@vellumai/cli 0.6.2 → 0.6.4

package/src/lib/constants.ts

@@ -16,16 +16,6 @@ export const DEFAULT_GATEWAY_PORT = 7830;
 export const DEFAULT_QDRANT_PORT = 6333;
 export const DEFAULT_CES_PORT = 8090;
 
-/**
- * Lockfile candidate filenames, checked in priority order.
- * `.vellum.lock.json` is the current name; `.vellum.lockfile.json` is the
- * legacy name kept for backwards compatibility with older installs.
- */
-export const LOCKFILE_NAMES = [
-  ".vellum.lock.json",
-  ".vellum.lockfile.json",
-] as const;
-
 export const VALID_REMOTE_HOSTS = [
   "local",
   "gcp",

package/src/lib/docker.ts

@@ -39,13 +39,17 @@ export const DOCKERHUB_IMAGES: Record<ServiceName, string> = {
 };
 
 /** Internal ports exposed by each service's Dockerfile. */
-export const ASSISTANT_INTERNAL_PORT = 3001;
+export const ASSISTANT_INTERNAL_PORT = 7821;
 export const GATEWAY_INTERNAL_PORT = 7830;
 
 /** Max time to wait for the assistant container to emit the readiness sentinel. */
 export const DOCKER_READY_TIMEOUT_MS = 3 * 60 * 1000;
 
+/** Default memory (GiB) allocated to the Colima VM. */
+const COLIMA_DEFAULT_MEMORY_GIB = 8;
+
 /** Directory for user-local binary installs (no sudo required). */
+
 const LOCAL_BIN_DIR = join(
   process.env.HOME || process.env.USERPROFILE || ".",
   ".local",
@@ -294,7 +298,11 @@ async function ensureDockerInstalled(): Promise<void> {
 
     console.log("🚀 Docker daemon not running. Starting Colima...");
     try {
-      await exec("colima", ["start"]);
+      await exec("colima", [
+        "start",
+        "--memory",
+        String(COLIMA_DEFAULT_MEMORY_GIB),
+      ]);
     } catch {
       // Colima may fail if a previous VM instance is in a corrupt state.
       // Attempt to delete the stale instance and retry once.
@@ -311,7 +319,11 @@ async function ensureDockerInstalled(): Promise<void> {
 
