@vellumai/cli 0.6.6 → 0.7.1

package/src/commands/login.ts

@@ -3,9 +3,11 @@ import { spawn } from "child_process";
 import { randomBytes } from "crypto";
 
 import {
-  findAssistantByName,
   getActiveAssistant,
-  loadLatestAssistant,
+  resolveAssistant,
+  loadAllAssistants,
+  removeAssistantEntry,
+  setActiveAssistant,
 } from "../lib/assistant-config";
 import { computeDeviceId } from "../lib/guardian-token";
 import {
@@ -13,13 +15,16 @@ import {
   ensureSelfHostedLocalRegistration,
   fetchCurrentUser,
   fetchOrganizationId,
+  fetchPlatformAssistants,
   getPlatformUrl,
+  getWebUrl,
   injectCredentialsIntoAssistant,
   readGatewayCredential,
   readPlatformToken,
   reprovisionAssistantApiKey,
   savePlatformToken,
 } from "../lib/platform-client";
+import { syncCloudAssistants } from "../lib/sync-cloud-assistants";
 
 const LOGIN_TIMEOUT_MS = 120_000; // 2 minutes
 
@@ -45,7 +50,7 @@ function openBrowser(url: string): void {
  * Start a local HTTP server, open the browser to the platform login page,
  * and wait for the platform to redirect back with the session token.
  */
-function browserLogin(platformUrl: string): Promise<string> {
+function browserLogin(webUrl: string): Promise<string> {
   return new Promise((resolve, reject) => {
     const state = randomBytes(32).toString("hex");
 
@@ -112,7 +117,7 @@ function browserLogin(platformUrl: string): Promise<string> {
 
       const port = addr.port;
       const returnTo = `/accounts/cli/callback?port=${port}&state=${state}`;
-      const loginUrl = `${platformUrl}/account/login?returnTo=${encodeURIComponent(returnTo)}`;
+      const loginUrl = `${webUrl}/account/login?returnTo=${encodeURIComponent(returnTo)}`;
 
       console.log("Opening browser for login...");
       console.log(`If the browser doesn't open, visit: ${loginUrl}`);
@@ -125,22 +130,30 @@ export async function login(): Promise<void> {
   const args = process.argv.slice(3);
 
   if (args.includes("--help") || args.includes("-h")) {
-    console.log("Usage: vellum login [--token <session-token>]");
+    console.log("Usage: vellum login [--token <session-token>] [--force]");
     console.log("");
     console.log("Log in to the Vellum platform.");
     console.log("");
     console.log("By default, opens a browser window for authentication.");
     console.log("Alternatively, pass a session token directly with --token.");
     console.log("");
+    console.log("On success, syncs cloud-managed assistants to the local");
+    console.log("lockfile so they appear in `vellum ps`.");
+    console.log("");
     console.log("Options:");
     console.log("  --token <token>    Session token from the Vellum platform");
+    console.log(
+      "  --force, -f        Re-authenticate even if already logged in",
+    );
     console.log("");
     console.log("Examples:");
     console.log("  vellum login");
     console.log("  vellum login --token <session-token>");
+    console.log("  vellum login --force");
     process.exit(0);
   }
 
+  const forceFlag = args.includes("--force") || args.includes("-f");
   let token: string | null = null;
 
   for (let i = 0; i < args.length; i++) {
@@ -154,11 +167,27 @@ export async function login(): Promise<void> {
     }
   }
 
