@vellumai/cli 0.5.16 → 0.6.1

package/src/commands/teleport.ts

@@ -12,7 +12,6 @@ import {
 } from "../lib/guardian-token.js";
 import {
   readPlatformToken,
-  fetchOrganizationId,
   getPlatformUrl,
   hatchAssistant,
   platformInitiateExport,
@@ -20,6 +19,10 @@ import {
   platformDownloadExport,
   platformImportPreflight,
   platformImportBundle,
+  platformRequestUploadUrl,
+  platformUploadToSignedUrl,
+  platformImportPreflightFromGcs,
+  platformImportBundleFromGcs,
 } from "../lib/platform-client.js";
 import {
   hatchDocker,
@@ -419,7 +422,7 @@ async function importViaHttp(
         "Content-Type": "application/octet-stream",
       },
       body: new Blob([bundleData]),
-      signal: AbortSignal.timeout(120_000),
+      signal: AbortSignal.timeout(300_000),
     });
 
     // Retry once with a fresh token on 401
@@ -443,13 +446,13 @@ async function importViaHttp(
             "Content-Type": "application/octet-stream",
           },
           body: new Blob([bundleData]),
-          signal: AbortSignal.timeout(120_000),
+          signal: AbortSignal.timeout(300_000),
         });
       }
     }
   } catch (err) {
     if (err instanceof Error && err.name === "TimeoutError") {
-      console.error("Error: Import request timed out after 2 minutes.");
+      console.error("Error: Import request timed out after 5 minutes.");
       process.exit(1);
     }
     const msg = err instanceof Error ? err.message : String(err);
@@ -485,36 +488,12 @@ async function exportFromAssistant(
       process.exit(1);
     }
 
-    let orgId: string;
-    try {
-      orgId = await fetchOrganizationId(token, entry.runtimeUrl);
-    } catch (err) {
-      const msg = err instanceof Error ? err.message : String(err);
-      if (msg.includes("401") || msg.includes("403")) {
-        console.error("Authentication failed. Run 'vellum login' to refresh.");
-        process.exit(1);
-      }
-      throw err;
-    }
-
     // Initiate export job
-    let jobId: string;
-    try {
-      const result = await platformInitiateExport(
-        token,
-        orgId,
-        "teleport export",
-        entry.runtimeUrl,
-      );
-      jobId = result.jobId;
-    } catch (err) {
-      const msg = err instanceof Error ? err.message : String(err);
-      if (msg.includes("401") || msg.includes("403")) {
-        console.error("Authentication failed. Run 'vellum login' to refresh.");
-        process.exit(1);
-      }
-      throw err;
-    }
+    const { jobId } = await platformInitiateExport(
+      token,
+      "teleport export",
+      entry.runtimeUrl,
+    );
 
     console.log(`Export started (job ${jobId})...`);
 
@@ -527,12 +506,7 @@ async function exportFromAssistant(
     while (Date.now() < deadline) {
       let status: { status: string; downloadUrl?: string; error?: string };
       try {
-        status = await platformPollExportStatus(
-          jobId,
-          token,
-          orgId,
-          entry.runtimeUrl,
-        );
+        status = await platformPollExportStatus(jobId, token, entry.runtimeUrl);
       } catch (err) {
         const msg = err instanceof Error ? err.message : String(err);
         if (msg.includes("not found")) {
@@ -628,6 +602,7 @@ async function importToAssistant(
   cloud: string,
   bundleData: Uint8Array<ArrayBuffer>,
   dryRun: boolean,
+  preUploadedBundleKey?: string | null,
 ): Promise<void> {
   if (cloud === "vellum") {
     // Platform target
@@ -637,16 +612,29 @@ async function importToAssistant(
       process.exit(1);
     }
 
-    let orgId: string;
-    try {
-      orgId = await fetchOrganizationId(token, entry.runtimeUrl);
-    } catch (err) {
-      const msg = err instanceof Error ? err.message : String(err);
-      if (msg.includes("401") || msg.includes("403")) {
-        console.error("Authentication failed. Run 'vellum login' to refresh.");
-        process.exit(1);
+    // Use pre-uploaded bundle key if provided (string), skip upload if null
+    // (signals signed URLs were already tried and unavailable), or try
+    // signed-URL upload if undefined (never attempted).
+    let bundleKey: string | undefined =
+      preUploadedBundleKey === null ? undefined : preUploadedBundleKey;
+    if (preUploadedBundleKey === undefined) {
+      try {
+        const { uploadUrl, bundleKey: key } = await platformRequestUploadUrl(
+          token,
+          entry.runtimeUrl,
+        );
+        bundleKey = key;
+        console.log("Uploading bundle...");
+        await platformUploadToSignedUrl(uploadUrl, bundleData);
+      } catch (err) {
+        // If signed uploads unavailable (503), fall back to inline upload
+        const msg = err instanceof Error ? err.message : String(err);
+        if (msg.includes("not available")) {
+          bundleKey = undefined;
+        } else {
+          throw err;
+        }
       }
-      throw err;
     }
 