       try {
         console.log("🔄 Retrying colima start...");
-        await exec("colima", ["start"]);
+        await exec("colima", [
+          "start",
+          "--memory",
+          String(COLIMA_DEFAULT_MEMORY_GIB),
+        ]);
       } catch (retryErr) {
         const message =
           retryErr instanceof Error ? retryErr.message : String(retryErr);
@@ -329,6 +341,7 @@ export function dockerResourceNames(instanceName: string) {
     assistantContainer: `${instanceName}-assistant`,
     cesContainer: `${instanceName}-credential-executor`,
     cesSecurityVolume: `${instanceName}-ces-sec`,
+    dockerdDataVolume: `${instanceName}-dockerd-data`,
     gatewayContainer: `${instanceName}-gateway`,
     gatewaySecurityVolume: `${instanceName}-gateway-sec`,
     network: `${instanceName}-net`,
@@ -388,6 +401,7 @@ export async function retireDocker(name: string): Promise<void> {
     res.workspaceVolume,
     res.cesSecurityVolume,
     res.gatewaySecurityVolume,
+    res.dockerdDataVolume,
   ]) {
     try {
       await exec("docker", ["volume", "rm", vol]);
@@ -551,19 +565,53 @@ export function serviceDockerRunArgs(opts: {
   } = opts;
   return {
     assistant: () => {
+      // Run the assistant container in Docker-in-Docker (DinD) mode: the
+      // container runs its own `dockerd` so the Meet subsystem can spawn
+      // sibling meet-bot containers without needing access to the host's
+      // Docker engine. This requires:
+      //   - `--privileged` so the inner dockerd can manage cgroups, iptables,
+      //     overlayfs mounts, etc.
+      //   - A dedicated named volume mounted at `/var/lib/docker` so the
+      //     inner Docker image cache and container state survive restarts of
+      //     the assistant container.
+      // The host's `/var/run/docker.sock` is intentionally NOT mounted — all
+      // Meet-bot spawning happens against the inner dockerd.
       const args: string[] = [
         "run",
         "--init",
         "-d",
+        "--privileged",
         "--name",
         res.assistantContainer,
         `--network=${res.network}`,
         "-p",
         `${gatewayPort}:${GATEWAY_INTERNAL_PORT}`,
+        // Published so the Meet subsystem's sibling bot containers can reach
+        // the daemon's internal HTTP API at host.docker.internal:<port>.
+        //
+        // Published on all host interfaces (no `127.0.0.1:` prefix) because on
+        // vanilla Linux Docker, `host.docker.internal:host-gateway` resolves
+        // to the Docker bridge gateway IP (e.g. 172.17.0.1), not loopback.
+        // Packets from sibling containers arrive at the host's bridge
+        // interface, and an iptables DNAT rule keyed on dest=127.0.0.1 would
+        // not match — causing connection refused. Docker Desktop (macOS/
+        // Windows) still works because its VM proxy forwards to the same
+        // published port regardless of the binding address.
+        //
+        // Security tradeoff: the daemon HTTP API is now reachable from the
+        // host's LAN (any device that can hit the host IP on this port).