+  // Block if already authenticated (unless --force)
+  if (!forceFlag && !token) {
+    const existingToken = readPlatformToken();
+    if (existingToken) {
+      try {
+        const existingUser = await fetchCurrentUser(existingToken);
+        console.error(
+          `Already logged in as ${existingUser.email}. Run \`vellum logout\` first, or use \`vellum login --force\` to re-authenticate.`,
+        );
+        process.exit(1);
+      } catch {
+        // Token is stale/invalid — proceed with login
+      }
+    }
+  }
+
   // If no --token flag, use browser-based login
   if (!token) {
-    const platformUrl = getPlatformUrl();
+    const webUrl = getWebUrl();
     try {
-      token = await browserLogin(platformUrl);
+      token = await browserLogin(webUrl);
     } catch (error) {
       console.error(`❌ ${error instanceof Error ? error.message : error}`);
       process.exit(1);
@@ -175,10 +204,7 @@ export async function login(): Promise<void> {
     // Register the local assistant with the platform (non-fatal).
     // Mirrors the desktop app's LocalAssistantBootstrapService flow.
     try {
-      const activeName = getActiveAssistant();
-      const entry = activeName
-        ? findAssistantByName(activeName)
-        : loadLatestAssistant();
+      const entry = resolveAssistant();
 
       // Skip managed ("vellum") assistants — they are handled by the platform.
       if (entry && entry.cloud !== "vellum") {
@@ -247,6 +273,31 @@ export async function login(): Promise<void> {
     } catch {
       // Non-fatal — login succeeded even if registration fails
     }
+
+    // Sync cloud assistants from the platform into the local lockfile.
+    // This ensures `vellum ps` shows managed assistants immediately
+    // after login (e.g. after a retire-and-rehatch cycle).
+    try {
+      const result = await syncCloudAssistants();
+      if (result) {
+        const total = result.added + result.removed;
+        if (total > 0) {
+          console.log(
+            `Synced cloud assistants (${result.added} added, ${result.removed} removed).`,
+          );
+        }
+      }
+
+      // If no active assistant is set, activate the first cloud one.
+      if (!getActiveAssistant()) {
+        const platformAssistants = await fetchPlatformAssistants(token);
+        if (platformAssistants.length > 0) {
+          setActiveAssistant(platformAssistants[0].id);
+        }
+      }
+    } catch {
+      // Non-fatal — login succeeded even if sync fails
+    }
   } catch (error) {
     console.error(
       `❌ Login failed: ${error instanceof Error ? error.message : error}`,
@@ -261,11 +312,25 @@ export async function logout(): Promise<void> {
     console.log("Usage: vellum logout");
     console.log("");
     console.log(
-      "Log out of the Vellum platform and remove the stored session token.",
+      "Log out of the Vellum platform, remove the stored session token,",
     );
+    console.log("and remove cloud-managed assistants from the local lockfile.");
     process.exit(0);
   }
 
+  // Remove cloud-managed assistants from the lockfile.
+  const cloudAssistants = loadAllAssistants().filter(
+    (a) => a.cloud === "vellum",
+  );
+  for (const a of cloudAssistants) {
+    removeAssistantEntry(a.assistantId);
+  }
+  if (cloudAssistants.length > 0) {
+    console.log(
+      `Removed ${cloudAssistants.length} cloud assistant${cloudAssistants.length > 1 ? "s" : ""} from local lockfile.`,
+    );
+  }
+
   clearPlatformToken();
   console.log("Logged out. Platform token removed.");
 }

package/src/commands/logs.ts

@@ -4,10 +4,7 @@ import { createInterface } from "readline";
 import { watch } from "fs";
 import { join } from "path";
 
-import {
-  findAssistantByName,
-  loadLatestAssistant,
-} from "../lib/assistant-config";
+import { resolveAssistant } from "../lib/assistant-config";
 import type { AssistantEntry } from "../lib/assistant-config";
 import { dockerResourceNames } from "../lib/docker";
 import { getLogDir } from "../lib/xdg-log";
@@ -593,9 +590,7 @@ async function showAwsLogs(
 export async function logs(): Promise<void> {
   const opts = parseArgs();
 
