@vellumai/cli 0.8.10-dev.202606110059.319a8d3 → 0.8.10-dev.202606110240.ef9212e

package/node_modules/@vellumai/local-mode/src/lockfile.test.ts

@@ -207,6 +207,175 @@ describe("replacePlatformAssistants", () => {
     expect(ids).toEqual(["asst_local", "asst_new_platform"]);
   });
 
+  test("a sync scoped to one org preserves another org's platform entries", () => {
+    writeOnDisk({
+      activeAssistant: null,
+      assistants: [
+        {
+          assistantId: "asst_org_a",
+          cloud: "vellum",
+          organizationId: "org_a",
+          runtimeUrl: "http://a",
+        },
+        {
+          assistantId: "asst_org_b_old",
+          cloud: "vellum",
+          organizationId: "org_b",
+          runtimeUrl: "http://bo",
+        },
+      ],
+    });
+
+    replacePlatformAssistants(
+      [lockfilePath],
+      [
+        {
+          assistantId: "asst_org_b_new",
+          cloud: "vellum",
+          organizationId: "org_b",
+          runtimeUrl: "http://bn",
+        },
+      ],
+      "org_b",
+    );
+
+    const ids = (readOnDisk().assistants as Array<Record<string, unknown>>).map(
+      (a) => a.assistantId,
+    );
+    // Org A survives; Org B's stale entry is replaced by the new one.
+    expect(ids).toEqual(["asst_org_a", "asst_org_b_new"]);
+  });
+
+  test("de-duplicates a legacy no-org entry that shares an id with the new list", () => {
+    writeOnDisk({
+      activeAssistant: null,
+      assistants: [
+        // Legacy platform entry with no organizationId, same id as the sync.
+        { assistantId: "asst_dup", cloud: "vellum", runtimeUrl: "http://old" },
+      ],
+    });
+
+    replacePlatformAssistants(
+      [lockfilePath],
+      [
+        {
+          assistantId: "asst_dup",
+          cloud: "vellum",
+          organizationId: "org_a",
+          runtimeUrl: "http://new",
+        },
+      ],
+      "org_a",
+    );
+
+    const assistants = readOnDisk().assistants as Array<Record<string, unknown>>;
+    expect(assistants).toHaveLength(1);
+    expect(assistants[0]).toMatchObject({
+      assistantId: "asst_dup",
+      organizationId: "org_a",
+      runtimeUrl: "http://new",
+    });
+  });
+
+  test("full-replaces all platform entries when no org is given (legacy)", () => {
+    writeOnDisk({
+      activeAssistant: null,
+      assistants: [
+        {
+          assistantId: "asst_org_a",
+          cloud: "vellum",
+          organizationId: "org_a",
+          runtimeUrl: "http://a",
+        },
+        {
+          assistantId: "asst_org_b",
+          cloud: "vellum",
+          organizationId: "org_b",
+          runtimeUrl: "http://b",
+        },
+      ],
+    });
+
+    replacePlatformAssistants(
+      [lockfilePath],
+      [
+        {
+          assistantId: "asst_new",
+          cloud: "vellum",
+          runtimeUrl: "http://np",
+        },
+      ],
+    );
+
+    const ids = (readOnDisk().assistants as Array<Record<string, unknown>>).map(
+      (a) => a.assistantId,
+    );
+    expect(ids).toEqual(["asst_new"]);
+  });
+
+  test("local entries always survive an org-scoped sync", () => {
+    writeOnDisk({
+      activeAssistant: null,
+      assistants: [
+        { assistantId: "asst_local", cloud: "local", runtimeUrl: "http://l" },
+        {
+          assistantId: "asst_org_a",
+          cloud: "vellum",
+          organizationId: "org_a",
+          runtimeUrl: "http://a",
+        },
+      ],
+    });
+
+    replacePlatformAssistants(
+      [lockfilePath],
+      [
+        {
+          assistantId: "asst_org_a_new",
+          cloud: "vellum",
+          organizationId: "org_a",
+          runtimeUrl: "http://an",
+        },
+      ],
+      "org_a",
+    );
+
+    const ids = (readOnDisk().assistants as Array<Record<string, unknown>>).map(
+      (a) => a.assistantId,
+    );
+    expect(ids).toEqual(["asst_local", "asst_org_a_new"]);
+  });
+
+  test("keeps activeAssistant when it still resolves after an org-scoped sync", () => {
+    writeOnDisk({
+      activeAssistant: "asst_org_b_old",
+      assistants: [
+        {
+          assistantId: "asst_org_b_old",
+          cloud: "vellum",
+          organizationId: "org_b",
+          runtimeUrl: "http://bo",
+        },
+      ],
+    });
+
+    replacePlatformAssistants(
+      [lockfilePath],
+      [
+        {
+          assistantId: "asst_org_a",
+          cloud: "vellum",
+          organizationId: "org_a",
+          runtimeUrl: "http://a",
+        },
+      ],
+      "org_a",
+    );
+
+    // Org B's entry (and the active id pointing at it) survives the org-A sync.
+    expect(readOnDisk().activeAssistant).toBe("asst_org_b_old");
+  });
+
   test("clears activeAssistant when the active id no longer exists", () => {
     writeOnDisk({
       activeAssistant: "asst_old_platform",

package/node_modules/@vellumai/local-mode/src/lockfile.ts

@@ -106,6 +106,7 @@ export function isActiveAssistant(
 export function replacePlatformAssistants(
   lockfilePaths: string[],
   platformAssistants: Array<Record<string, unknown>>,
+  organizationId?: string,
 ): WriteResult {
   let lockfile: Record<string, unknown> = { assistants: [], activeAssistant: null };
   for (const candidate of lockfilePaths) {
@@ -118,10 +119,14 @@ export function replacePlatformAssistants(
   }
 