+        // This matches the gateway port's existing posture and is acceptable
+        // for single-user self-hosted Docker mode per the Phase 1.8 security
+        // note. Managed/multi-tenant deployments are out of scope and would
+        // require a different design.
+        "-p",
+        `${ASSISTANT_INTERNAL_PORT}:${ASSISTANT_INTERNAL_PORT}`,
         "-v",
         `${res.workspaceVolume}:/workspace`,
         "-v",
         `${res.socketVolume}:/run/ces-bootstrap`,
+        "-v",
+        `${res.dockerdDataVolume}:/var/lib/docker`,
         "-e",
         "IS_CONTAINERIZED=true",
         "-e",
@@ -575,6 +623,10 @@ export function serviceDockerRunArgs(opts: {
         "-e",
         "VELLUM_WORKSPACE_DIR=/workspace",
         "-e",
+        "VELLUM_BACKUP_DIR=/workspace/.backups",
+        "-e",
+        "VELLUM_BACKUP_KEY_PATH=/workspace/.backup.key",
+        "-e",
         "CES_CREDENTIAL_URL=http://localhost:8090",
         "-e",
         `GATEWAY_INTERNAL_URL=http://localhost:${GATEWAY_INTERNAL_PORT}`,
@@ -596,6 +648,7 @@ export function serviceDockerRunArgs(opts: {
       }
       for (const envVar of [
         ...Object.values(PROVIDER_ENV_VAR_NAMES),
+        "VELLUM_ENVIRONMENT",
         "VELLUM_PLATFORM_URL",
       ]) {
         if (process.env[envVar]) {
@@ -644,6 +697,12 @@ export function serviceDockerRunArgs(opts: {
       ...(opts.bootstrapSecret
         ? ["-e", `GUARDIAN_BOOTSTRAP_SECRET=${opts.bootstrapSecret}`]
         : []),
+      ...(process.env.VELLUM_ENVIRONMENT
+        ? ["-e", `VELLUM_ENVIRONMENT=${process.env.VELLUM_ENVIRONMENT}`]
+        : []),
+      ...(process.env.VELLUM_PLATFORM_URL
+        ? ["-e", `VELLUM_PLATFORM_URL=${process.env.VELLUM_PLATFORM_URL}`]
+        : []),
       imageTags.gateway,
     ],
     "credential-executor": () => [
@@ -697,6 +756,16 @@ export async function startContainers(
   },
   log: (msg: string) => void,
 ): Promise<void> {
+  // Ensure the inner dockerd's data volume exists before mounting it.
+  // For instances hatched on Phase 1.10+, this is created in hatchDocker and
+  // is a no-op here. For instances that pre-date Phase 1.10 (DinD) and are
+  // upgrading in place, Docker would otherwise auto-create the volume on
+  // first `-v` mount without our standard ownership/labeling. Creating it
+  // explicitly keeps volume provenance consistent across fresh and upgraded
+  // instances. `docker volume create` is idempotent for an existing volume
+  // of the same name, so this is safe to run on every start.
+  await exec("docker", ["volume", "create", opts.res.dockerdDataVolume]);
+
   const runArgs = serviceDockerRunArgs(opts);
   for (const service of SERVICE_START_ORDER) {
     log(`🚀 Starting ${service} container...`);
@@ -1107,6 +1176,7 @@ export async function hatchDocker(
     await exec("docker", ["volume", "create", res.workspaceVolume]);
     await exec("docker", ["volume", "create", res.cesSecurityVolume]);
     await exec("docker", ["volume", "create", res.gatewaySecurityVolume]);
+    await exec("docker", ["volume", "create", res.dockerdDataVolume]);
 
