@vellumai/cli 0.8.10-staging.1 → 0.8.11-staging.1

package/src/lib/assistant-client.ts

@@ -19,6 +19,7 @@ import {
   refreshGuardianToken,
   guardianTokenDueForRenewal,
 } from "./guardian-token.js";
+import { loopbackSafeFetch } from "./loopback-fetch.js";
 
 const DEFAULT_TIMEOUT_MS = 30_000;
 const FALLBACK_RUNTIME_URL = `http://127.0.0.1:${GATEWAY_PORT}`;
@@ -203,7 +204,7 @@ export class AssistantClient {
     const doFetch = (): Promise<Response> => {
       const headers = buildHeaders();
       if (opts?.signal) {
-        return fetch(url, {
+        return loopbackSafeFetch(url, {
           method,
           headers,
           body: jsonBody,
@@ -213,7 +214,7 @@ export class AssistantClient {
       const timeout = opts?.timeout ?? DEFAULT_TIMEOUT_MS;
       const controller = new AbortController();
       const timeoutId = setTimeout(() => controller.abort(), timeout);
-      return fetch(url, {
+      return loopbackSafeFetch(url, {
         method,
         headers,
         body: jsonBody,

package/src/lib/backup-ops.ts

@@ -13,6 +13,7 @@ import {
   loadGuardianToken,
   refreshGuardianToken,
 } from "./guardian-token.js";
+import { loopbackSafeFetch } from "./loopback-fetch.js";
 
 /** Default backup directory following XDG convention */
 export function getBackupsDir(): string {
@@ -66,7 +67,7 @@ export async function createBackup(
       return null;
     }
 
-    let response = await fetch(`${runtimeUrl}/v1/migrations/export`, {
+    let response = await loopbackSafeFetch(`${runtimeUrl}/v1/migrations/export`, {
       method: "POST",
       headers: {
         Authorization: `Bearer ${accessToken}`,
@@ -87,7 +88,7 @@ export async function createBackup(
         return null;
       }
       accessToken = refreshed.accessToken;
-      response = await fetch(`${runtimeUrl}/v1/migrations/export`, {
+      response = await loopbackSafeFetch(`${runtimeUrl}/v1/migrations/export`, {
         method: "POST",
         headers: {
           Authorization: `Bearer ${accessToken}`,
@@ -152,7 +153,7 @@ export async function restoreBackup(
       return false;
     }
 
-    let response = await fetch(`${runtimeUrl}/v1/migrations/import`, {
+    let response = await loopbackSafeFetch(`${runtimeUrl}/v1/migrations/import`, {
       method: "POST",
       headers: {
         Authorization: `Bearer ${accessToken}`,
@@ -171,7 +172,7 @@ export async function restoreBackup(
         return false;
       }
       accessToken = refreshed.accessToken;
-      response = await fetch(`${runtimeUrl}/v1/migrations/import`, {
+      response = await loopbackSafeFetch(`${runtimeUrl}/v1/migrations/import`, {
         method: "POST",
         headers: {
           Authorization: `Bearer ${accessToken}`,

