@vellumai/cli 0.5.12 → 0.5.14

package/src/commands/backup.ts

@@ -66,7 +66,7 @@ export async function backup(): Promise<void> {
   const cloud =
     entry.cloud || (entry.project ? "gcp" : entry.sshUser ? "custom" : "local");
   if (cloud === "vellum") {
-    await backupPlatform(name, outputArg);
+    await backupPlatform(name, outputArg, entry.runtimeUrl);
     return;
   }
 
@@ -184,7 +184,11 @@ export async function backup(): Promise<void> {
 // Platform (Vellum-hosted) backup via Django async migration export
 // ---------------------------------------------------------------------------
 
-async function backupPlatform(name: string, outputArg?: string): Promise<void> {
+async function backupPlatform(
+  name: string,
+  outputArg?: string,
+  runtimeUrl?: string,
+): Promise<void> {
   // Step 1 — Authenticate
   const token = readPlatformToken();
   if (!token) {
@@ -194,7 +198,7 @@ async function backupPlatform(name: string, outputArg?: string): Promise<void> {
 
   let orgId: string;
   try {
-    orgId = await fetchOrganizationId(token);
+    orgId = await fetchOrganizationId(token, runtimeUrl);
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
     if (msg.includes("401") || msg.includes("403")) {
@@ -207,7 +211,12 @@ async function backupPlatform(name: string, outputArg?: string): Promise<void> {
   // Step 2 — Initiate export job
   let jobId: string;
   try {
-    const result = await platformInitiateExport(token, orgId, "CLI backup");
+    const result = await platformInitiateExport(
+      token,
+      orgId,
+      "CLI backup",
+      runtimeUrl,
+    );
     jobId = result.jobId;
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
@@ -235,7 +244,7 @@ async function backupPlatform(name: string, outputArg?: string): Promise<void> {
   while (Date.now() < deadline) {
     let status: { status: string; downloadUrl?: string; error?: string };
     try {
-      status = await platformPollExportStatus(jobId, token, orgId);
+      status = await platformPollExportStatus(jobId, token, orgId, runtimeUrl);
     } catch (err) {
       const msg = err instanceof Error ? err.message : String(err);
       // Let non-transient errors (e.g. 404 "job not found") propagate immediately

package/src/commands/hatch.ts

@@ -42,12 +42,17 @@ import { hatchGcp } from "../lib/gcp";
 import type { PollResult, WatchHatchingResult } from "../lib/gcp";
 import { buildNestedConfig, writeInitialConfig } from "../lib/config-utils";
 import {
+  generateLocalSigningKey,
   startLocalDaemon,
   startGateway,
   stopLocalProcesses,
 } from "../lib/local";
 import { maybeStartNgrokTunnel } from "../lib/ngrok";
-import { getPlatformUrl } from "../lib/platform-client";
+import {
+  getPlatformUrl,
+  hatchAssistant,
+  readPlatformToken,
+} from "../lib/platform-client";
 import { httpHealthCheck } from "../lib/http-client";
 import { detectOrphanedProcesses } from "../lib/orphan-detection";
 import { isProcessAlive, stopProcess } from "../lib/process";
@@ -237,7 +242,7 @@ function parseArgs(): HatchArgs {
       console.log("  -d                        Run in detached mode");
       console.log("  --name <name>             Custom instance name");
       console.log(
-        "  --remote <host>           Remote host (local, gcp, aws, docker, custom)",
+        "  --remote <host>           Remote host (local, gcp, aws, docker, custom, vellum)",
       );
       console.log(
         "  --restart                 Restart processes without onboarding side effects",
@@ -772,12 +777,16 @@ async function hatchLocal(
   const defaultWorkspaceConfigPath = writeInitialConfig(configValues);
 
   emitProgress(4, 7, "Starting assistant...");
-  await startLocalDaemon(watch, resources, { defaultWorkspaceConfigPath });
+  const signingKey = generateLocalSigningKey();
+  await startLocalDaemon(watch, resources, {
+    defaultWorkspaceConfigPath,
+    signingKey,
+  });
 