     // Set workspace volume ownership so non-root containers (UID 1001) can write.
     await exec("docker", [
@@ -1162,7 +1232,6 @@ export async function hatchDocker(
       cloud: "docker",
       species,
       hatchedAt: new Date().toISOString(),
-      serviceGroupVersion: cliPkg.version ? `v${cliPkg.version}` : undefined,
       containerInfo: {
         assistantImage: imageTags.assistant,
         gatewayImage: imageTags.gateway,

package/src/lib/environments/__tests__/paths.test.ts

@@ -0,0 +1,234 @@
+import { afterEach, beforeEach, describe, expect, mock, test } from "bun:test";
+import { join } from "path";
+
+const TEST_HOME = "/test/home";
+
+// Mock homedir() so the helpers return predictable paths regardless of who
+// is running the test. `os.homedir()` is read once per process on Bun/Node
+// and does not reflect later $HOME changes, so setting process.env.HOME at
+// test time does not work — module mocking is the recommended pattern (see
+// cli/src/__tests__/multi-local.test.ts).
+const realOs = await import("node:os");
+mock.module("node:os", () => ({
+  ...realOs,
+  homedir: () => TEST_HOME,
+}));
+mock.module("os", () => ({
+  ...realOs,
+  homedir: () => TEST_HOME,
+}));
+
+// Imports that depend on the mocked `os` module must come after the
+// mock.module() calls above.
+const {
+  getConfigDir,
+  getDefaultPorts,
+  getLockfilePath,
+  getLockfilePaths,
+  getMultiInstanceDir,
+} = await import("../paths.js");
+type EnvironmentDefinition = import("../types.js").EnvironmentDefinition;
+
+const prod: EnvironmentDefinition = {
+  name: "production",
+  platformUrl: "https://platform.vellum.ai",
+};
+
+const dev: EnvironmentDefinition = {
+  name: "dev",
+  platformUrl: "https://dev-platform.vellum.ai",
+};
+
+const XDG_ENV_VARS = ["XDG_DATA_HOME", "XDG_CONFIG_HOME"] as const;
+
+describe("path helpers", () => {
+  let savedEnv: Record<string, string | undefined>;
+
+  beforeEach(() => {
+    savedEnv = {};
+    for (const key of XDG_ENV_VARS) {
+      savedEnv[key] = process.env[key];
+      delete process.env[key];
+    }
+  });
+
+  afterEach(() => {
+    for (const [key, value] of Object.entries(savedEnv)) {
+      if (value === undefined) {
+        delete process.env[key];
+      } else {
+        process.env[key] = value;
+      }
+    }
+  });
+
+  describe("getConfigDir", () => {
+    test("production returns ~/.config/vellum/", () => {
+      expect(getConfigDir(prod)).toBe(join(TEST_HOME, ".config", "vellum"));
+    });
+
+    test("dev returns ~/.config/vellum-dev/", () => {
+      expect(getConfigDir(dev)).toBe(join(TEST_HOME, ".config", "vellum-dev"));
+    });
+
+    test("respects XDG_CONFIG_HOME for non-prod envs", () => {
+      process.env.XDG_CONFIG_HOME = "/custom/config";
+      expect(getConfigDir(dev)).toBe("/custom/config/vellum-dev");
+    });
+
+    test("respects XDG_CONFIG_HOME for production too", () => {
+      // Production's XDG config dir already follows XDG conventions, so the
+      // standard XDG override applies.
+      process.env.XDG_CONFIG_HOME = "/custom/config";
+      expect(getConfigDir(prod)).toBe("/custom/config/vellum");
+    });
+
+    test("respects env.configDirOverride", () => {
+      const env: EnvironmentDefinition = {
+        ...dev,
+        configDirOverride: "/tmp/cfg",
+      };
+      expect(getConfigDir(env)).toBe("/tmp/cfg");
+    });
+  });
+
+  describe("getLockfilePath", () => {
+    test("production returns ~/.vellum.lock.json", () => {
+      expect(getLockfilePath(prod)).toBe(join(TEST_HOME, ".vellum.lock.json"));
+    });
+
+    test("dev returns ~/.config/vellum-dev/lockfile.json", () => {
+      expect(getLockfilePath(dev)).toBe(
+        join(TEST_HOME, ".config", "vellum-dev", "lockfile.json"),
+      );
+    });
+
+    test("non-prod respects configDirOverride", () => {
+      const env: EnvironmentDefinition = {
+        ...dev,
+        configDirOverride: "/tmp/cfg",
+      };
+      expect(getLockfilePath(env)).toBe("/tmp/cfg/lockfile.json");
+    });
+
+    test("production respects lockfileDirOverride", () => {