package/src/lib/device-id.ts

@@ -0,0 +1,85 @@
+/**
+ * Host device ID resolver. Resolution order: `VELLUM_DEVICE_ID` env var,
+ * then `device.json`. Production uses the machine-wide shared
+ * `~/.vellum/device.json`, matching Electron (`apps/macos/src/main/device-id.ts`)
+ * and Swift (`VellumPaths.deviceIdFile`); non-production uses
+ * `<configDir>/device.json`.
+ *
+ * Not to be confused with `guardian-token.ts`'s salted-hash Guardian
+ * identity (`computeDeviceId` / `getOrCreatePersistedDeviceId`) — do not
+ * merge the two.
+ */
+
+import { randomUUID } from "crypto";
+import { mkdirSync, readFileSync, writeFileSync } from "fs";
+import { homedir } from "os";
+import { join } from "path";
+
+import { getConfigDir } from "./environments/paths.js";
+import { getCurrentEnvironment } from "./environments/resolve.js";
+
+let cached: string | undefined;
+
+function resolveDeviceIdPaths(): { dir: string; file: string } {
+  const env = getCurrentEnvironment();
+  const dir =
+    env.name === "production"
+      ? join(homedir(), ".vellum")
+      : getConfigDir(env);
+  return { dir, file: join(dir, "device.json") };
+}
+
+/**
+ * Get the stable device ID for this host machine, creating and persisting
+ * one in `device.json` if absent. `VELLUM_DEVICE_ID` takes precedence over
+ * any file. Never throws: on write failure the generated UUID is still
+ * cached and returned for the process lifetime.
+ */
+export function getOrCreateHostDeviceId(): string {
+  if (cached !== undefined) {
+    return cached;
+  }
+
+  const fromEnv = process.env.VELLUM_DEVICE_ID?.trim();
+  if (fromEnv) {
+    cached = fromEnv;
+    return cached;
+  }
+
+  const { dir, file } = resolveDeviceIdPaths();
+
+  // Preserve unrelated fields from any existing JSON object.
+  let existing: Record<string, unknown> = {};
+  try {
+    const raw: unknown = JSON.parse(readFileSync(file, "utf-8"));
+    if (raw && typeof raw === "object" && !Array.isArray(raw)) {
+      existing = raw as Record<string, unknown>;
+    }
+  } catch {
+    // Missing, unreadable, or malformed — start fresh.
+  }
+
+  if (typeof existing.deviceId === "string" && existing.deviceId.length > 0) {
+    cached = existing.deviceId;
+    return cached;
+  }
+
+  const generated = randomUUID();
+  try {
+    mkdirSync(dir, { recursive: true });
+    existing.deviceId = generated;
+    writeFileSync(file, JSON.stringify(existing, null, 2) + "\n", {
+      mode: 0o644,
+    });
+  } catch {
+    // Write failure — use the generated ID in-memory only.
+  }
+
+  cached = generated;
+  return cached;
+}
+
+/** Reset the cached device ID. Used by tests to force re-resolution. */
+export function resetHostDeviceIdCache(): void {
+  cached = undefined;
+}

package/src/lib/docker.ts

@@ -22,6 +22,7 @@ import type { AssistantEntry } from "./assistant-config";
 import { buildHatchConfigValues, writeInitialConfig } from "./config-utils";
 import { buildServiceRunArgs } from "./statefulset.js";
 import type { Species } from "./constants";
+import { getOrCreateHostDeviceId } from "./device-id.js";
 import { getDefaultPorts } from "./environments/paths.js";
 import { getCurrentEnvironment } from "./environments/resolve.js";
 import { leaseGuardianToken } from "./guardian-token";
@@ -66,6 +67,7 @@ export {
   ASSISTANT_INTERNAL_PORT,
   GATEWAY_INTERNAL_PORT,
 } from "./environments/paths.js";
+import { loopbackSafeFetch } from "./loopback-fetch.js";
 
 /** Max time to wait for the assistant container to emit the readiness sentinel. */
 export const DOCKER_READY_TIMEOUT_MS = 5 * 60 * 1000;
@@ -882,6 +884,8 @@ function startFileWatcher(opts: {
   signingKey?: string;
   bootstrapSecret?: string;
   cesServiceToken?: string;
+  extraAssistantEnv?: Record<string, string>;
+  extraGatewayEnv?: Record<string, string>;
   gatewayPort: number;
   imageTags: Record<ServiceName, string>;
   instanceName: string;
@@ -901,6 +905,8 @@ function startFileWatcher(opts: {
     signingKey: opts.signingKey,
     bootstrapSecret: opts.bootstrapSecret,
     cesServiceToken: opts.cesServiceToken,
+    extraAssistantEnv: opts.extraAssistantEnv,
+    extraGatewayEnv: opts.extraGatewayEnv,
     gatewayPort,
     imageTags,
     instanceName,
@@ -1323,8 +1329,16 @@ export async function hatchDocker(
       : ownSecret;
 