-  const entry = opts.name
-    ? findAssistantByName(opts.name)
-    : loadLatestAssistant();
+  const entry = resolveAssistant(opts.name);
 
   if (!entry) {
     if (opts.name) {

package/src/commands/ps.ts

@@ -3,11 +3,18 @@ import { join } from "path";
 import {
   findAssistantByName,
   getActiveAssistant,
+  getDaemonPidPath,
   loadAllAssistants,
   type AssistantEntry,
 } from "../lib/assistant-config";
+import { resolveEnvironmentSource } from "../lib/environments/resolve";
 import { loadGuardianToken } from "../lib/guardian-token";
-import { checkHealth, checkManagedHealth } from "../lib/health-check";
+import {
+  checkHealth,
+  checkManagedHealth,
+  fetchManagedPs,
+  type ManagedProcessEntry,
+} from "../lib/health-check";
 import { dockerResourceNames } from "../lib/docker";
 import { existsSync } from "fs";
 import {
@@ -21,6 +28,10 @@ import { pgrepExact } from "../lib/pgrep";
 import { probePort } from "../lib/port-probe";
 import { withStatusEmoji } from "../lib/status-emoji";
 import { execOutput } from "../lib/step-runner";
+import {
+  syncCloudAssistants,
+  type SyncLogger,
+} from "../lib/sync-cloud-assistants";
 
 // ── Table formatting helpers ────────────────────────────────────
 
@@ -65,6 +76,49 @@ function printTable(rows: TableRow[]): void {
   }
 }
 
+// ── Managed process tree rendering ──────────────────────────────
+
+const STATUS_LABELS: Record<ManagedProcessEntry["status"], string> = {
+  running: "running",
+  not_running: "not running",
+  unreachable: "unreachable",
+};
+
+function flattenProcessTree(
+  entries: ManagedProcessEntry[],
+  depth = 0,
+): TableRow[] {
+  const rows: TableRow[] = [];
+  for (const entry of entries) {
+    const children = entry.children ?? [];
+
+    rows.push({
+      name:
+        depth === 0 ? entry.name : `${"  ".repeat(depth - 1)}├─ ${entry.name}`,
+      status: withStatusEmoji(STATUS_LABELS[entry.status]),
+      info: entry.info ?? "",
+    });
+
+    for (let j = 0; j < children.length; j++) {
+      const child = children[j];
+      const isLast = j === children.length - 1;
+      const prefix = `${"  ".repeat(depth)}${isLast ? "└─" : "├─"} ${child.name}`;
+      rows.push({
+        name: prefix,
+        status: withStatusEmoji(STATUS_LABELS[child.status]),
+        info: child.info ?? "",
+      });
+
+      // Recurse into grandchildren
+      const grandchildren = child.children ?? [];
+      if (grandchildren.length > 0) {
+        rows.push(...flattenProcessTree(grandchildren, depth + 2));
+      }
+    }
+  }
+  return rows;
+}
+
 // ── Remote process listing via SSH ──────────────────────────────
 
 const SSH_OPTS = [
@@ -215,37 +269,38 @@ async function getLocalProcesses(entry: AssistantEntry): Promise<TableRow[]> {
   const resources = entry.resources;
   const vellumDir = join(resources.instanceDir, ".vellum");
 
-  const specs: ProcessSpec[] = [
-    {
-      name: "assistant",
-      pgrepName: "vellum-daemon",
-      port: resources.daemonPort,
-      pidFile: resources.pidFile,
-    },
+  const assistantSpec: ProcessSpec = {
+    name: "assistant",
+    pgrepName: "vellum-daemon",
+    port: resources.daemonPort,
+    pidFile: getDaemonPidPath(resources),
+  };
+  const subSpecs: ProcessSpec[] = [
     {
-      name: "qdrant",
+      name: "├─ qdrant",
       pgrepName: "qdrant",
       port: resources.qdrantPort,
       pidFile: join(vellumDir, "workspace", "data", "qdrant", "qdrant.pid"),
     },
     {
-      name: "gateway",
-      pgrepName: "vellum-gateway",
-      port: resources.gatewayPort,
-      pidFile: join(vellumDir, "gateway.pid"),
-    },
-    {
-      name: "embed-worker",
+      name: "└─ embed-worker",
       pgrepName: "embed-worker",
       port: 0,
       pidFile: join(vellumDir, "workspace", "embed-worker.pid"),
     },
   ];
+  const gatewaySpec: ProcessSpec = {
+    name: "gateway",
+    pgrepName: "vellum-gateway",
+    port: resources.gatewayPort,
+    pidFile: join(vellumDir, "gateway.pid"),
+  };
 