+      const env: EnvironmentDefinition = {
+        ...prod,
+        lockfileDirOverride: "/tmp/lock",
+      };
+      expect(getLockfilePath(env)).toBe("/tmp/lock/.vellum.lock.json");
+    });
+
+    test("non-prod respects lockfileDirOverride (overrides configDir)", () => {
+      const env: EnvironmentDefinition = {
+        ...dev,
+        configDirOverride: "/tmp/cfg",
+        lockfileDirOverride: "/tmp/lock",
+      };
+      expect(getLockfilePath(env)).toBe("/tmp/lock/lockfile.json");
+    });
+  });
+
+  describe("getLockfilePaths", () => {
+    test("production returns both current and legacy filenames in priority order", () => {
+      expect(getLockfilePaths(prod)).toEqual([
+        join(TEST_HOME, ".vellum.lock.json"),
+        join(TEST_HOME, ".vellum.lockfile.json"),
+      ]);
+    });
+
+    test("non-prod returns a single canonical path", () => {
+      expect(getLockfilePaths(dev)).toEqual([
+        join(TEST_HOME, ".config", "vellum-dev", "lockfile.json"),
+      ]);
+    });
+
+    test("production with lockfileDirOverride applies to both candidates", () => {
+      const env: EnvironmentDefinition = {
+        ...prod,
+        lockfileDirOverride: "/tmp/lock",
+      };
+      expect(getLockfilePaths(env)).toEqual([
+        "/tmp/lock/.vellum.lock.json",
+        "/tmp/lock/.vellum.lockfile.json",
+      ]);
+    });
+
+    test("non-prod with lockfileDirOverride overrides the config dir", () => {
+      const env: EnvironmentDefinition = {
+        ...dev,
+        lockfileDirOverride: "/tmp/lock",
+      };
+      expect(getLockfilePaths(env)).toEqual(["/tmp/lock/lockfile.json"]);
+    });
+
+    test("getLockfilePath returns the first entry from getLockfilePaths", () => {
+      expect(getLockfilePath(prod)).toBe(getLockfilePaths(prod)[0]);
+      expect(getLockfilePath(dev)).toBe(getLockfilePaths(dev)[0]);
+    });
+  });
+
+  describe("getMultiInstanceDir", () => {
+    test("production returns ~/.local/share/vellum/assistants", () => {
+      expect(getMultiInstanceDir(prod)).toBe(
+        join(TEST_HOME, ".local", "share", "vellum", "assistants"),
+      );
+    });
+
+    test("dev returns ~/.local/share/vellum-dev/assistants", () => {
+      expect(getMultiInstanceDir(dev)).toBe(
+        join(TEST_HOME, ".local", "share", "vellum-dev", "assistants"),
+      );
+    });
+
+    test("respects XDG_DATA_HOME", () => {
+      process.env.XDG_DATA_HOME = "/custom/data";
+      expect(getMultiInstanceDir(dev)).toBe(
+        "/custom/data/vellum-dev/assistants",
+      );
+    });
+  });
+
+  describe("getDefaultPorts", () => {
+    test("returns production defaults for production", () => {
+      const ports = getDefaultPorts(prod);
+      expect(ports.daemon).toBe(7821);
+      expect(ports.gateway).toBe(7830);
+      expect(ports.qdrant).toBe(6333);
+      expect(ports.ces).toBe(8090);
+      expect(ports.outboundProxy).toBe(8080);
+      expect(ports.tcp).toBe(8765);
+    });
+
+    test("returns identical defaults for dev (Phase 5 deferred)", () => {
+      expect(getDefaultPorts(dev)).toEqual(getDefaultPorts(prod));
+    });
+
+    test("returns identical defaults for staging", () => {
+      const staging: EnvironmentDefinition = {
+        name: "staging",
+        platformUrl: "https://staging-platform.vellum.ai",
+      };
+      expect(getDefaultPorts(staging)).toEqual(getDefaultPorts(prod));
+    });
+
+    test("merges env.portsOverride on top of defaults", () => {
+      const env: EnvironmentDefinition = {
+        ...dev,
+        portsOverride: { daemon: 9999, gateway: 9998 },
+      };
+      const ports = getDefaultPorts(env);
+      expect(ports.daemon).toBe(9999);
+      expect(ports.gateway).toBe(9998);
+      expect(ports.qdrant).toBe(6333);
+      expect(ports.ces).toBe(8090);
+    });
+
+    test("returns a fresh object — mutations do not affect future calls", () => {
+      const first = getDefaultPorts(prod);
+      first.daemon = 1;
+      const second = getDefaultPorts(prod);
+      expect(second.daemon).toBe(7821);
+    });
+  });
+});

