@vellumai/cli 0.8.12-dev.202606131247.4d64b75 → 0.8.12-dev.202606131450.c6f2ffd

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vellumai/cli",
-  "version": "0.8.12-dev.202606131247.4d64b75",
+  "version": "0.8.12-dev.202606131450.c6f2ffd",
   "description": "CLI tools for vellum-assistant",
   "type": "module",
   "exports": {

package/src/__tests__/teleport.test.ts

@@ -773,15 +773,12 @@ describe("resolveOrHatchTarget", () => {
     });
 
     const result = await resolveOrHatchTarget("docker", "new-one");
-    expect(hatchDockerMock).toHaveBeenCalledWith(
-      "vellum",
-      false,
-      "new-one",
-      false,
-      {},
-      {},
-      { setupProviderCredentials: false },
-    );
+    expect(hatchDockerMock).toHaveBeenCalledWith({
+      species: "vellum",
+      detached: false,
+      name: "new-one",
+      setupProviderCredentials: false,
+    });
     expect(result).toBe(newEntry);
   });
 

package/src/commands/hatch.ts

@@ -182,6 +182,9 @@ interface HatchArgs {
   flagEnvVars: Record<string, string>;
   analyze: boolean;
   disablePlatform: boolean;
+  netnsContainer: string | null;
+  gatewayPort: number | null;
+  assistantCaCert: string | null;
 }
 
 function parseArgs(): HatchArgs {
@@ -189,8 +192,10 @@ function parseArgs(): HatchArgs {
     process.argv.slice(3),
   );
   const flagEnvVars = { ...readAmbientFlagEnvVars(), ...cliFlagVars };
-  const disablePlatformAmbient = process.env.VELLUM_DISABLE_PLATFORM?.trim().toLowerCase();
-  let disablePlatform = disablePlatformAmbient === "true" || disablePlatformAmbient === "1";
+  const disablePlatformAmbient =
+    process.env.VELLUM_DISABLE_PLATFORM?.trim().toLowerCase();
+  let disablePlatform =
+    disablePlatformAmbient === "true" || disablePlatformAmbient === "1";
   let species: Species = DEFAULT_SPECIES;
   let detached = false;
   let keepAlive = false;
@@ -200,6 +205,9 @@ function parseArgs(): HatchArgs {
   let sourcePath: string | null = null;
   const configValues: Record<string, string> = {};
   let analyze = false;
+  let netnsContainer: string | null = null;
+  let gatewayPort: number | null = null;
+  let assistantCaCert: string | null = null;
 