   const existing = Array.isArray(lockfile.assistants) ? lockfile.assistants : [];
-  const local = existing.filter(
-    (a: Record<string, unknown>) => a?.cloud !== "vellum",
-  );
-  lockfile.assistants = [...local, ...platformAssistants];
+  const syncedIds = new Set(platformAssistants.map((a) => a.assistantId));
+  // Org-scoped sync preserves other orgs' platform entries; no org full-replaces.
+  const preserved = existing.filter((a: Record<string, unknown>) => {
+    if (a?.cloud !== "vellum") return true;
+    if (syncedIds.has(a.assistantId)) return false;
+    return organizationId != null && a.organizationId !== organizationId;
+  });
+  lockfile.assistants = [...preserved, ...platformAssistants];
 
   const active = lockfile.activeAssistant as string | null;
   if (active) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vellumai/cli",
-  "version": "0.8.10-dev.202606110059.319a8d3",
+  "version": "0.8.10-dev.202606110240.ef9212e",
   "description": "CLI tools for vellum-assistant",
   "type": "module",
   "exports": {

package/src/__tests__/upgrade-replay-env.test.ts

@@ -130,6 +130,22 @@ describe("buildReplayState", () => {
     expect(state.extraGatewayEnv.VELLUM_DEVICE_ID).toBe("existing");
   });
 
+  test("backfills VELLUM_DEVICE_ID on assistant replay env when absent", () => {
+    const state = buildReplayState({}, {});
+    expect(state.extraAssistantEnv.VELLUM_DEVICE_ID).toBe("host-device-id");
+  });
+
+  test("assistant backfill inherits captured gateway VELLUM_DEVICE_ID", () => {
+    const state = buildReplayState({}, { VELLUM_DEVICE_ID: "gw-captured" });
+    expect(state.extraGatewayEnv.VELLUM_DEVICE_ID).toBe("gw-captured");
+    expect(state.extraAssistantEnv.VELLUM_DEVICE_ID).toBe("gw-captured");
+  });
+
+  test("captured assistant VELLUM_DEVICE_ID wins over host-derived id", () => {
+    const state = buildReplayState({ VELLUM_DEVICE_ID: "existing" }, {});
+    expect(state.extraAssistantEnv.VELLUM_DEVICE_ID).toBe("existing");
+  });
+
   test("plucks secrets from the captured envs", () => {
     const state = buildReplayState(
       { CES_SERVICE_TOKEN: "ces-token", ACTOR_TOKEN_SIGNING_KEY: "sign-key" },

package/src/commands/client.ts

@@ -458,6 +458,7 @@ async function handleLocalEndpoints(
         result = replacePlatformAssistants(
           lockfilePaths,
           body.platformAssistants as Array<Record<string, unknown>>,
+          body.organizationId as string | undefined,
         );
       } else {
         result = upsertLockfileAssistant(

package/src/lib/docker.ts

@@ -1332,9 +1332,11 @@ export async function hatchDocker(
       extraAssistantEnv.VELLUM_DISABLE_PLATFORM =
         flagEnvVars.VELLUM_DISABLE_PLATFORM;
     }
+    const hostDeviceId = getOrCreateHostDeviceId();
+    extraAssistantEnv.VELLUM_DEVICE_ID = hostDeviceId;
     const extraGatewayEnv = {
       ...flagEnvVars,
-      VELLUM_DEVICE_ID: getOrCreateHostDeviceId(),
+      VELLUM_DEVICE_ID: hostDeviceId,
     };
     await startContainers(
       {

package/src/lib/upgrade-lifecycle.ts

@@ -219,8 +219,8 @@ interface ReplayState {
  * already-captured assistant/gateway envs. GUARDIAN_BOOTSTRAP_SECRET is only
  * set on the gateway; CES_SERVICE_TOKEN and ACTOR_TOKEN_SIGNING_KEY fall back
  * to fresh values for instances that predate them. VELLUM_DEVICE_ID is
- * backfilled from the host for gateways hatched before device-id injection
- * (captured value wins — it was itself host-derived).
+ * backfilled on the gateway from the host, and the assistant inherits the
+ * gateway's value (captured values win) so the pair always matches.
  */
 export function buildReplayState(
   capturedEnv: Record<string, string>,
@@ -229,13 +229,16 @@ export function buildReplayState(
   const extraGatewayEnv = buildReplayEnv(gatewayEnv, "gateway");
   extraGatewayEnv.VELLUM_DEVICE_ID ??= getOrCreateHostDeviceId();
 
+  const extraAssistantEnv = buildReplayEnv(capturedEnv, "assistant");
+  extraAssistantEnv.VELLUM_DEVICE_ID ??= extraGatewayEnv.VELLUM_DEVICE_ID;
+
   return {
     bootstrapSecret: gatewayEnv["GUARDIAN_BOOTSTRAP_SECRET"],
     cesServiceToken:
       capturedEnv["CES_SERVICE_TOKEN"] || randomBytes(32).toString("hex"),
     signingKey:
       capturedEnv["ACTOR_TOKEN_SIGNING_KEY"] || randomBytes(32).toString("hex"),
-    extraAssistantEnv: buildReplayEnv(capturedEnv, "assistant"),
+    extraAssistantEnv,
     extraGatewayEnv,
   };
 }