package/src/lib/environments/__tests__/resolve.test.ts

@@ -0,0 +1,226 @@
+import { afterEach, beforeEach, describe, expect, spyOn, test } from "bun:test";
+
+import { getCurrentEnvironment, getSeed } from "../resolve.js";
+
+const ENV_VARS_TO_SAVE = [
+  "VELLUM_ENVIRONMENT",
+  "VELLUM_PLATFORM_URL",
+  "VELLUM_ASSISTANT_PLATFORM_URL",
+  "VELLUM_LOCKFILE_DIR",
+] as const;
+
+describe("getCurrentEnvironment", () => {
+  let savedEnv: Record<string, string | undefined>;
+
+  beforeEach(() => {
+    savedEnv = {};
+    for (const key of ENV_VARS_TO_SAVE) {
+      savedEnv[key] = process.env[key];
+      delete process.env[key];
+    }
+  });
+
+  afterEach(() => {
+    for (const [key, value] of Object.entries(savedEnv)) {
+      if (value === undefined) {
+        delete process.env[key];
+      } else {
+        process.env[key] = value;
+      }
+    }
+  });
+
+  test("returns production seed when no override, no env var", () => {
+    const env = getCurrentEnvironment();
+    expect(env.name).toBe("production");
+    expect(env.platformUrl).toBe("https://platform.vellum.ai");
+  });
+
+  test("returns dev seed when VELLUM_ENVIRONMENT=dev", () => {
+    process.env.VELLUM_ENVIRONMENT = "dev";
+    const env = getCurrentEnvironment();
+    expect(env.name).toBe("dev");
+    expect(env.platformUrl).toBe("https://dev-platform.vellum.ai");
+  });
+
+  test("returns staging seed when VELLUM_ENVIRONMENT=staging", () => {
+    process.env.VELLUM_ENVIRONMENT = "staging";
+    expect(getCurrentEnvironment().platformUrl).toBe(
+      "https://staging-platform.vellum.ai",
+    );
+  });
+
+  test("returns local seed with localhost URL", () => {
+    process.env.VELLUM_ENVIRONMENT = "local";
+    expect(getCurrentEnvironment().platformUrl).toBe("http://localhost:8000");
+  });
+
+  test("override argument takes priority over VELLUM_ENVIRONMENT env var", () => {
+    process.env.VELLUM_ENVIRONMENT = "staging";
+    const env = getCurrentEnvironment("dev");
+    expect(env.name).toBe("dev");
+    expect(env.platformUrl).toBe("https://dev-platform.vellum.ai");
+  });
+
+  test("empty override argument falls through to env var", () => {
+    process.env.VELLUM_ENVIRONMENT = "dev";
+    const env = getCurrentEnvironment("");
+    expect(env.name).toBe("dev");
+  });
+
+  test("whitespace-only override argument falls through to env var", () => {
+    process.env.VELLUM_ENVIRONMENT = "dev";
+    const env = getCurrentEnvironment("   ");
+    expect(env.name).toBe("dev");
+  });
+
+  test("falls back to production seed for unknown env name via override, warns on stderr", () => {
+    const stderr = spyOn(process.stderr, "write").mockImplementation(
+      () => true,
+    );
+    try {
+      const env = getCurrentEnvironment("no-such-env");
+      expect(env.name).toBe("production");
+      expect(env.platformUrl).toBe("https://platform.vellum.ai");
+      expect(stderr).toHaveBeenCalledWith(
+        expect.stringContaining('unknown environment "no-such-env"'),
+      );
+      expect(stderr).toHaveBeenCalledWith(
+        expect.stringContaining('falling back to "production"'),
+      );
+    } finally {
+      stderr.mockRestore();
+    }
+  });
+
+  test("falls back to production seed for unknown env name via env var, warns on stderr", () => {
+    process.env.VELLUM_ENVIRONMENT = "nope";
+    const stderr = spyOn(process.stderr, "write").mockImplementation(
+      () => true,
+    );
+    try {
+      const env = getCurrentEnvironment();
+      expect(env.name).toBe("production");
+      expect(env.platformUrl).toBe("https://platform.vellum.ai");
+      expect(stderr).toHaveBeenCalledWith(
+        expect.stringContaining('unknown environment "nope"'),
+      );
+    } finally {
+      stderr.mockRestore();
+    }
+  });
+
+  test("VELLUM_ENVIRONMENT=production does not emit a warning", () => {
+    process.env.VELLUM_ENVIRONMENT = "production";
+    const stderr = spyOn(process.stderr, "write").mockImplementation(
+      () => true,
+    );
+    try {
+      const env = getCurrentEnvironment();
+      expect(env.name).toBe("production");