   for (let i = 0; i < args.length; i++) {
     const arg = args[i];
@@ -239,6 +247,15 @@ function parseArgs(): HatchArgs {
       console.log(
         "  --disable-platform        Suppress all outbound platform API calls",
       );
+      console.log(
+        "  --netns-container <name>  Join an existing container's network namespace (docker target only) instead of creating a per-instance network. The namespace owner publishes host ports, so --gateway-port is required.",
+      );
+      console.log(
+        "  --gateway-port <port>     Use an explicit host port for the gateway runtime URL instead of auto-allocating. Required with --netns-container.",
+      );
+      console.log(
+        "  --assistant-ca-cert <path>  Trust an extra PEM CA bundle in the assistant container (NODE_EXTRA_CA_CERTS) from process start. Useful behind a TLS-terminating egress proxy.",
+      );
       process.exit(0);
     } else if (arg === "-d") {
       detached = true;
@@ -301,11 +318,38 @@ function parseArgs(): HatchArgs {
       i++;
     } else if (arg === "--disable-platform") {
       disablePlatform = true;
+    } else if (arg === "--netns-container") {
+      const next = args[i + 1];
+      if (!next || next.startsWith("-")) {
+        console.error("Error: --netns-container requires a container name");
+        process.exit(1);
+      }
+      netnsContainer = next;
+      i++;
+    } else if (arg === "--gateway-port") {
+      const next = args[i + 1];
+      const parsed = next ? Number(next) : NaN;
+      if (!Number.isInteger(parsed) || parsed <= 0 || parsed > 65535) {
+        console.error(
+          "Error: --gateway-port requires an integer port in 1-65535",
+        );
+        process.exit(1);
+      }
+      gatewayPort = parsed;
+      i++;
+    } else if (arg === "--assistant-ca-cert") {
+      const next = args[i + 1];
+      if (!next || next.startsWith("-")) {
+        console.error("Error: --assistant-ca-cert requires a path argument");
+        process.exit(1);
+      }
+      assistantCaCert = next;
+      i++;
     } else if (VALID_SPECIES.includes(arg as Species)) {
       species = arg as Species;
     } else {
       console.error(
-        `Error: Unknown argument '${arg}'. Valid options: ${VALID_SPECIES.join(", ")}, -d, --watch, --source <path>, --keep-alive, --name <name>, --remote <${VALID_REMOTE_HOSTS.join("|")}>, --config <key=value>, --flag <key=value>, --analyze, --disable-platform`,
+        `Error: Unknown argument '${arg}'. Valid options: ${VALID_SPECIES.join(", ")}, -d, --watch, --source <path>, --keep-alive, --name <name>, --remote <${VALID_REMOTE_HOSTS.join("|")}>, --config <key=value>, --flag <key=value>, --analyze, --disable-platform, --netns-container <name>, --gateway-port <port>, --assistant-ca-cert <path>`,
       );
       process.exit(1);
     }
@@ -323,6 +367,9 @@ function parseArgs(): HatchArgs {
     flagEnvVars,
     analyze,
     disablePlatform,
+    netnsContainer,
+    gatewayPort,
+    assistantCaCert,
   };
 }
 
@@ -559,6 +606,9 @@ export async function hatch(): Promise<void> {
     flagEnvVars,
     analyze,
     disablePlatform,
+    netnsContainer,
+    gatewayPort,
+    assistantCaCert,
   } = parseArgs();
 
   if (disablePlatform) {
@@ -580,6 +630,25 @@ export async function hatch(): Promise<void> {
     process.exit(1);
   }
 
+  if (
+    (netnsContainer !== null ||
+      gatewayPort !== null ||
+      assistantCaCert !== null) &&
+    remote !== "docker"
+  ) {
+    console.error(
+      "Error: --netns-container, --gateway-port, and --assistant-ca-cert are only supported for docker hatch targets.",
+    );
+    process.exit(1);
+  }
+
+  if (netnsContainer !== null && gatewayPort === null) {
+    console.error(
+      "Error: --gateway-port is required with --netns-container (the namespace owner publishes the port before hatch runs).",
+    );
+    process.exit(1);
+  }
+
   if (UNSUPPORTED_REMOTE_HATCH_TARGETS.has(remote)) {
     console.error(
       `Error: \`vellum hatch --remote ${remote}\` is not a supported provisioning target yet.`,
@@ -591,14 +660,30 @@ export async function hatch(): Promise<void> {
   }
 
   if (remote === "local") {
-    await hatchLocal(species, name, watch, keepAlive, configValues, flagEnvVars);
+    await hatchLocal(
+      species,
+      name,
+      watch,
+      keepAlive,
+      configValues,
+      flagEnvVars,
+    );
     return;
   }
 
   if (remote === "docker") {
-    await hatchDocker(species, detached, name, watch, configValues, flagEnvVars, {
+    await hatchDocker({
+      species,
+      detached,
+      name,
+      watch,
+      configValues,
+      flagEnvVars,
       sourcePath,
       analyze,
+      netnsContainer: netnsContainer ?? undefined,
+      gatewayPort: gatewayPort ?? undefined,
+      assistantCaCertPath: assistantCaCert ?? undefined,
     });
     return;
   }