   emitProgress(5, 7, "Starting gateway...");
   let runtimeUrl = `http://127.0.0.1:${resources.gatewayPort}`;
   try {
-    runtimeUrl = await startGateway(watch, resources);
+    runtimeUrl = await startGateway(watch, resources, { signingKey });
   } catch (error) {
     // Gateway failed — stop the daemon we just started so we don't leave
     // orphaned processes with no lock file entry.
@@ -820,7 +829,7 @@ async function hatchLocal(
     species,
     hatchedAt: new Date().toISOString(),
     serviceGroupVersion: cliPkg.version ? `v${cliPkg.version}` : undefined,
-    resources,
+    resources: { ...resources, signingKey },
   };
   emitProgress(7, 7, "Saving configuration...");
   if (!restart) {
@@ -943,6 +952,48 @@ export async function hatch(): Promise<void> {
     return;
   }
 
+  if (remote === "vellum") {
+    await hatchVellumPlatform();
+    return;
+  }
+
   console.error(`Error: Remote host '${remote}' is not yet supported.`);
   process.exit(1);
 }
+
+async function hatchVellumPlatform(): Promise<void> {
+  const token = readPlatformToken();
+  if (!token) {
+    console.error("Not logged in. Run `vellum login --token <token>` first.");
+    process.exit(1);
+  }
+
+  const config = SPECIES_CONFIG.vellum;
+  console.log("");
+  for (const line of config.art) {
+    console.log(`   ${line}`);
+  }
+  console.log("");
+  console.log("   Hatching assistant on Vellum platform...");
+  console.log("");
+
+  const result = await hatchAssistant(token);
+
+  const platformUrl = getPlatformUrl();
+
+  saveAssistantEntry({
+    assistantId: result.id,
+    runtimeUrl: platformUrl,
+    cloud: "vellum",
+    species: "vellum",
+    hatchedAt: new Date().toISOString(),
+  });
+  setActiveAssistant(result.id);
+
+  console.log(`   ${config.hatchedEmoji}  Your assistant has hatched!`);
+  console.log("");
+  console.log(`   ID:     ${result.id}`);
+  console.log(`   Name:   ${result.name}`);
+  console.log(`   Status: ${result.status}`);
+  console.log("");
+}

package/src/commands/ps.ts

@@ -238,7 +238,7 @@ async function getLocalProcesses(entry: AssistantEntry): Promise<TableRow[]> {
       name: "embed-worker",
       pgrepName: "embed-worker",
       port: 0,
-      pidFile: join(vellumDir, "embed-worker.pid"),
+      pidFile: join(vellumDir, "workspace", "embed-worker.pid"),
     },
   ];
 

package/src/commands/recover.ts

@@ -4,7 +4,11 @@ import { join } from "path";
 
 import { saveAssistantEntry } from "../lib/assistant-config";
 import type { AssistantEntry } from "../lib/assistant-config";
-import { startLocalDaemon, startGateway } from "../lib/local";
+import {
+  generateLocalSigningKey,
+  startLocalDaemon,
+  startGateway,
+} from "../lib/local";
 import { getArchivePath, getMetadataPath } from "../lib/retire-archive";
 import { exec } from "../lib/step-runner";
 
@@ -66,9 +70,14 @@ export async function recover(): Promise<void> {
   unlinkSync(archivePath);
   unlinkSync(metadataPath);
 
-  // 7. Start daemon + gateway (same as wake)
-  await startLocalDaemon(false, entry.resources);
-  await startGateway(false, entry.resources);
+  // 7. Persist signing key so it survives daemon/gateway restarts (same as wake)
+  const signingKey = generateLocalSigningKey();
+  entry.resources = { ...entry.resources, signingKey };
+  saveAssistantEntry(entry);
+
+  // 8. Start daemon + gateway
+  await startLocalDaemon(false, entry.resources, { signingKey });
+  await startGateway(false, entry.resources, { signingKey });
 
   console.log(`✅ Recovered assistant '${name}'.`);
 }

package/src/commands/restore.ts

@@ -179,7 +179,7 @@ async function restorePlatform(
 
   let orgId: string;
   try {
-    orgId = await fetchOrganizationId(token);
+    orgId = await fetchOrganizationId(token, entry.runtimeUrl);
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
     if (msg.includes("401") || msg.includes("403")) {
@@ -206,6 +206,7 @@ async function restorePlatform(
         new Uint8Array(bundleData),
         token,
         orgId,
+        entry.runtimeUrl,
       );
     } catch (err) {
       if (err instanceof Error && err.name === "TimeoutError") {
@@ -315,7 +316,12 @@ async function restorePlatform(
     );
 