+      expect(stderr).not.toHaveBeenCalled();
+    } finally {
+      stderr.mockRestore();
+    }
+  });
+
+  test("VELLUM_PLATFORM_URL overrides platformUrl on the resolved definition", () => {
+    process.env.VELLUM_ENVIRONMENT = "dev";
+    process.env.VELLUM_PLATFORM_URL = "https://custom.example.com";
+    const env = getCurrentEnvironment();
+    expect(env.name).toBe("dev");
+    expect(env.platformUrl).toBe("https://custom.example.com");
+  });
+
+  test("VELLUM_PLATFORM_URL override does not affect the seed table", () => {
+    process.env.VELLUM_PLATFORM_URL = "https://custom.example.com";
+    getCurrentEnvironment();
+    delete process.env.VELLUM_PLATFORM_URL;
+    const env = getCurrentEnvironment();
+    expect(env.platformUrl).toBe("https://platform.vellum.ai");
+  });
+
+  test("VELLUM_ASSISTANT_PLATFORM_URL overrides assistantPlatformUrl", () => {
+    process.env.VELLUM_ASSISTANT_PLATFORM_URL =
+      "http://host.docker.internal:8000";
+    const env = getCurrentEnvironment();
+    expect(env.assistantPlatformUrl).toBe("http://host.docker.internal:8000");
+  });
+
+  test("VELLUM_ASSISTANT_PLATFORM_URL does not shadow platformUrl", () => {
+    process.env.VELLUM_ASSISTANT_PLATFORM_URL = "http://override";
+    const env = getCurrentEnvironment();
+    expect(env.platformUrl).toBe("https://platform.vellum.ai");
+  });
+
+  test("does not auto-materialize a new environment from VELLUM_PLATFORM_URL alone", () => {
+    // Unknown env names fall back to production (parity with daemon + Swift).
+    // The per-field VELLUM_PLATFORM_URL override is intentionally dropped on
+    // the fallback path — fallback returns a pristine production seed so a
+    // typo'd env var can't accidentally stitch together a new environment.
+    process.env.VELLUM_ENVIRONMENT = "my-custom";
+    process.env.VELLUM_PLATFORM_URL = "https://my-custom.example.com";
+    const stderr = spyOn(process.stderr, "write").mockImplementation(
+      () => true,
+    );
+    try {
+      const env = getCurrentEnvironment();
+      expect(env.name).toBe("production");
+      expect(env.platformUrl).toBe("https://platform.vellum.ai");
+      expect(stderr).toHaveBeenCalledWith(
+        expect.stringContaining('unknown environment "my-custom"'),
+      );
+    } finally {
+      stderr.mockRestore();
+    }
+  });
+
+  test("VELLUM_LOCKFILE_DIR populates lockfileDirOverride on the resolved definition", () => {
+    process.env.VELLUM_LOCKFILE_DIR = "/tmp/test-lockfile-dir";
+    const env = getCurrentEnvironment();
+    expect(env.lockfileDirOverride).toBe("/tmp/test-lockfile-dir");
+  });
+
+  test("lockfileDirOverride is undefined when VELLUM_LOCKFILE_DIR is unset", () => {
+    const env = getCurrentEnvironment();
+    expect(env.lockfileDirOverride).toBeUndefined();
+  });
+
+  test("lockfileDirOverride applies to non-prod envs too", () => {
+    process.env.VELLUM_ENVIRONMENT = "dev";
+    process.env.VELLUM_LOCKFILE_DIR = "/tmp/test-lockfile-dir";
+    const env = getCurrentEnvironment();
+    expect(env.name).toBe("dev");
+    expect(env.lockfileDirOverride).toBe("/tmp/test-lockfile-dir");
+  });
+});
+
+describe("getSeed", () => {
+  test("returns a definition for a known seed", () => {
+    const seed = getSeed("dev");
+    expect(seed).toBeDefined();
+    expect(seed?.name).toBe("dev");
+    expect(seed?.platformUrl).toBe("https://dev-platform.vellum.ai");
+  });
+
+  test("returns undefined for an unknown name", () => {
+    expect(getSeed("no-such-env")).toBeUndefined();
+  });
+
+  test("returned seed is a copy — mutations do not affect the table", () => {
+    const seed = getSeed("dev");
+    if (seed) {
+      seed.platformUrl = "mutated";
+    }
+    const second = getSeed("dev");
+    expect(second?.platformUrl).toBe("https://dev-platform.vellum.ai");
+  });
+
+  test("all five canonical seeds exist", () => {
+    expect(getSeed("production")).toBeDefined();
+    expect(getSeed("staging")).toBeDefined();
+    expect(getSeed("test")).toBeDefined();
+    expect(getSeed("dev")).toBeDefined();
+    expect(getSeed("local")).toBeDefined();
+  });
+});