewayPort ?? GATEWAY_PORT;
 
+  // Kill any existing gateway process before spawning a new one.
+  // Without this, crashed/stale gateways accumulate as zombies — the old
+  // process holds the port (or lingers after losing it), and every restart
+  // attempt spawns yet another process that fails with EADDRINUSE.
+  const gwPidDir = resources
+    ? join(resources.instanceDir, ".vellum")
+    : join(homedir(), ".vellum");
+  const gwPidFile = join(gwPidDir, "gateway.pid");
+  await stopProcessByPidFile(gwPidFile, "gateway");
+
   const publicUrl = await discoverPublicUrl(effectiveGatewayPort);
   if (publicUrl) {
     console.log(`   Public URL: ${publicUrl}`);
@@ -952,15 +956,13 @@ export async function startGateway(
       );
     }
 
-    // Use fd inheritance (not pipes) so the gateway survives after the
-    // hatch CLI exits — Bun does not ignore SIGPIPE.
     const gatewayLogFd = openLogFile("hatch.log");
     gateway = spawn(gatewayBinary, [], {
       detached: true,
-      stdio: ["ignore", gatewayLogFd, gatewayLogFd],
+      stdio: ["ignore", "pipe", "pipe"],
       env: gatewayEnv,
     });
-    if (typeof gatewayLogFd === "number") closeSync(gatewayLogFd);
+    pipeToLogFile(gateway, gatewayLogFd, "gateway");
   } else {
     // Source tree / bunx: resolve the gateway source directory and run via bun.
     const gatewayDir = resolveGatewayDir();
@@ -971,10 +973,10 @@ export async function startGateway(
     gateway = spawn("bun", bunArgs, {
       cwd: gatewayDir,
       detached: true,
-      stdio: ["ignore", gwLogFd, gwLogFd],
+      stdio: ["ignore", "pipe", "pipe"],
       env: gatewayEnv,
     });
-    if (typeof gwLogFd === "number") closeSync(gwLogFd);
+    pipeToLogFile(gateway, gwLogFd, "gateway");
     if (watch) {
       console.log("   Gateway started in watch mode (bun --watch)");
     }
@@ -1044,4 +1046,20 @@ export async function stopLocalProcesses(
 
   const gatewayPidFile = join(vellumDir, "gateway.pid");
   await stopProcessByPidFile(gatewayPidFile, "gateway", undefined, 7000);
+
+  // Kill ngrok directly by PID rather than using stopProcessByPidFile, because
+  // isVellumProcess() checks for /vellum|@vellumai|--vellum-gateway/ which
+  // won't match the ngrok binary — resulting in a no-op that leaves ngrok running.
+  const ngrokPidFile = join(vellumDir, "ngrok.pid");
+  if (existsSync(ngrokPidFile)) {
+    try {
+      const pid = parseInt(readFileSync(ngrokPidFile, "utf-8").trim(), 10);
+      if (!isNaN(pid)) {
+        try {
+          process.kill(pid, "SIGTERM");
+        } catch {}
+      }
+      unlinkSync(ngrokPidFile);
+    } catch {}
+  }
 }

package/src/lib/ngrok.ts

@@ -115,6 +115,7 @@ export async function findExistingTunnel(
  */
 export function startNgrokProcess(targetPort: number): ChildProcess {
   const child = spawn("ngrok", ["http", String(targetPort), "--log=stdout"], {
+    detached: true,
     stdio: ["ignore", "pipe", "pipe"],
   });
   return child;
@@ -168,6 +169,97 @@ function clearIngressUrl(): void {
   saveRawConfig(config);
 }
 