package/src/commands/teleport.ts

@@ -391,9 +391,8 @@ async function exportFromAssistant(
     // daemon, the CLI is updated separately).
     let sourceRuntimeVersion: string;
     try {
-      const identity = await callRuntimeWithAuthRetry(
-        entry,
-        async (token) => localRuntimeIdentity(entry, token),
+      const identity = await callRuntimeWithAuthRetry(entry, async (token) =>
+        localRuntimeIdentity(entry, token),
       );
       sourceRuntimeVersion = identity.version;
     } catch (err) {
@@ -427,16 +426,13 @@ async function exportFromAssistant(
     let jobId: string;
     let accessToken: string;
     try {
-      const result = await callRuntimeWithAuthRetry(
-        entry,
-        async (token) => {
-          const r = await localRuntimeExportToGcs(entry, token, {
-            uploadUrl,
-            description: "teleport export",
-          });
-          return { jobId: r.jobId, token };
-        },
-      );
+      const result = await callRuntimeWithAuthRetry(entry, async (token) => {
+        const r = await localRuntimeExportToGcs(entry, token, {
+          uploadUrl,
+          description: "teleport export",
+        });
+        return { jobId: r.jobId, token };
+      });
       jobId = result.jobId;
       accessToken = result.token;
     } catch (err) {
@@ -734,9 +730,8 @@ async function importToAssistant(
     // target can't actually load) whenever the two drift apart.
     let targetRuntimeVersion: string;
     try {
-      const identity = await callRuntimeWithAuthRetry(
-        entry,
-        (token) => localRuntimeIdentity(entry, token),
+      const identity = await callRuntimeWithAuthRetry(entry, (token) =>
+        localRuntimeIdentity(entry, token),
       );
       targetRuntimeVersion = identity.version;
     } catch (err) {
@@ -779,15 +774,12 @@ async function importToAssistant(
     let jobId: string;
     let accessToken: string;
     try {
-      const result = await callRuntimeWithAuthRetry(
-        entry,
-        async (token) => {
-          const r = await localRuntimeImportFromGcs(entry, token, {
-            bundleUrl,
-          });
-          return { jobId: r.jobId, token };
-        },
-      );
+      const result = await callRuntimeWithAuthRetry(entry, async (token) => {
+        const r = await localRuntimeImportFromGcs(entry, token, {
+          bundleUrl,
+        });
+        return { jobId: r.jobId, token };
+      });
       jobId = result.jobId;
       accessToken = result.token;
     } catch (err) {
@@ -910,17 +902,12 @@ export async function resolveOrHatchTarget(
 
   if (targetEnv === "docker") {
     const beforeIds = new Set(loadAllAssistants().map((e) => e.assistantId));
-    await hatchDocker(
-      "vellum",
-      false,
-      targetName ?? null,
-      false,
-      {},
-      {},
-      {
-        setupProviderCredentials: false,
-      },
-    );
+    await hatchDocker({
+      species: "vellum",
+      detached: false,
+      name: targetName ?? null,
+      setupProviderCredentials: false,
+    });
     const entry = targetName
       ? findAssistantByName(targetName)
       : (loadAllAssistants().find((e) => !beforeIds.has(e.assistantId)) ??