     if (dryRun) {
@@ -657,12 +645,13 @@ async function importToAssistant(
         body: Record<string, unknown>;
       };
       try {
-        preflightResult = await platformImportPreflight(
-          bundleData,
-          token,
-          orgId,
-          entry.runtimeUrl,
-        );
+        preflightResult = bundleKey
+          ? await platformImportPreflightFromGcs(
+              bundleKey,
+              token,
+              entry.runtimeUrl,
+            )
+          : await platformImportPreflight(bundleData, token, entry.runtimeUrl);
       } catch (err) {
         if (err instanceof Error && err.name === "TimeoutError") {
           console.error("Error: Preflight request timed out after 2 minutes.");
@@ -712,15 +701,12 @@ async function importToAssistant(
 
     let importResult: { statusCode: number; body: Record<string, unknown> };
     try {
-      importResult = await platformImportBundle(
-        bundleData,
-        token,
-        orgId,
-        entry.runtimeUrl,
-      );
+      importResult = bundleKey
+        ? await platformImportBundleFromGcs(bundleKey, token, entry.runtimeUrl)
+        : await platformImportBundle(bundleData, token, entry.runtimeUrl);
     } catch (err) {
       if (err instanceof Error && err.name === "TimeoutError") {
-        console.error("Error: Import request timed out after 2 minutes.");
+        console.error("Error: Import request timed out after 5 minutes.");
         process.exit(1);
       }
       throw err;
@@ -1080,10 +1066,19 @@ export async function teleport(): Promise<void> {
       // No existing target — just describe what would happen
       console.log("Dry run summary:");
       console.log(`  Would export data from: ${from} (${fromCloud})`);
-      console.log(
-        `  Would hatch a new ${targetEnv} assistant${targetName ? ` named '${targetName}'` : ""}`,
-      );
-      console.log(`  Would import data into the new assistant`);
+      if (targetEnv === "platform") {
+        // For platform targets, reflect the reordered flow
+        console.log(`  Would upload bundle via signed URL (if available)`);
+        console.log(
+          `  Would hatch a new ${targetEnv} assistant${targetName ? ` named '${targetName}'` : ""}`,
+        );
+        console.log(`  Would import data into the new assistant`);
+      } else {
+        console.log(
+          `  Would hatch a new ${targetEnv} assistant${targetName ? ` named '${targetName}'` : ""}`,
+        );
+        console.log(`  Would import data into the new assistant`);
+      }
     }
 
     console.log(`Dry run complete — no changes were made.`);
@@ -1094,6 +1089,71 @@ export async function teleport(): Promise<void> {
   console.log(`Exporting from ${from} (${fromCloud})...`);
   const bundleData = await exportFromAssistant(fromEntry, fromCloud);
 
+  // Platform target: reordered flow — upload to GCS before hatching so that
+  // if upload fails, no empty assistant is left dangling on the platform.
+  if (targetEnv === "platform") {
+    // Step B — Auth
+    const token = readPlatformToken();
+    if (!token) {
+      console.error("Not logged in. Run 'vellum login' first.");
+      process.exit(1);
+    }
+
+    // If targeting an existing assistant, validate cloud match early — before
+    // uploading — so we don't waste a GCS upload on an invalid command.
+    const existingTarget = targetName ? findAssistantByName(targetName) : null;
+    if (existingTarget) {
+      const existingCloud = resolveCloud(existingTarget);
+      if (existingCloud !== "vellum") {
+        console.error(
+          `Error: Assistant '${targetName}' is a ${existingCloud} assistant, not platform. ` +
+            `Use --${existingCloud} to target it.`,
+        );
+        process.exit(1);
+      }
+    }
+
+    // Use the existing target's runtimeUrl for all platform calls so upload
+    // and import hit the same instance.
+    const targetPlatformUrl = existingTarget?.runtimeUrl;
+
+    // Step C — Upload to GCS
+    // bundleKey: string = uploaded successfully, null = tried but unavailable,
+    // undefined would mean "never tried" (not used here).
+    let bundleKey: string | null = null;
+    try {
+      const { uploadUrl, bundleKey: key } = await platformRequestUploadUrl(
+        token,
+        targetPlatformUrl,
+      );
+      bundleKey = key;
+      console.log("Uploading bundle to GCS...");
+      await platformUploadToSignedUrl(uploadUrl, bundleData);
+    } catch (err) {
+      // If signed uploads unavailable (503), fall back to inline upload later
+      const msg = err instanceof Error ? err.message : String(err);
+      if (msg.includes("not available")) {
+        bundleKey = null;
+      } else {
+        throw err;
+      }
+    }
+
+    // Step D — Hatch (upload succeeded or fallback to inline — safe to hatch)
+    const toEntry = await resolveOrHatchTarget(targetEnv, targetName);
+    const toCloud = resolveCloud(toEntry);
+
+    // Step E — Import from GCS (or inline fallback)
+    // Pass bundleKey (string) or null to signal "already tried, use inline".
+    console.log(`Importing to ${toEntry.assistantId} (${toCloud})...`);
+    await importToAssistant(toEntry, toCloud, bundleData, false, bundleKey);
+
+    // Success summary
+    console.log(`Teleport complete: ${from} → ${toEntry.assistantId}`);
+    return;
+  }
+
+  // Non-platform targets (local/docker): existing flow unchanged
   // For local<->docker transfers, stop (sleep) the source to free up ports
   // before hatching the target. We do NOT retire yet — if hatch or import
   // fails, the user can recover by running `vellum wake <source>`.