+/**
+ * Check whether any webhook-based integrations (e.g. Telegram) are configured
+ * that require a public ingress URL.
+ */
+function hasWebhookIntegrationsConfigured(): boolean {
+  try {
+    const config = loadRawConfig();
+    const telegram = config.telegram as Record<string, unknown> | undefined;
+    if (telegram?.botUsername) return true;
+    return false;
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Check whether a non-ngrok ingress URL is already configured (e.g. custom
+ * domain or cloud deployment), meaning ngrok is not needed.
+ */
+function hasNonNgrokIngressUrl(): boolean {
+  try {
+    const config = loadRawConfig();
+    const ingress = config.ingress as Record<string, unknown> | undefined;
+    const publicBaseUrl = ingress?.publicBaseUrl;
+    if (!publicBaseUrl || typeof publicBaseUrl !== "string") return false;
+    return !publicBaseUrl.includes("ngrok");
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Auto-start an ngrok tunnel if webhook integrations are configured and no
+ * non-ngrok ingress URL is present. Designed to be called during daemon/gateway
+ * startup. Non-fatal: if ngrok is unavailable or fails, startup continues.
+ *
+ * Returns the spawned ngrok child process (for PID tracking) or null.
+ */
+export async function maybeStartNgrokTunnel(
+  targetPort: number,
+): Promise<ChildProcess | null> {
+  if (!hasWebhookIntegrationsConfigured()) return null;
+  if (hasNonNgrokIngressUrl()) return null;
+
+  const version = getNgrokVersion();
+  if (!version) return null;
+
+  // Reuse an existing tunnel if one is already running
+  const existingUrl = await findExistingTunnel(targetPort);
+  if (existingUrl) {
+    console.log(`   Found existing ngrok tunnel: ${existingUrl}`);
+    saveIngressUrl(existingUrl);
+    return null;
+  }
+
+  console.log(`   Starting ngrok tunnel for webhook integrations...`);
+  const ngrokProcess = startNgrokProcess(targetPort);
+
+  // Pipe output for debugging but don't block on it
+  ngrokProcess.stdout?.on("data", (data: Buffer) => {
+    const line = data.toString().trim();
+    if (line) console.log(`[ngrok] ${line}`);
+  });
+  ngrokProcess.stderr?.on("data", (data: Buffer) => {
+    const line = data.toString().trim();
+    if (line) console.error(`[ngrok] ${line}`);
+  });
+
+  try {
+    const publicUrl = await waitForNgrokUrl();
+    saveIngressUrl(publicUrl);
+    console.log(`   Tunnel established: ${publicUrl}`);
+
+    // Detach the ngrok process so the CLI (hatch/wake) can exit without
+    // keeping it alive. Remove stdout/stderr listeners and unref all handles.
+    ngrokProcess.stdout?.removeAllListeners("data");
+    ngrokProcess.stderr?.removeAllListeners("data");
+    ngrokProcess.stdout?.destroy();
+    ngrokProcess.stderr?.destroy();
+    ngrokProcess.unref();
+
+    return ngrokProcess;
+  } catch {
+    console.warn(
+      `   ⚠ Could not start ngrok tunnel. Webhook integrations may not work until you run \`vellum tunnel\`.`,
+    );
+    if (!ngrokProcess.killed) ngrokProcess.kill("SIGTERM");
+    return null;
+  }
+}
+
 /**
  * Run the ngrok tunnel workflow: check installation, find or start a tunnel,
  * save the public URL to config, and block until exit or signal.

package/src/lib/orphan-detection.ts

@@ -0,0 +1,103 @@
+import { existsSync, readFileSync } from "fs";
+import { homedir } from "os";
+import { join } from "path";
+
+import { execOutput } from "./step-runner";
+
+export interface RemoteProcess {
+  pid: string;
+  ppid: string;
+  command: string;
+}
+
+export function classifyProcess(command: string): string {
+  if (/qdrant/.test(command)) return "qdrant";
+  if (/vellum-gateway/.test(command)) return "gateway";
+  if (/openclaw/.test(command)) return "openclaw-adapter";
+  if (/vellum-daemon/.test(command)) return "assistant";
+  if (/daemon\s+(start|restart)/.test(command)) return "assistant";
+  // Exclude macOS desktop app processes — their path contains .app/Contents/MacOS/
+  // but they are not background service processes.
+  if (/\.app\/Contents\/MacOS\//.test(command)) return "unknown";
+  if (/vellum/.test(command)) return "vellum";
+  return "unknown";
+}
+
+export function parseRemotePs(output: string): RemoteProcess[] {
+  return output
+    .trim()
+    .split("\n")
+    .filter((line) => line.trim().length > 0)
+    .map((line) => {
+      const trimmed = line.trim();
+      const parts = trimmed.split(/\s+/);
+      const pid = parts[0];
+      const ppid = parts[1];
+      const command = parts.slice(2).join(" ");
+      return { pid, ppid, command };
+    });
+}
+
+export function readPidFile(pidFile: string): string | null {
+  if (!existsSync(pidFile)) return null;
+  const pid = readFileSync(pidFile, "utf-8").trim();
+  return pid || null;
+}
+
+export function isProcessAlive(pid: string): boolean {
+  try {
+    process.kill(parseInt(pid, 10), 0);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+export interface OrphanedProcess {
+  name: string;
+  pid: string;
+  source: string;
+}
+
+export async function detectOrphanedProcesses(): Promise<OrphanedProcess[]> {
+  const results: OrphanedProcess[] = [];
+  const seenPids = new Set<string>();
+  const vellumDir = join(homedir(), ".vellum");
+
+  // Strategy 1: PID file scan
+  const pidFiles: Array<{ file: string; name: string }> = [
+    { file: join(vellumDir, "vellum.pid"), name: "assistant" },
+    { file: join(vellumDir, "gateway.pid"), name: "gateway" },
+    { file: join(vellumDir, "qdrant.pid"), name: "qdrant" },
+  ];
+
+  for (const { file, name } of pidFiles) {
+    const pid = readPidFile(file);
+    if (pid && isProcessAlive(pid)) {
+      results.push({ name, pid, source: "pid file" });
+      seenPids.add(pid);
+    }
+  }
+
+  // Strategy 2: Process table scan
+  try {
+    const output = await execOutput("sh", [
+      "-c",
+      "ps ax -o pid=,ppid=,args= | grep -E 'vellum|vellum-gateway|qdrant|openclaw' | grep -v grep",
+    ]);
+    const procs = parseRemotePs(output);
+    const ownPid = String(process.pid);
+
+    for (const p of procs) {
+      if (p.pid === ownPid || seenPids.has(p.pid)) continue;
+      const type = classifyProcess(p.command);
+      if (type === "unknown") continue;
+      results.push({ name: type, pid: p.pid, source: "process table" });
+      seenPids.add(p.pid);
+    }
+  } catch {
+    // grep exits 1 when no matches found — ignore
+  }
+
+  return results;
+}