     emitProgress(4, 6, "Starting containers...");
-    const extraGatewayEnv =
-      Object.keys(flagEnvVars).length > 0 ? flagEnvVars : undefined;
+    if (flagEnvVars.VELLUM_DISABLE_PLATFORM) {
+      extraAssistantEnv.VELLUM_DISABLE_PLATFORM =
+        flagEnvVars.VELLUM_DISABLE_PLATFORM;
+    }
+    const hostDeviceId = getOrCreateHostDeviceId();
+    extraAssistantEnv.VELLUM_DEVICE_ID = hostDeviceId;
+    const extraGatewayEnv = {
+      ...flagEnvVars,
+      VELLUM_DEVICE_ID: hostDeviceId,
+    };
     await startContainers(
       {
         signingKey,
@@ -1426,6 +1440,8 @@ export async function hatchDocker(
         signingKey,
         bootstrapSecret,
         cesServiceToken,
+        extraAssistantEnv,
+        extraGatewayEnv,
         gatewayPort,
         imageTags,
         instanceName,
@@ -1515,7 +1531,7 @@ async function waitForGatewayAndLease(opts: {
 
   while (Date.now() - start < DOCKER_READY_TIMEOUT_MS) {
     try {
-      const resp = await fetch(readyUrl, {
+      const resp = await loopbackSafeFetch(readyUrl, {
         signal: AbortSignal.timeout(5000),
       });
       if (resp.ok) {

package/src/lib/guardian-token.ts

@@ -17,9 +17,14 @@ import { platform } from "os";
 import { dirname, join } from "path";
 
 import { SEEDS } from "@vellumai/environments";
+import {
+  guardianTokenPath,
+  resolveConfigDir,
+} from "@vellumai/local-mode";
 
 import { getConfigDir } from "./environments/paths.js";
 import { getCurrentEnvironment } from "./environments/resolve.js";
+import { loopbackSafeFetch } from "./loopback-fetch.js";
 
 const DEVICE_ID_SALT = "vellum-assistant-host-id";
 
@@ -38,12 +43,12 @@ export interface GuardianTokenData {
 }
 
 function getGuardianTokenPath(assistantId: string): string {
-  return join(
-    getConfigDir(getCurrentEnvironment()),
-    "assistants",
-    assistantId,
-    "guardian-token.json",
-  );
+  // Resolve via the shared @vellumai/local-mode resolver — the same one every
+  // host-seam reader (`getGuardianAccessToken`) uses — so the token is always
+  // written where it's read. Must stay in lockstep with `getConfigDir(
+  // getCurrentEnvironment())`; the parity test in guardian-token.test.ts guards
+  // against drift.
+  return guardianTokenPath(resolveConfigDir(process.env), assistantId);
 }
 
 /**
@@ -342,7 +347,7 @@ export async function refreshGuardianToken(
 
     const tokenData = current ?? before;
 
-    const response = await fetch(`${gatewayUrl}/v1/guardian/refresh`, {
+    const response = await loopbackSafeFetch(`${gatewayUrl}/v1/guardian/refresh`, {
       method: "POST",
       headers: {
         "Content-Type": "application/json",
@@ -402,7 +407,7 @@ export async function leaseGuardianToken(
   if (bootstrapSecret) {
     headers["x-bootstrap-secret"] = bootstrapSecret;
   }
-  const response = await fetch(`${gatewayUrl}/v1/guardian/init`, {
+  const response = await loopbackSafeFetch(`${gatewayUrl}/v1/guardian/init`, {
     method: "POST",
     headers,
     body: JSON.stringify({ platform: "cli", deviceId }),
@@ -430,6 +435,37 @@ export async function leaseGuardianToken(
   return tokenData;
 }
 