package/src/commands/upgrade.ts

@@ -18,7 +18,7 @@ import {
 } from "../lib/docker";
 import { resolveImageRefs } from "../lib/platform-releases";
 import {
-  fetchOrganizationId,
+  authHeaders,
   getPlatformUrl,
   readPlatformToken,
 } from "../lib/platform-client";
@@ -42,7 +42,7 @@ import {
   UPGRADE_PROGRESS,
   waitForReady,
 } from "../lib/upgrade-lifecycle.js";
-import { parseVersion } from "../lib/version-compat.js";
+import { compareVersions } from "../lib/version-compat.js";
 
 interface UpgradeArgs {
   name: string | null;
@@ -193,21 +193,12 @@ async function upgradeDocker(
   // Users should use `vellum rollback --version <version>` for downgrades.
   const currentVersion = entry.serviceGroupVersion;
   if (currentVersion && versionTag) {
-    const current = parseVersion(currentVersion);
-    const target = parseVersion(versionTag);
-    if (current && target) {
-      const isOlder =
-        target.major < current.major ||
-        (target.major === current.major && target.minor < current.minor) ||
-        (target.major === current.major &&
-          target.minor === current.minor &&
-          target.patch < current.patch);
-      if (isOlder) {
-        const msg = `Cannot upgrade to an older version (${versionTag} < ${currentVersion}). Use \`vellum rollback --version ${versionTag}\` instead.`;
-        console.error(msg);
-        emitCliError("VERSION_DIRECTION", msg);
-        process.exit(1);
-      }
+    const cmp = compareVersions(versionTag, currentVersion);
+    if (cmp !== null && cmp < 0) {
+      const msg = `Cannot upgrade to an older version (${versionTag} < ${currentVersion}). Use \`vellum rollback --version ${versionTag}\` instead.`;
+      console.error(msg);
+      emitCliError("VERSION_DIRECTION", msg);
+      process.exit(1);
     }
   }
 
@@ -291,6 +282,11 @@ async function upgradeDocker(
     `   Captured ${Object.keys(capturedEnv).length} env var(s) from ${res.assistantContainer}\n`,
   );
 
+  // Capture GUARDIAN_BOOTSTRAP_SECRET from the gateway container (it is only
+  // set on gateway, not assistant) so it persists across container restarts.
+  const gatewayEnv = await captureContainerEnv(res.gatewayContainer);
+  const bootstrapSecret = gatewayEnv["GUARDIAN_BOOTSTRAP_SECRET"];
+
   // Notify connected clients that an upgrade is about to begin.
   // This must fire BEFORE any progress broadcasts so the UI sets
   // isUpdateInProgress = true and starts displaying status messages.
@@ -419,6 +415,7 @@ async function upgradeDocker(
   await startContainers(
     {
       signingKey,
+      bootstrapSecret,
       cesServiceToken,
       extraAssistantEnv,
       gatewayPort,
@@ -517,6 +514,7 @@ async function upgradeDocker(
         await startContainers(
           {
             signingKey,
+            bootstrapSecret,
             cesServiceToken,
             extraAssistantEnv,
             gatewayPort,
@@ -687,21 +685,12 @@ async function upgradePlatform(
   // we must not block the request based on the local CLI version.
   const currentVersion = entry.serviceGroupVersion;
   if (version && currentVersion) {
-    const current = parseVersion(currentVersion);
-    const target = parseVersion(version);
-    if (current && target) {
-      const isOlder =
-        target.major < current.major ||
-        (target.major === current.major && target.minor < current.minor) ||
-        (target.major === current.major &&
-          target.minor === current.minor &&
-          target.patch < current.patch);
-      if (isOlder) {
-        const msg = `Cannot upgrade to an older version (${version} < ${currentVersion}). Use \`vellum rollback --version ${version}\` instead.`;
-        console.error(msg);
-        emitCliError("VERSION_DIRECTION", msg);
-        process.exit(1);
-      }
+    const cmp = compareVersions(version, currentVersion);
+    if (cmp !== null && cmp < 0) {
+      const msg = `Cannot upgrade to an older version (${version} < ${currentVersion}). Use \`vellum rollback --version ${version}\` instead.`;
+      console.error(msg);
+      emitCliError("VERSION_DIRECTION", msg);
+      process.exit(1);
     }
   }
 