package/src/lib/docker.ts

@@ -274,8 +274,53 @@ function ensureLocalBinOnPath(): void {
   }
 }
 
-export interface HatchDockerOptions {
+export interface HatchDockerParams {
+  /** Assistant species to hatch (e.g. `"vellum"`). */
+  species: Species;
+  /** Run detached without attaching to logs or interactive setup. */
+  detached?: boolean;
+  /** Instance display name. Defaults to an auto-generated name. */
+  name?: string | null;
+  /** Build from a local source tree and hot-reload on change. */
+  watch?: boolean;
+  /** Hatch-time config values (key → value). */
+  configValues?: Record<string, string>;
+  /** Extra env vars forwarded into the assistant container. */
+  flagEnvVars?: Record<string, string>;
   setupProviderCredentials?: boolean;
+  /**
+   * Path to a local source tree to build images from before hatching. When
+   * provided, this path is used directly as the repo root and no file
+   * watcher is started — useful for callers (e.g. evals) that want each
+   * run to pick up local CLI changes without keeping a long-lived watcher
+   * process around. `--watch` independently auto-detects the repo root and
+   * also enables hot-reload.
+   */
+  sourcePath?: string | null;
+  analyze?: boolean;
+  /**
+   * Name of an existing container whose network namespace the assistant,
+   * gateway, and credential-executor join (`--network=container:<name>`),
+   * instead of the assistant owning a freshly-created per-instance network.
+   * When set, hatch creates no Docker network and publishes no host ports —
+   * the namespace owner is responsible for publishing the gateway port — so
+   * `gatewayPort` must also be supplied (the owner had to publish it before
+   * hatch ran).
+   */
+  netnsContainer?: string;
+  /**
+   * Explicit host port to record as the gateway's `runtimeUrl` instead of
+   * auto-allocating a free port. Required alongside `netnsContainer`, where
+   * the namespace owner — not hatch — owns port allocation and publishing.
+   */
+  gatewayPort?: number;
+  /**
+   * Host path to a PEM CA bundle bind-mounted into the assistant container
+   * and trusted at process start via `NODE_EXTRA_CA_CERTS`. Lets the daemon
+   * trust a TLS-terminating egress proxy from its very first outbound
+   * connection.
+   */
+  assistantCaCertPath?: string;
 }
 
 export type DockerProviderCredentialSetupAction =
@@ -669,6 +714,8 @@ export async function startContainers(
     imageTags: Record<ServiceName, string>;
     instanceName: string;
     res: ReturnType<typeof dockerResourceNames>;
+    netnsContainer?: string;
+    assistantCaCertPath?: string;
   },
   log: (msg: string) => void,
 ): Promise<void> {
@@ -891,6 +938,8 @@ function startFileWatcher(opts: {
   instanceName: string;
   repoRoot: string;
   res: ReturnType<typeof dockerResourceNames>;
+  netnsContainer?: string;
+  assistantCaCertPath?: string;
 }): () => void {
   const { gatewayPort, imageTags, instanceName, repoRoot, res } = opts;
 
@@ -912,6 +961,8 @@ function startFileWatcher(opts: {
     instanceName,
     res,
     avatarDevicePath: resolveAvatarDevicePath(),
+    netnsContainer: opts.netnsContainer,
+    assistantCaCertPath: opts.assistantCaCertPath,
   });
   const containerForService: Record<ServiceName, string> = {
     assistant: res.assistantContainer,
@@ -1030,31 +1081,19 @@ function startFileWatcher(opts: {
   };
 }
 
-export interface HatchDockerOptions {
-  /**
-   * Path to a local source tree to build images from before hatching. When
-   * provided, this path is used directly as the repo root and no file
-   * watcher is started — useful for callers (e.g. evals) that want each
-   * run to pick up local CLI changes without keeping a long-lived watcher
-   * process around. `--watch` independently auto-detects the repo root and
-   * also enables hot-reload.
-   */
-  sourcePath?: string | null;
-  analyze?: boolean;
-}
+export async function hatchDocker(params: HatchDockerParams): Promise<void> {
+  const {
+    species,
+    detached = false,
+    name = null,
+    configValues = {},
+    flagEnvVars = {},
+  } = params;
+  let watch = params.watch ?? false;
 
-export async function hatchDocker(
-  species: Species,
-  detached: boolean,
-  name: string | null,
-  watch: boolean = false,
-  configValues: Record<string, string> = {},
-  flagEnvVars: Record<string, string> = {},
-  options: HatchDockerOptions = {},
-): Promise<void> {
   resetLogFile("hatch.log");
   const provider =
-    options.setupProviderCredentials === false
+    params.setupProviderCredentials === false
       ? undefined
       : resolveHatchProvider(configValues);
 