-  const results = await Promise.all(specs.map(detectProcess));
+  const allSpecs = [assistantSpec, ...subSpecs, gatewaySpec];
+  const results = await Promise.all(allSpecs.map(detectProcess));
 
-  return results.map((proc) => ({
-    name: proc.name,
+  return results.map((proc, i) => ({
+    name: allSpecs[i].name,
     status: withStatusEmoji(proc.running ? "running" : "not running"),
     info: proc.running ? formatDetectionInfo(proc) : "not detected",
   }));
@@ -335,6 +390,28 @@ async function showAssistantProcesses(entry: AssistantEntry): Promise<void> {
     return;
   }
 
+  if (cloud === "vellum") {
+    console.log(`  Platform ID: ${entry.assistantId}\n`);
+
+    const psData = await fetchManagedPs(entry.runtimeUrl, entry.assistantId);
+
+    if (!psData) {
+      const rows: TableRow[] = [
+        {
+          name: "assistant",
+          status: withStatusEmoji("unreachable"),
+          info: "could not reach platform API — run `vellum login`",
+        },
+      ];
+      printTable(rows);
+      return;
+    }
+
+    const rows = flattenProcessTree(psData.processes);
+    printTable(rows);
+    return;
+  }
+
   if (cloud === "apple-container") {
     const mgmtSocket = entry.mgmtSocket as string | undefined;
     const socketAlive = mgmtSocket ? existsSync(mgmtSocket) : false;
@@ -395,7 +472,40 @@ async function showAssistantProcesses(entry: AssistantEntry): Promise<void> {
 
 // ── List all assistants (no arg) ────────────────────────────────
 
-async function listAllAssistants(): Promise<void> {
+async function listAllAssistants(verbose: boolean): Promise<void> {
+  const { name: envName, source: envSource } = resolveEnvironmentSource();
+  const sourceLabels: Record<typeof envSource, string> = {
+    flag: "--environment flag",
+    env: "VELLUM_ENVIRONMENT",
+    config: "~/.config/vellum/environment",
+    default: "default",
+  };
+  console.log(`Environment: ${envName} (${sourceLabels[envSource]})`);
+
+  const log: SyncLogger | undefined = verbose
+    ? (msg) => console.log(`  [verbose] ${msg}`)
+    : undefined;
+
+  // Refresh cloud assistants from the platform before listing.
+  const syncResult = await syncCloudAssistants({ log });
+
+  // Show platform login status
+  if (syncResult) {
+    const parts = [`Platform: logged in`];
+    if (syncResult.email) parts[0] += ` as ${syncResult.email}`;
+    if (syncResult.added > 0 || syncResult.removed > 0) {
+      const changes: string[] = [];
+      if (syncResult.added > 0) changes.push(`${syncResult.added} added`);
+      if (syncResult.removed > 0)
+        changes.push(`${syncResult.removed} removed`);
+      parts.push(`(${changes.join(", ")})`);
+    }
+    console.log(parts.join(" "));
+  } else {
+    console.log("Platform: not logged in");
+  }
+  console.log("");
+
   const assistants = loadAllAssistants();
   const activeId = getActiveAssistant();
 