@@ -718,7 +707,7 @@ async function upgradePlatform(
     process.exit(1);
   }
 
-  const orgId = await fetchOrganizationId(token, entry.runtimeUrl);
+  const headers = await authHeaders(token, entry.runtimeUrl);
 
   const url = `${entry.runtimeUrl || getPlatformUrl()}/v1/assistants/upgrade/`;
   const body: { assistant_id?: string; version?: string } = {
@@ -730,14 +719,28 @@ async function upgradePlatform(
 
   const response = await fetch(url, {
     method: "POST",
-    headers: {
-      "Content-Type": "application/json",
-      "X-Session-Token": token,
-      "Vellum-Organization-Id": orgId,
-    },
+    headers,
     body: JSON.stringify(body),
   });
 
+  if (response.status === 401 || response.status === 403) {
+    const text = await response.text();
+    console.error(
+      `Authentication failed (${response.status}). Run 'vellum login' to refresh.`,
+    );
+    emitCliError("AUTH_FAILED", "Authentication failed", text);
+    try {
+      await broadcastUpgradeEvent(
+        entry.runtimeUrl,
+        entry.assistantId,
+        buildCompleteEvent(entry.serviceGroupVersion ?? "unknown", false),
+      );
+    } catch {
+      // Best-effort — broadcast may fail if the assistant is unreachable
+    }
+    process.exit(1);
+  }
+
   if (!response.ok) {
     const text = await response.text();
     console.error(
@@ -748,11 +751,15 @@ async function upgradePlatform(
       `Platform upgrade failed (${response.status})`,
       text,
     );
-    await broadcastUpgradeEvent(
-      entry.runtimeUrl,
-      entry.assistantId,
-      buildCompleteEvent(entry.serviceGroupVersion ?? "unknown", false),
-    );
+    try {
+      await broadcastUpgradeEvent(
+        entry.runtimeUrl,
+        entry.assistantId,
+        buildCompleteEvent(entry.serviceGroupVersion ?? "unknown", false),
+      );
+    } catch {
+      // Best-effort — broadcast may fail if the assistant is unreachable
+    }
     process.exit(1);
   }
 

package/src/index.ts

@@ -4,8 +4,10 @@ import cliPkg from "../package.json";
 import { backup } from "./commands/backup";
 import { clean } from "./commands/clean";
 import { client } from "./commands/client";
+import { events } from "./commands/events";
 import { hatch } from "./commands/hatch";
 import { login, logout, whoami } from "./commands/login";
+import { message } from "./commands/message";
 import { pair } from "./commands/pair";
 import { ps } from "./commands/ps";
 import { recover } from "./commands/recover";
@@ -33,9 +35,11 @@ const commands = {
   backup,
   clean,
   client,
+  events,
   hatch,
   login,
   logout,
+  message,
   pair,
   ps,
   recover,
@@ -62,9 +66,11 @@ function printHelp(): void {
   console.log("  backup   Export a backup of a running assistant");
   console.log("  clean    Kill orphaned vellum processes");
   console.log("  client   Connect to a hatched assistant");
+  console.log("  events   Stream events from a running assistant");
   console.log("  hatch    Create a new assistant instance");
   console.log("  login    Log in to the Vellum platform");
   console.log("  logout   Log out of the Vellum platform");
+  console.log("  message  Send a message to a running assistant");
   console.log("  pair     Pair with a remote assistant via QR code");
   console.log(
     "  ps       List assistants (or processes for a specific assistant)",

package/src/lib/arg-utils.ts

@@ -0,0 +1,13 @@
+/** Extract a named flag's value from an arg list, returning [value, remaining]. */
+export function extractFlag(
+  args: string[],
+  flag: string,
+): [string | undefined, string[]] {
+  const idx = args.indexOf(flag);
+  if (idx === -1 || idx + 1 >= args.length) {
+    return [undefined, args.filter((a) => a !== flag)];
+  }
+  const value = args[idx + 1]!;
+  const remaining = [...args.slice(0, idx), ...args.slice(idx + 2)];
+  return [value, remaining];
+}