@vellumai/cli 0.8.11-dev.202606122025.f06346f → 0.8.11-dev.202606122104.e5b9dd5

package/node_modules/@vellumai/local-mode/src/__tests__/wake.test.ts

@@ -41,6 +41,25 @@ describe("runWake", () => {
     expect(spawnArgs[0]).toEqual(["bun", ["run", "cli", "wake", "asst-42"]]);
   });
 
+  test("repairGuardian: true appends --repair-guardian to the CLI args", async () => {
+    const pending = runWake(invocation, "asst-42", { repairGuardian: true });
+    lastChild.emit("close", 0);
+
+    expect(await pending).toEqual({ ok: true });
+    expect(spawnArgs[0]).toEqual([
+      "bun",
+      ["run", "cli", "wake", "asst-42", "--repair-guardian"],
+    ]);
+  });
+
+  test("repairGuardian: false omits the flag", async () => {
+    const pending = runWake(invocation, "asst-42", { repairGuardian: false });
+    lastChild.emit("close", 0);
+
+    expect(await pending).toEqual({ ok: true });
+    expect(spawnArgs[0]).toEqual(["bun", ["run", "cli", "wake", "asst-42"]]);
+  });
+
   test("a non-zero exit resolves to a failure carrying the CLI's output", async () => {
     const pending = runWake(invocation, "asst-42");
     lastChild.stderr.emit("data", Buffer.from("no sibling environment to seed from"));

package/node_modules/@vellumai/local-mode/src/index.ts

@@ -36,7 +36,7 @@ export type { HatchResult } from "./hatch";
 export { runRetire } from "./retire";
 export type { RetireResult } from "./retire";
 export { runWake } from "./wake";
-export type { WakeResult } from "./wake";
+export type { WakeOptions, WakeResult } from "./wake";
 export { getGuardianAccessToken } from "./guardian-token";
 export type { TokenResult } from "./guardian-token";
 export {

package/node_modules/@vellumai/local-mode/src/wake.ts

@@ -14,6 +14,11 @@ export type WakeResult =
   | { ok: true }
   | { ok: false; status: number; error: string };
 
+export interface WakeOptions {
+  /** Pass --repair-guardian to re-provision a missing/expired guardian token. Revokes the assistant's other device-bound tokens, so callers must gate this behind explicit user confirmation. */
+  repairGuardian?: boolean;
+}
+
 /**
  * Start (or restart) a local assistant's daemon and gateway via the CLI's
  * `wake`, which also re-seeds the guardian token from a sibling environment.
@@ -27,11 +32,17 @@ export type WakeResult =
 export function runWake(
   invocation: CliInvocation,
   assistantId: string,
+  options?: WakeOptions,
 ): Promise<WakeResult> {
   return new Promise((resolve) => {
     const child = spawn(
       invocation.command,
-      [...invocation.baseArgs, "wake", assistantId],
+      [
+        ...invocation.baseArgs,
+        "wake",
+        assistantId,
+        ...(options?.repairGuardian ? ["--repair-guardian"] : []),
+      ],
       { stdio: ["ignore", "pipe", "pipe"] },
     );
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vellumai/cli",
-  "version": "0.8.11-dev.202606122025.f06346f",
+  "version": "0.8.11-dev.202606122104.e5b9dd5",
   "description": "CLI tools for vellum-assistant",
   "type": "module",
   "exports": {

package/src/__tests__/wake.test.ts

@@ -272,12 +272,23 @@ describe("vellum wake", () => {
     expect(leaseGuardianTokenMock).not.toHaveBeenCalled();
   });
 
-  test("skips re-provision when a guardian token already exists", async () => {
+  test("re-provisions even when a guardian token already exists", async () => {
+    // A connect can 401 off a token whose local state looks healthy
+    // (revoked, mis-seeded, wrong principal). The user explicitly confirmed
+    // the destructive repair, so the flag forces a re-lease instead of
+    // guessing from local token state and recreating the no-op loop.
     process.argv = ["bun", "vellum", "wake", "--repair-guardian", "local-assistant"];
-    // loadGuardianToken returns a token by default — recovery must not run.
+    // loadGuardianToken returns a healthy-looking token by default.
     await wake();
 
-    expect(resetGuardianBootstrapMock).not.toHaveBeenCalled();
-    expect(leaseGuardianTokenMock).not.toHaveBeenCalled();
+    expect(resetGuardianBootstrapMock).toHaveBeenCalledWith(
+      "http://127.0.0.1:7830",
+      "generated-bootstrap-secret",
+    );
+    expect(leaseGuardianTokenMock).toHaveBeenCalledWith(
+      "http://127.0.0.1:7830",
+      "local-assistant",
+      "generated-bootstrap-secret",
+    );
   });
 });

package/src/__tests__/workos-pkce.test.ts

@@ -84,7 +84,9 @@ describe("buildAuthorizeUrl", () => {
   });
 
   test("login hint is forwarded", () => {
+    // generic-examples:ignore-next-line — reason: test fixture for URL encoding, not a real email
     const url = new URL(buildAuthorizeUrl({ ...base, loginHint: "a@b.co" }));
+    // generic-examples:ignore-next-line — reason: test fixture for URL encoding, not a real email
     expect(url.searchParams.get("login_hint")).toBe("a@b.co");
 
     const noHint = new URL(buildAuthorizeUrl(base));

package/src/commands/wake.ts

@@ -9,7 +9,6 @@ import {
 import { dockerResourceNames, wakeContainers } from "../lib/docker.js";
 import {
   leaseGuardianToken,
-  loadGuardianToken,
   resetGuardianBootstrap,
   seedGuardianTokenFromSiblingEnv,
 } from "../lib/guardian-token.js";
@@ -43,7 +42,7 @@ export async function wake(): Promise<void> {
       "  --foreground   Run assistant in foreground with logs printed to terminal",
     );
     console.log(
-      "  --repair-guardian  Re-provision the guardian token if missing (resets the\n" +
+      "  --repair-guardian  Force-re-provision the guardian token (resets the\n" +
         "                     gateway bootstrap and re-leases — REVOKES other device-bound\n" +
         "                     tokens, so only use deliberately, never from auto-repair)",
     );
@@ -238,8 +237,11 @@ export async function wake(): Promise<void> {
     console.log("   Seeded guardian token from sibling environment.");
   }
 
-  // Last-resort recovery (explicit `--repair-guardian` only): if no guardian
-  // token exists for this env even after sibling seeding, re-provision one. The
+  // Last-resort recovery (explicit `--repair-guardian` only): force a
+  // re-provision. Token health can't be judged locally — a connect can 401
+  // off a token whose local expiry looks fine (revoked, mis-seeded, wrong
+  // principal) — and the user explicitly confirmed the destructive repair,
+  // so guessing "looks healthy, skip" just recreates the no-op loop. The
   // single-use bootstrap secret may already be spent — a prior connect can
   // lease a token that's then lost, or the gateway marks the secret consumed
   // before the client persists it — which otherwise bricks connect into a
@@ -248,7 +250,7 @@ export async function wake(): Promise<void> {
   // by the lockfile secret — mirrors the macOS client's forceReBootstrap), then
   // re-lease. Gated behind the flag because the re-lease revokes other
   // device-bound tokens; it must never run from the automatic repair path.
-  if (repairGuardian && !loadGuardianToken(entry.assistantId)) {
+  if (repairGuardian) {
     const loopbackUrl = `http://127.0.0.1:${resources.gatewayPort}`;
     const maxAttempts = 3;
     for (let attempt = 1; attempt <= maxAttempts; attempt++) {