+/**
+ * Clear the gateway's guardian-init lock + consumed-secret state via
+ * `POST /v1/guardian/reset-bootstrap`, so a spent single-use bootstrap secret
+ * can be used again by a subsequent `leaseGuardianToken`. Loopback-only on the
+ * gateway; when bootstrap secrets are configured the gateway requires a
+ * matching `x-bootstrap-secret`. Mirrors the macOS client's `forceReBootstrap`
+ * recovery. Throws on a non-OK response.
+ */
+export async function resetGuardianBootstrap(
+  gatewayUrl: string,
+  bootstrapSecret?: string,
+): Promise<void> {
+  const headers: Record<string, string> = {
+    "Content-Type": "application/json",
+  };
+  if (bootstrapSecret) {
+    headers["x-bootstrap-secret"] = bootstrapSecret;
+  }
+  const response = await fetch(`${gatewayUrl}/v1/guardian/reset-bootstrap`, {
+    method: "POST",
+    headers,
+    body: JSON.stringify({}),
+  });
+  if (!response.ok) {
+    const body = await response.text();
+    throw new Error(
+      `guardian/reset-bootstrap failed (${response.status}): ${body}`,
+    );
+  }
+}
+
 /**
  * Copy a guardian token from a sibling environment's config directory into
  * the current environment's dir when the current one is missing it.

package/src/lib/hatch-local.ts

@@ -44,6 +44,7 @@ import {
 } from "./provider-secrets.js";
 import { logHatchNextSteps } from "./hatch-next-steps.js";
 import { checkProviderApiKey } from "./api-key-check.js";
+import { loopbackSafeFetch } from "./loopback-fetch.js";
 
 /**
  * Attempts to place a symlink at the given path pointing to cliBinary.
@@ -358,7 +359,7 @@ export async function hatchLocal(
     while (true) {
       await new Promise((r) => setTimeout(r, POLL_INTERVAL_MS));
       try {
-        const res = await fetch(healthUrl, {
+        const res = await loopbackSafeFetch(healthUrl, {
           signal: AbortSignal.timeout(3000),
         });
         if (res.ok) {

package/src/lib/health-check.ts

@@ -1,3 +1,5 @@
+import { loopbackSafeFetch } from "./loopback-fetch.js";
+
 export const HEALTH_CHECK_TIMEOUT_MS = 1500;
 
 interface HealthResponse {
@@ -44,7 +46,7 @@ export async function checkManagedHealth(
       HEALTH_CHECK_TIMEOUT_MS,
     );
 
-    const response = await fetch(url, {
+    const response = await loopbackSafeFetch(url, {
       signal: controller.signal,
       headers,
     });
@@ -105,7 +107,7 @@ export async function fetchManagedPs(
     const controller = new AbortController();
     const timeoutId = setTimeout(() => controller.abort(), 5000);
 
-    const response = await fetch(psUrl, {
+    const response = await loopbackSafeFetch(psUrl, {
       signal: controller.signal,
       headers,
     });
@@ -144,7 +146,7 @@ async function fetchLegacyConnectionStatus(
     const controller = new AbortController();
     const timeoutId = setTimeout(() => controller.abort(), 5000);
 
-    const response = await fetch(url, {
+    const response = await loopbackSafeFetch(url, {
       method: "POST",
       signal: controller.signal,
       headers,
@@ -188,7 +190,7 @@ export async function checkHealth(
       headers["Authorization"] = `Bearer ${bearerToken}`;
     }
 
-    const response = await fetch(url, {
+    const response = await loopbackSafeFetch(url, {
       signal: controller.signal,
       headers,
     });

package/src/lib/http-client.ts

@@ -1,3 +1,5 @@
+import { loopbackSafeFetch } from "./loopback-fetch.js";
+
 /**
  * Build the base URL for the daemon HTTP server.
  */
@@ -15,7 +17,7 @@ export async function httpHealthCheck(
 ): Promise<boolean> {
   try {
     const url = `${buildDaemonUrl(port)}/healthz`;
-    const response = await fetch(url, {
+    const response = await loopbackSafeFetch(url, {
       signal: AbortSignal.timeout(timeoutMs),
     });
     return response.ok;

package/src/lib/local-runtime-client.ts

@@ -9,6 +9,7 @@ import {
   resolveRuntimeMigrationUrl,
   resolveRuntimeUrl,
 } from "./runtime-url.js";
+import { loopbackSafeFetch } from "./loopback-fetch.js";
 