@@ -1069,21 +1108,32 @@ export async function hatchDocker(
     await ensureDockerInstalled();
 
     const instanceName = generateInstanceName(species, name);
-    // Resolve the gateway's host port dynamically. The env-default
+    // Resolve the gateway's host port. When joining an externally-owned
+    // network namespace, the owner has already published the gateway port,
+    // so the caller — not hatch — owns port allocation; use the supplied
+    // port verbatim. Otherwise resolve it dynamically: the env-default
     // (production 7830 / non-prod overrides) is just the *preferred*
-    // starting point — if it's taken by another local assistant, eval
-    // run, or unrelated process, we walk upward until we find a free
-    // port. This replaces the previous "first one in wins, everyone
-    // else gets a docker bind error" behavior and removes the need for
-    // an orphan-cleanup pre-flight in the evals harness.
-    const preferredGatewayPort = getDefaultPorts(
-      getCurrentEnvironment(),
-    ).gateway;
-    const gatewayPort = await findOpenPort(preferredGatewayPort);
-    if (gatewayPort !== preferredGatewayPort) {
-      log(
-        `Preferred gateway port ${preferredGatewayPort} is in use; allocated ${gatewayPort} for this instance.`,
-      );
+    // starting point — if it's taken by another local assistant, eval run,
+    // or unrelated process, we walk upward until we find a free port, so
+    // concurrent instances don't collide on a docker bind error.
+    let gatewayPort: number;
+    if (params.netnsContainer) {
+      if (params.gatewayPort === undefined) {
+        throw new Error(
+          "hatchDocker: gatewayPort is required when netnsContainer is set (the namespace owner publishes the port before hatch runs)",
+        );
+      }
+      gatewayPort = params.gatewayPort;
+    } else {
+      const preferredGatewayPort = getDefaultPorts(
+        getCurrentEnvironment(),
+      ).gateway;
+      gatewayPort = await findOpenPort(preferredGatewayPort);
+      if (gatewayPort !== preferredGatewayPort) {
+        log(
+          `Preferred gateway port ${preferredGatewayPort} is in use; allocated ${gatewayPort} for this instance.`,
+        );
+      }
     }
 
     const imageTags: Record<ServiceName, string> = {
@@ -1093,8 +1143,8 @@ export async function hatchDocker(
     };
 
     const sourcePath =
-      typeof options.sourcePath === "string" && options.sourcePath.length > 0
-        ? options.sourcePath
+      typeof params.sourcePath === "string" && params.sourcePath.length > 0
+        ? params.sourcePath
         : null;
     const buildFromSource = sourcePath !== null;
     let repoRoot: string | undefined;
@@ -1241,8 +1291,15 @@ export async function hatchDocker(
     const res = dockerResourceNames(instanceName);
 
     emitProgress(3, 6, "Creating volumes...");
-    log("📁 Creating network and volumes...");
-    await exec("docker", ["network", "create", res.network]);
+    // When joining an externally-owned network namespace, the owner already
+    // provides the network stack — creating a per-instance network here would
+    // be unused and leak on teardown.
+    if (params.netnsContainer) {
+      log("📁 Joining existing network namespace; creating volumes...");
+    } else {
+      log("📁 Creating network and volumes...");
+      await exec("docker", ["network", "create", res.network]);
+    }
     await exec("docker", ["volume", "create", res.socketVolume]);
     await exec("docker", ["volume", "create", res.assistantIpcVolume]);
     await exec("docker", ["volume", "create", res.gatewayIpcVolume]);
@@ -1350,6 +1407,8 @@ export async function hatchDocker(
         imageTags,
         instanceName,
         res,
+        netnsContainer: params.netnsContainer,
+        assistantCaCertPath: params.assistantCaCertPath,
       },
       log,
     );
@@ -1389,7 +1448,7 @@ export async function hatchDocker(
       logFd,
       runtimeUrl,
       containersUpAt,
-      analyze: options.analyze ?? false,
+      analyze: params.analyze ?? false,
     });
 