@@ -454,7 +564,9 @@ async function listAllAssistants(): Promise<void> {
       let health: { status: string; detail: string | null; version?: string };
       const resources = a.resources;
       if (a.cloud === "local" && resources) {
-        const pid = readPidFile(resources.pidFile);
+        // TODO(ATL-306): Remove readPidFile/getDaemonPidPath in favor of
+        // fetching daemon PIDs via the health API (Gateway Security Migration).
+        const pid = readPidFile(getDaemonPidPath(resources));
         const alive = pid !== null && isProcessAlive(pid);
         if (!alive) {
           health = { status: "sleeping", detail: null };
@@ -515,21 +627,28 @@ async function listAllAssistants(): Promise<void> {
 export async function ps(): Promise<void> {
   const args = process.argv.slice(3);
   if (args.includes("--help") || args.includes("-h")) {
-    console.log("Usage: vellum ps [<name>]");
+    console.log("Usage: vellum ps [<name>] [--verbose]");
     console.log("");
     console.log(
       "List all assistants, or show processes for a specific assistant.",
     );
     console.log("");
     console.log("Arguments:");
-    console.log("  <name>    Show processes for the named assistant");
+    console.log("  <name>       Show processes for the named assistant");
+    console.log("");
+    console.log("Options:");
+    console.log(
+      "  --verbose    Show diagnostic logs (platform sync, auth issues)",
+    );
     process.exit(0);
   }
 
-  const assistantId = process.argv[3];
+  const verbose = args.includes("--verbose");
+  const positional = args.filter((a) => !a.startsWith("--"));
+  const assistantId = positional[0];
 
   if (!assistantId) {
-    await listAllAssistants();
+    await listAllAssistants(verbose);
     return;
   }
 

package/src/commands/restore.ts

@@ -9,13 +9,11 @@ import {
 import {
   readPlatformToken,
   rollbackPlatformAssistant,
-  platformImportPreflight,
-  platformImportBundle,
-  platformRequestUploadUrl,
+  platformRequestSignedUrl,
   platformUploadToSignedUrl,
   platformImportPreflightFromGcs,
   platformImportBundleFromGcs,
-  platformPollImportStatus,
+  platformPollJobStatus,
 } from "../lib/platform-client.js";
 import { performDockerRollback } from "../lib/upgrade-lifecycle.js";
 
@@ -181,24 +179,14 @@ async function restorePlatform(
     process.exit(1);
   }
 
-  // Step 1.5 — Upload to GCS via signed URL (with fallback to inline)
-  let bundleKey: string | null = null;
-  try {
-    const { uploadUrl, bundleKey: key } = await platformRequestUploadUrl(
-      token,
-      entry.runtimeUrl,
-    );
-    bundleKey = key;
-    console.log("Uploading bundle...");
-    await platformUploadToSignedUrl(uploadUrl, new Uint8Array(bundleData));
-  } catch (err) {
-    const msg = err instanceof Error ? err.message : String(err);
-    if (msg.includes("not available")) {
-      bundleKey = null;
-    } else {
-      throw err;
-    }
-  }
+  // Step 1.5 — Upload to GCS via signed URL
+  const { url: uploadUrl, bundleKey } = await platformRequestSignedUrl(
+    { operation: "upload" },
+    token,
+    entry.runtimeUrl,
+  );
+  console.log("Uploading bundle...");
+  await platformUploadToSignedUrl(uploadUrl, new Uint8Array(bundleData));
 
   // Step 2 — Dry-run path
   if (opts.dryRun) {
@@ -213,17 +201,11 @@ async function restorePlatform(
 
     let preflightResult: { statusCode: number; body: Record<string, unknown> };
     try {
-      preflightResult = bundleKey
-        ? await platformImportPreflightFromGcs(
-            bundleKey,
-            token,
-            entry.runtimeUrl,
-          )
-        : await platformImportPreflight(
-            new Uint8Array(bundleData),
-            token,
-            entry.runtimeUrl,
-          );
+      preflightResult = await platformImportPreflightFromGcs(
+        bundleKey,
+        token,
+        entry.runtimeUrl,
+      );
     } catch (err) {
       if (err instanceof Error && err.name === "TimeoutError") {
         console.error("Error: Preflight request timed out after 2 minutes.");
@@ -353,13 +335,11 @@ async function restorePlatform(
 
   let importResult: { statusCode: number; body: Record<string, unknown> };
   try {
-    importResult = bundleKey
-      ? await platformImportBundleFromGcs(bundleKey, token, entry.runtimeUrl)
-      : await platformImportBundle(
-          new Uint8Array(bundleData),
-          token,
-          entry.runtimeUrl,
-        );
+    importResult = await platformImportBundleFromGcs(
+      bundleKey,
+      token,
+      entry.runtimeUrl,
+    );
   } catch (err) {
     if (err instanceof Error && err.name === "TimeoutError") {
       console.error("Error: Import request timed out after 5 minutes.");
@@ -420,13 +400,9 @@ async function restorePlatform(
     while (Date.now() < deadline) {
       await new Promise((resolve) => setTimeout(resolve, POLL_INTERVAL_MS));
 