 /**
  * Thrown when the local runtime returns 409 for an export/import request
@@ -122,7 +123,7 @@ export async function localRuntimeExportToGcs(
     body.description = params.description;
   }
 
-  const response = await fetch(
+  const response = await loopbackSafeFetch(
     resolveRuntimeMigrationUrl(entry, "export-to-gcs"),
     {
       method: "POST",
@@ -166,7 +167,7 @@ export async function localRuntimeImportFromGcs(
   token: string,
   params: { bundleUrl: string },
 ): Promise<{ jobId: string }> {
-  const response = await fetch(
+  const response = await loopbackSafeFetch(
     resolveRuntimeMigrationUrl(entry, "import-from-gcs"),
     {
       method: "POST",
@@ -211,7 +212,7 @@ export async function localRuntimePollJobStatus(
   token: string,
   jobId: string,
 ): Promise<UnifiedJobStatus> {
-  const response = await fetch(
+  const response = await loopbackSafeFetch(
     resolveRuntimeMigrationUrl(entry, `jobs/${jobId}`),
     {
       headers: await migrationRequestHeaders(entry, token),
@@ -285,7 +286,7 @@ export async function localRuntimeIdentity(
 ): Promise<RuntimeIdentity> {
   const url = resolveRuntimeUrl(entry, "health");
   const doRequest = async (): Promise<Response> =>
-    fetch(url, {
+    loopbackSafeFetch(url, {
       method: "GET",
       headers: await migrationRequestHeaders(entry, token),
     });

package/src/lib/local.ts

@@ -961,6 +961,7 @@ export async function startLocalDaemon(
         "VELLUM_DEBUG",
         "VELLUM_DEV",
         "VELLUM_DESKTOP_APP",
+        "VELLUM_DISABLE_PLATFORM",
         "VELLUM_WORKSPACE_DIR",
       ]) {
         if (process.env[key]) {

package/src/lib/loopback-fetch.ts

@@ -0,0 +1,28 @@
+/**
+ * Bun's fetch pools sockets even when the server responds `Connection:
+ * close` (e.g. the Werkzeug dev platform on localhost), so the next request
+ * to the same origin is written to a dead socket and hangs until its abort
+ * timeout fires. Disable keepalive for loopback targets to force a fresh
+ * connection per request; remote hosts are unaffected.
+ */
+
+function isLoopbackUrl(url: string): boolean {
+  try {
+    // WHATWG URL canonicalizes hostnames, so IPv6 loopback is always "[::1]".
+    const h = new URL(url).hostname;
+    return (
+      h === "localhost" || h === "[::1]" || /^127(?:\.\d{1,3}){3}$/.test(h)
+    );
+  } catch {
+    return false;
+  }
+}
+
+export function loopbackSafeFetch(
+  url: string,
+  init?: RequestInit,
+): Promise<Response> {
+  return isLoopbackUrl(url)
+    ? fetch(url, { ...init, keepalive: false })
+    : fetch(url, init);
+}

package/src/lib/ngrok.ts

@@ -11,6 +11,7 @@ import { homedir } from "node:os";
 import { dirname, join } from "node:path";
 
 import { GATEWAY_PORT } from "./constants";
+import { loopbackSafeFetch } from "./loopback-fetch.js";
 
 function getDefaultWorkspaceDir(): string {
   return (
@@ -78,7 +79,7 @@ export function getNgrokVersion(): string | null {
  */
 async function queryNgrokTunnels(): Promise<NgrokTunnel[] | null> {
   try {
-    const res = await fetch(NGROK_API_URL, {
+    const res = await loopbackSafeFetch(NGROK_API_URL, {
       signal: AbortSignal.timeout(2_000),
     });
     if (!res.ok) return null;