     try {
-      await rollbackPlatformAssistant(token, orgId, opts.version);
+      await rollbackPlatformAssistant(
+        token,
+        orgId,
+        opts.version,
+        entry.runtimeUrl,
+      );
     } catch (err) {
       const msg = err instanceof Error ? err.message : String(err);
       if (msg.includes("401") || msg.includes("403")) {
@@ -340,6 +346,7 @@ async function restorePlatform(
       new Uint8Array(bundleData),
       token,
       orgId,
+      entry.runtimeUrl,
     );
   } catch (err) {
     if (err instanceof Error && err.name === "TimeoutError") {

package/src/commands/retire.ts

@@ -197,7 +197,10 @@ async function retireCustom(entry: AssistantEntry): Promise<void> {
   console.log(`\u2705 Custom instance retired.`);
 }
 
-async function retireVellum(assistantId: string): Promise<void> {
+async function retireVellum(
+  assistantId: string,
+  runtimeUrl?: string,
+): Promise<void> {
   console.log("\u{1F5D1}\ufe0f  Retiring platform-hosted instance...\n");
 
   const token = readPlatformToken();
@@ -208,9 +211,10 @@ async function retireVellum(assistantId: string): Promise<void> {
     process.exit(1);
   }
 
-  const orgId = await fetchOrganizationId(token);
+  const orgId = await fetchOrganizationId(token, runtimeUrl);
 
-  const url = `${getPlatformUrl()}/v1/assistants/${encodeURIComponent(assistantId)}/retire/`;
+  const platformUrl = runtimeUrl || getPlatformUrl();
+  const url = `${platformUrl}/v1/assistants/${encodeURIComponent(assistantId)}/retire/`;
   const response = await fetch(url, {
     method: "DELETE",
     headers: {
@@ -343,7 +347,7 @@ async function retireInner(): Promise<void> {
   } else if (cloud === "custom") {
     await retireCustom(entry);
   } else if (cloud === "vellum") {
-    await retireVellum(entry.assistantId);
+    await retireVellum(entry.assistantId, entry.runtimeUrl);
   } else {
     console.error(`Error: Unknown cloud type '${cloud}'.`);
     process.exit(1);

package/src/commands/rollback.ts

@@ -11,8 +11,6 @@ import {
   captureImageRefs,
   GATEWAY_INTERNAL_PORT,
   dockerResourceNames,
-  migrateCesSecurityFiles,
-  migrateGatewaySecurityFiles,
   startContainers,
   stopContainers,
 } from "../lib/docker";
@@ -185,7 +183,7 @@ async function rollbackPlatformViaEndpoint(
 
   let orgId: string;
   try {
-    orgId = await fetchOrganizationId(token);
+    orgId = await fetchOrganizationId(token, entry.runtimeUrl);
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
     if (msg.includes("401") || msg.includes("403")) {
@@ -206,7 +204,12 @@ async function rollbackPlatformViaEndpoint(
 
   let result: { detail: string; version: string | null };
   try {
-    result = await rollbackPlatformAssistant(token, orgId, version);
+    result = await rollbackPlatformAssistant(
+      token,
+      orgId,
+      version,
+      entry.runtimeUrl,
+    );
   } catch (err) {
     const detail = err instanceof Error ? err.message : String(err);
 
@@ -423,13 +426,6 @@ export async function rollback(): Promise<void> {
     await stopContainers(res);
     console.log("✅ Containers stopped\n");
 
-    // Run security file migrations and signing key cleanup
-    console.log("🔄 Migrating security files to gateway volume...");
-    await migrateGatewaySecurityFiles(res, (msg) => console.log(msg));
-
-    console.log("🔄 Migrating credential files to CES security volume...");
-    await migrateCesSecurityFiles(res, (msg) => console.log(msg));
-
     console.log("🚀 Starting containers with previous version...");
     await startContainers(
       {