-      let status: {
-        status: string;
-        result?: Record<string, unknown>;
-        error?: string;
-      };
+      let status: Awaited<ReturnType<typeof platformPollJobStatus>>;
       try {
-        status = await platformPollImportStatus(jobId, token, entry.runtimeUrl);
+        status = await platformPollJobStatus(jobId, token, entry.runtimeUrl);
       } catch (err) {
         const msg = err instanceof Error ? err.message : String(err);
         if (msg.includes("not found")) {
@@ -451,7 +427,10 @@ async function restorePlatform(
       }
 
       if (status.status === "complete") {
-        importResult = { statusCode: 200, body: status.result ?? {} };
+        importResult = {
+          statusCode: 200,
+          body: (status.result as Record<string, unknown>) ?? {},
+        };
         break;
       }
 

package/src/commands/sleep.ts

@@ -1,7 +1,10 @@
 import { existsSync, readFileSync } from "fs";
 import { join } from "path";
 
-import { resolveTargetAssistant } from "../lib/assistant-config.js";
+import {
+  getDaemonPidPath,
+  resolveTargetAssistant,
+} from "../lib/assistant-config.js";
 import type { AssistantEntry } from "../lib/assistant-config.js";
 import { dockerResourceNames, sleepContainers } from "../lib/docker.js";
 import { isProcessAlive, stopProcessByPidFile } from "../lib/process";
@@ -93,7 +96,7 @@ export async function sleep(): Promise<void> {
     process.exit(1);
   }
   const resources = entry.resources;
-  const assistantPidFile = resources.pidFile;
+  const assistantPidFile = getDaemonPidPath(resources);
   const vellumDir = getAssistantRootDir(entry);
   const gatewayPidFile = join(vellumDir, "gateway.pid");
 

package/src/commands/ssh.ts

@@ -1,12 +1,11 @@
 import { spawn } from "child_process";
 
-import {
-  findAssistantByName,
-  loadLatestAssistant,
-} from "../lib/assistant-config";
+import { resolveAssistant } from "../lib/assistant-config";
 import type { AssistantEntry } from "../lib/assistant-config";
 import { dockerResourceNames } from "../lib/docker";
+import { getPlatformUrl, readPlatformToken } from "../lib/platform-client";
 import { sshAppleContainer } from "../lib/ssh-apple-container";
+import { interactiveSession } from "../lib/terminal-session";
 
 const SSH_OPTS = [
   "-o",
@@ -56,7 +55,7 @@ export async function ssh(): Promise<void> {
   }
 
   const name = process.argv[3];
-  const entry = name ? findAssistantByName(name) : loadLatestAssistant();
+  const entry = resolveAssistant(name);
 
   if (!entry) {
     if (name) {
@@ -121,8 +120,19 @@ export async function ssh(): Promise<void> {
       { stdio: "inherit" },
     );
   } else if (cloud === "vellum") {
-    console.error("SSH to Vellum-managed instances is not yet supported.");
-    process.exit(1);
+    const token = readPlatformToken();
+    if (!token) {
+      console.error(
+        "Not logged in. Run `vellum login` first to authenticate with the platform.",
+      );
+      process.exit(1);
+    }
+    await interactiveSession({
+      assistantId: entry.assistantId,
+      token,
+      platformUrl: getPlatformUrl(),
+    });
+    return;
   } else if (cloud === "custom") {
     const host = extractHostFromUrl(entry.runtimeUrl);
     const sshUser = entry.sshUser ?? "root";