package/src/lib/platform-client.ts

@@ -11,6 +11,7 @@ import { join, dirname } from "path";
 import { getLockfilePlatformBaseUrl } from "./assistant-config.js";
 import { getConfigDir } from "./environments/paths.js";
 import { getCurrentEnvironment } from "./environments/resolve.js";
+import { loopbackSafeFetch } from "./loopback-fetch.js";
 
 function getPlatformTokenPath(): string {
   return join(getConfigDir(getCurrentEnvironment()), "platform-token");
@@ -229,7 +230,7 @@ export async function ensureSelfHostedLocalRegistration(
     body.public_ingress_url = publicBaseUrl;
   }
 
-  const response = await fetch(
+  const response = await loopbackSafeFetch(
     `${resolvedUrl}/v1/assistants/self-hosted-local/ensure-registration/`,
     {
       method: "POST",
@@ -292,7 +293,7 @@ export async function reprovisionAssistantApiKey(
     body.assistant_version = assistantVersion;
   }
 
-  const response = await fetch(
+  const response = await loopbackSafeFetch(
     `${resolvedUrl}/v1/assistants/self-hosted-local/reprovision-api-key/`,
     {
       method: "POST",
@@ -358,7 +359,7 @@ export async function readGatewayCredential(
       headers["Authorization"] = `Bearer ${bearerToken}`;
     }
 
-    const response = await fetch(`${gatewayUrl}/v1/secrets/read`, {
+    const response = await loopbackSafeFetch(`${gatewayUrl}/v1/secrets/read`, {
       method: "POST",
       headers,
       body: JSON.stringify({ type: "credential", name, reveal: true }),
@@ -416,7 +417,7 @@ async function injectGatewayCredential(
     headers["Authorization"] = `Bearer ${bearerToken}`;
   }
 
-  const response = await fetch(`${gatewayUrl}/v1/secrets`, {
+  const response = await loopbackSafeFetch(`${gatewayUrl}/v1/secrets`, {
     method: "POST",
     headers,
     body: JSON.stringify({ type: "credential", name, value }),
@@ -486,7 +487,7 @@ export async function hatchAssistant(
   const resolvedUrl = platformUrl || getPlatformUrl();
   const url = `${resolvedUrl}/v1/assistants/hatch/`;
 
-  const response = await fetch(url, {
+  const response = await loopbackSafeFetch(url, {
     method: "POST",
     headers: await authHeaders(token, platformUrl),
     body: JSON.stringify({}),
@@ -545,7 +546,7 @@ export async function checkExistingPlatformAssistant(
   );
 
   try {
-    const response = await fetch(url, {
+    const response = await loopbackSafeFetch(url, {
       signal: controller.signal,
       headers: await authHeaders(token, platformUrl),
     });
@@ -583,7 +584,7 @@ export async function fetchPlatformAssistants(
   );
 
   try {
-    const response = await fetch(url, {
+    const response = await loopbackSafeFetch(url, {
       signal: controller.signal,
       headers: await authHeaders(token, platformUrl),
     });
@@ -624,7 +625,7 @@ export async function fetchOrganizationId(
   );
 
   try {
-    const response = await fetch(url, {
+    const response = await loopbackSafeFetch(url, {
       signal: controller.signal,
       headers: { ...tokenAuthHeader(token) },
     });
@@ -671,7 +672,7 @@ export async function fetchCurrentUser(
   );
 
   try {
-    const response = await fetch(url, {
+    const response = await loopbackSafeFetch(url, {
       signal: controller.signal,
       headers: { "X-Session-Token": token },
     });
@@ -706,11 +707,14 @@ export async function rollbackPlatformAssistant(
   platformUrl?: string,
 ): Promise<{ detail: string; version: string | null }> {
   const resolvedUrl = platformUrl || getPlatformUrl();
-  const response = await fetch(`${resolvedUrl}/v1/assistants/rollback/`, {
-    method: "POST",
-    headers: await authHeaders(token, platformUrl),
-    body: JSON.stringify(version ? { version } : {}),
-  });
+  const response = await loopbackSafeFetch(
+    `${resolvedUrl}/v1/assistants/rollback/`,
+    {
+      method: "POST",
+      headers: await authHeaders(token, platformUrl),
+      body: JSON.stringify(version ? { version } : {}),
+    },
+  );
 