package/src/lib/xdg-log.ts

@@ -1,8 +1,20 @@
-import { closeSync, mkdirSync, openSync, writeSync } from "fs";
 import type { ChildProcess } from "child_process";
+import {
+  closeSync,
+  copyFileSync,
+  existsSync,
+  mkdirSync,
+  openSync,
+  statSync,
+  writeFileSync,
+  writeSync,
+} from "fs";
 import { homedir } from "os";
 import { join } from "path";
 
+/** Regex matching pino-pretty's short time prefix, e.g. `[12:07:37.467] `. */
+const PINO_TIME_RE = /^\[\d{2}:\d{2}:\d{2}\.\d{3}\]\s*/;
+
 /** Returns the XDG-compatible log directory for Vellum CLI logs. */
 export function getLogDir(): string {
   const configHome = process.env.XDG_CONFIG_HOME || join(homedir(), ".config");
@@ -23,6 +35,36 @@ export function openLogFile(name: string): number | "ignore" {
   }
 }
 
+/** Truncate (or create) a log file so each session starts fresh. */
+export function resetLogFile(name: string): void {
+  try {
+    const dir = getLogDir();
+    mkdirSync(dir, { recursive: true });
+    writeFileSync(join(dir, name), "");
+  } catch {
+    /* best-effort */
+  }
+}
+
+/**
+ * Copy the current log file into `destDir` with a timestamped name so that
+ * previous session logs are preserved for debugging. No-op when the source
+ * file is missing or empty.
+ */
+export function archiveLogFile(name: string, destDir: string): void {
+  try {
+    const srcPath = join(getLogDir(), name);
+    if (!existsSync(srcPath) || statSync(srcPath).size === 0) return;
+
+    mkdirSync(destDir, { recursive: true });
+    const ts = new Date().toISOString().replace(/[:.]/g, "-");
+    const base = name.replace(/\.log$/, "");
+    copyFileSync(srcPath, join(destDir, `${base}-${ts}.log`));
+  } catch {
+    /* best-effort */
+  }
+}
+
 /** Close a file descriptor returned by openLogFile (no-op for "ignore"). */
 export function closeLogFile(fd: number | "ignore"): void {
   if (typeof fd === "number") {
@@ -46,7 +88,8 @@ export function writeToLogFile(fd: number | "ignore", msg: string): void {
 }
 
 /** Pipe a child process's stdout/stderr to a shared log file descriptor,
- *  prefixing each line with a tag (e.g. "[daemon]" or "[gateway]").
+ *  prefixing each line with an ISO timestamp and tag (e.g. "[daemon]").
+ *  Strips pino-pretty's redundant short time prefix when present.
  *  Streams are unref'd so they don't prevent the parent from exiting.
  *  The fd is closed automatically when both streams end. */
 export function pipeToLogFile(
@@ -80,9 +123,10 @@ export function pipeToLogFile(
       for (let i = 0; i < lines.length; i++) {
         if (i === lines.length - 1 && lines[i] === "") break;
         const nl = i < lines.length - 1 ? "\n" : "";
+        const stripped = lines[i].replace(PINO_TIME_RE, "");
         const prefix = `${new Date().toISOString()} ${tagLabel} `;
         try {
-          writeSync(numFd, prefix + lines[i] + nl);
+          writeSync(numFd, prefix + stripped + nl);
         } catch {
           /* best-effort */
         }