     if (!ready && !(watch && repoRoot)) {
@@ -1447,6 +1506,8 @@ export async function hatchDocker(
         instanceName,
         repoRoot,
         res,
+        netnsContainer: params.netnsContainer,
+        assistantCaCertPath: params.assistantCaCertPath,
       });
 
       await new Promise<void>((resolve) => {

package/src/lib/statefulset.ts

@@ -16,22 +16,29 @@ import { PROVIDER_ENV_VAR_NAMES } from "../shared/provider-env-vars.js";
 
 const AVATAR_DEVICE_ENV_VAR = "VELLUM_AVATAR_DEVICE";
 
+/**
+ * In-container path the assistant's extra CA bundle is mounted at when
+ * `assistantCaCertPath` is supplied. Read-only and outside the
+ * `update-ca-certificates` directory so it's consumed purely via
+ * `NODE_EXTRA_CA_CERTS` without touching the system trust store.
+ */
+const ASSISTANT_EXTRA_CA_TARGET = "/etc/vellum/extra-ca-cert.pem";
+
 /** Logical service name used throughout the CLI. */
 export type ServiceName = "assistant" | "gateway" | "credential-executor";
 
 /**
- /**
-  * The four fields from `dockerResourceNames()` that the builder actually uses.
-  * Container/network names come from here; volume names are generated by the
-  * `volumeClaimTemplates` in the spec. `ReturnType<typeof dockerResourceNames>`
-  * structurally satisfies this interface (it has all these fields plus more).
-  */
- export interface DockerResourceNames {
-   assistantContainer: string;
-   cesContainer: string;
-   gatewayContainer: string;
-   network: string;
- }
+ * The four fields from `dockerResourceNames()` that the builder actually uses.
+ * Container/network names come from here; volume names are generated by the
+ * `volumeClaimTemplates` in the spec. `ReturnType<typeof dockerResourceNames>`
+ * structurally satisfies this interface (it has all these fields plus more).
+ */
+export interface DockerResourceNames {
+  assistantContainer: string;
+  cesContainer: string;
+  gatewayContainer: string;
+  network: string;
+}
 
 // ---------------------------------------------------------------------------
 // Types
@@ -133,6 +140,7 @@ export interface DockerRunSecrets {
 // Spec
 // ---------------------------------------------------------------------------
 
+// prettier-ignore
 export const DOCKER_STATEFUL_SET_SPEC: DockerStatefulSetSpec = {
   startOrder: ["assistant", "gateway", "credential-executor"],
 
@@ -260,6 +268,21 @@ export interface BuildServiceRunArgsOpts extends DockerRunSecrets {
   extraGatewayEnv?: Record<string, string>;
   /** Avatar device path, if available. Injected by `docker.ts` after resolving. */
   avatarDevicePath?: string;
+  /**
+   * Name of an existing container whose network namespace every service
+   * joins via `--network=container:<name>`, instead of the assistant owning
+   * the namespace. When set, the assistant publishes no host ports — the
+   * namespace owner is responsible for port publishing — and no per-instance
+   * Docker network is referenced.
+   */
+  netnsContainer?: string;
+  /**
+   * Host path to a PEM CA bundle to bind-mount into the assistant container
+   * and trust at process start via `NODE_EXTRA_CA_CERTS`. Used when the
+   * assistant's outbound TLS is terminated by a proxy whose certificate is
+   * signed by a CA outside the default trust set.
+   */
+  assistantCaCertPath?: string;
 }
 
 interface BuilderManagedEnvKeys {
@@ -283,13 +306,17 @@ export function getBuilderManagedEnvKeys(
   spec = DOCKER_STATEFUL_SET_SPEC,
 ): BuilderManagedEnvKeys {
   const container = spec.containers.find((c) => c.internalName === service);
-  if (!container) throw new Error(`docker-statefulset: unknown service "${service}"`);
+  if (!container)
+    throw new Error(`docker-statefulset: unknown service "${service}"`);
 