   const body = (await response.json().catch(() => ({}))) as {
     detail?: string;
@@ -744,7 +748,7 @@ export async function platformUploadToSignedUrl(
   uploadUrl: string,
   bundleData: Uint8Array<ArrayBuffer>,
 ): Promise<void> {
-  const response = await fetch(uploadUrl, {
+  const response = await loopbackSafeFetch(uploadUrl, {
     method: "PUT",
     headers: {
       "Content-Type": "application/octet-stream",
@@ -766,7 +770,7 @@ export async function platformImportPreflightFromGcs(
   platformUrl?: string,
 ): Promise<{ statusCode: number; body: Record<string, unknown> }> {
   const resolvedUrl = platformUrl || getPlatformUrl();
-  const response = await fetch(
+  const response = await loopbackSafeFetch(
     `${resolvedUrl}/v1/migrations/import-preflight-from-gcs/`,
     {
       method: "POST",
@@ -789,7 +793,7 @@ export async function platformImportBundleFromGcs(
   platformUrl?: string,
 ): Promise<{ statusCode: number; body: Record<string, unknown> }> {
   const resolvedUrl = platformUrl || getPlatformUrl();
-  const response = await fetch(
+  const response = await loopbackSafeFetch(
     `${resolvedUrl}/v1/migrations/import-from-gcs/`,
     {
       method: "POST",
@@ -970,7 +974,7 @@ export async function platformRequestSignedUrl(
   }
 
   const doRequest = async (): Promise<Response> =>
-    fetch(`${resolvedUrl}/v1/migrations/signed-url/`, {
+    loopbackSafeFetch(`${resolvedUrl}/v1/migrations/signed-url/`, {
       method: "POST",
       headers: await authHeaders(token, platformUrl),
       body: JSON.stringify(body),
@@ -1040,9 +1044,12 @@ export async function platformPollJobStatus(
   platformUrl?: string,
 ): Promise<UnifiedJobStatus> {
   const resolvedUrl = platformUrl || getPlatformUrl();
-  const response = await fetch(`${resolvedUrl}/v1/migrations/jobs/${jobId}/`, {
-    headers: await authHeaders(token, platformUrl),
-  });
+  const response = await loopbackSafeFetch(
+    `${resolvedUrl}/v1/migrations/jobs/${jobId}/`,
+    {
+      headers: await authHeaders(token, platformUrl),
+    },
+  );
 
   if (response.status === 404) {
     throw new Error("Migration job not found");

package/src/lib/platform-releases.ts

@@ -1,6 +1,7 @@
 import { getPlatformUrl } from "./platform-client.js";
 import { DOCKERHUB_IMAGES } from "./docker.js";
 import type { ServiceName } from "./docker.js";
+import { loopbackSafeFetch } from "./loopback-fetch.js";
 
 export interface ResolvedImageRefs {
   imageTags: Record<ServiceName, string>;
@@ -15,7 +16,7 @@ export interface ResolvedImageRefs {
 export async function fetchLatestStableVersion(): Promise<string | null> {
   try {
     const platformUrl = getPlatformUrl();
-    const response = await fetch(`${platformUrl}/v1/releases/?stable=true`, {
+    const response = await loopbackSafeFetch(`${platformUrl}/v1/releases/?stable=true`, {
       signal: AbortSignal.timeout(10_000),
     });
     if (!response.ok) return null;
@@ -80,7 +81,7 @@ async function fetchPlatformImageRefs(
 
     log?.(`Fetching releases from ${url}`);
 
-    const response = await fetch(url, {
+    const response = await loopbackSafeFetch(url, {
       signal: AbortSignal.timeout(10_000),
     });