   const always = new Set<string>(["PATH"]);
   const hostForwarded: Array<{ name: string; hostVar: string }> = [];
   for (const entry of container.env) {
     if (entry.kind === "host") {
-      hostForwarded.push({ name: entry.name, hostVar: entry.hostVar ?? entry.name });
+      hostForwarded.push({
+        name: entry.name,
+        hostVar: entry.hostVar ?? entry.name,
+      });
     } else {
       always.add(entry.name);
     }
@@ -311,7 +338,8 @@ function resolveVolume(
   volumeName: string,
 ): string {
   const claim = spec.volumeClaimTemplates.find((v) => v.name === volumeName);
-  if (!claim) throw new Error(`docker-statefulset: unknown volume "${volumeName}"`);
+  if (!claim)
+    throw new Error(`docker-statefulset: unknown volume "${volumeName}"`);
   return claim.dockerVolume(instanceName);
 }
 
@@ -331,6 +359,8 @@ export function buildServiceRunArgs(
     extraAssistantEnv,
     extraGatewayEnv,
     avatarDevicePath,
+    netnsContainer,
+    assistantCaCertPath,
   } = opts;
 
   const result = {} as Record<ServiceName, () => string[]>;
@@ -356,7 +386,11 @@ export function buildServiceRunArgs(
       }
 
       // Network
-      if (container.network === "bridge") {
+      if (netnsContainer) {
+        // Every service joins an externally-owned namespace. The owner
+        // publishes host ports, so nothing is published here.
+        args.push(`--network=container:${netnsContainer}`);
+      } else if (container.network === "bridge") {
         args.push(`--network=${res.network}`);
         for (const port of container.ports ?? []) {
           const hostSide =
@@ -374,7 +408,12 @@ export function buildServiceRunArgs(
       // Volume mounts
       for (const mount of container.volumeMounts) {
         const vol = resolveVolume(spec, instanceName, mount.volumeName);
-        args.push("-v", mount.readOnly ? `${vol}:${mount.mountPath}:ro` : `${vol}:${mount.mountPath}`);
+        args.push(
+          "-v",
+          mount.readOnly
+            ? `${vol}:${mount.mountPath}:ro`
+            : `${vol}:${mount.mountPath}`,
+        );
       }
 
       // Env vars from spec
@@ -401,8 +440,10 @@ export function buildServiceRunArgs(
       // Assistant-only computed / optional additions
       if (svc === "assistant") {
         args.push(
-          "-e", `VELLUM_ASSISTANT_NAME=${instanceName}`,
-          "-e", `GATEWAY_INTERNAL_URL=http://localhost:${GATEWAY_INTERNAL_PORT}`,
+          "-e",
+          `VELLUM_ASSISTANT_NAME=${instanceName}`,
+          "-e",
+          `GATEWAY_INTERNAL_URL=http://localhost:${GATEWAY_INTERNAL_PORT}`,
         );
 
         if (extraAssistantEnv) {
@@ -413,8 +454,19 @@ export function buildServiceRunArgs(
 
         if (avatarDevicePath && existsSync(avatarDevicePath)) {
           args.push(
-            "--device", `${avatarDevicePath}:${avatarDevicePath}`,
-            "-e", `${AVATAR_DEVICE_ENV_VAR}=${avatarDevicePath}`,
+            "--device",
+            `${avatarDevicePath}:${avatarDevicePath}`,
+            "-e",
+            `${AVATAR_DEVICE_ENV_VAR}=${avatarDevicePath}`,
+          );
+        }
+
+        if (assistantCaCertPath) {
+          args.push(
+            "-v",
+            `${assistantCaCertPath}:${ASSISTANT_EXTRA_CA_TARGET}:ro`,
+            "-e",
+            `NODE_EXTRA_CA_CERTS=${ASSISTANT_EXTRA_CA_TARGET}`,
           );
         }
       }