@vellumai/credential-executor 0.10.7-dev.202607102035.64f07ea → 0.10.7-staging.1

package/src/main.ts

@@ -1,24 +1,26 @@
 #!/usr/bin/env bun
 /**
- * CES (Credential Execution Service) entrypoint — unified for both
- * local (bare-metal sibling) and managed (Kubernetes sidecar) modes.
+ * Local CES entrypoint. Two run modes:
  *
- * Mode is determined by `getCesMode()` from `paths.ts`:
- * - `CES_MODE=managed` (set in the Dockerfile / K8s statefulset) → managed mode
- * - absent or any other value → local mode (bare-metal sibling)
+ * - **stdio child (default):** the assistant spawns CES as a child process and
+ *   communicates over stdin/stdout. CES shuts down when stdin closes (parent
+ *   exit) or on SIGTERM. This is today's behavior.
  *
- * Both modes serve credential CRUD RPC over a Unix socket using a concurrent
- * multi-connection server (`serveStandaloneSocket`). Each connection gets its
- * own `CesRpcServer` over a shared, process-scoped handler registry. The server
- * stays listening across connections, so an assistant that disconnects (crash,
- * restart) can reconnect without CES re-binding.
+ * - **standalone sibling (`CES_STANDALONE=1`):** CES is launched independently
+ *   by the CLI (the opt-in), serves RPC over a
+ *   Unix socket (`getLocalSocketPath()`), and runs until SIGTERM — no stdio.
+ *   This is the direction local CES is converging on; the socket-serving here
+ *   is temporary scaffolding to be folded into a single unified CES entrypoint.
  *
- * Managed mode additionally starts a health HTTP server (`/healthz`, `/readyz`,
- * optional credential CRUD routes) for Kubernetes liveness/readiness probes.
+ * Local mode never opens a TCP listener. Neither the stdio transport nor the
+ * Unix socket's listening fd is inherited by shell subprocesses spawned by CES
+ * (e.g. for `run_authenticated_command`): Bun's `Bun.spawn` defaults to "pipe"
+ * for stdio, and the listening socket is not passed to those subprocesses.
  */
 
 import { mkdirSync, unlinkSync } from "node:fs";
 import { createServer as createNetServer, type Socket } from "node:net";
+import { homedir } from "node:os";
 import { dirname, join } from "node:path";
 import { Readable, Writable } from "node:stream";
 
@@ -26,60 +28,285 @@ import {
   CES_PROTOCOL_VERSION,
   CesRpcMethod,
 } from "@vellumai/service-contracts/credential-rpc";
-import type { SecureKeyBackend } from "@vellumai/credential-storage";
+import { StaticCredentialMetadataStore } from "@vellumai/credential-storage";
 
+import { AuditStore } from "./audit/store.js";
+import { PersistentGrantStore } from "./grants/persistent-store.js";
+import {
+  createListAuditRecordsHandler,
+  createListGrantsHandler,
+  createRecordGrantHandler,
+  createRevokeGrantHandler,
+} from "./grants/rpc-handlers.js";
+import { TemporaryGrantStore } from "./grants/temporary-store.js";
+import { LocalMaterialiser } from "./materializers/local.js";
+import type { SecureKeyBackend } from "@vellumai/credential-storage";
 import { createLocalSecureKeyBackend } from "./materializers/local-secure-key-backend.js";
+import { createLocalOAuthLookup } from "./materializers/local-oauth-lookup.js";
+import { createLocalTokenRefreshFn } from "./materializers/local-token-refresh.js";
+import { resolveLocalSubject } from "./subjects/local.js";
+import { checkCredentialPolicy } from "./subjects/policy.js";
 import { initLogger, getLogger } from "./logger.js";
 import {
-  getBootstrapSocketPath,
+  getCesAuditDir,
   getCesDataRoot,
+  getCesGrantsDir,
   getCesLogDir,
-  getCesMode,
-  getHealthPort,
+  getCesToolStoreDir,
   getLocalSocketPath,
-  getSecurityDir,
-  type CesMode,
 } from "./paths.js";
-import { CesRpcServer, type RpcHandlerRegistry } from "./server.js";
 import {
-  handleCredentialRoute,
-  type CredentialRouteDeps,
-} from "./http/credential-routes.js";
-import { handleLogExportRoute } from "./http/log-export-routes.js";
+  buildHandlersWithHttp,
+  CesRpcServer,
+  registerCommandExecutionHandler,
+  registerManageSecureCommandToolHandler,
+  type RpcHandlerRegistry,
+} from "./server.js";
+import {
+  deleteBundleFromToolstore,
+  publishBundle,
+} from "./toolstore/publish.js";
+import { validateSourceUrl } from "./toolstore/manifest.js";
+import { buildCesEgressHooks } from "./commands/egress-hooks.js";
 import { CES_MIGRATIONS } from "./migrations/registry.js";
 import { runCesMigrations } from "./migrations/runner.js";
 
 // ---------------------------------------------------------------------------
-// Logging (module-level for early bootstrap + structured logging post-init)
+// Data directory bootstrap
 // ---------------------------------------------------------------------------
 
-const log = getLogger("main");
+function ensureDataDirs(): void {
+  const dirs = [
+    getCesDataRoot("local"),
+    getCesGrantsDir("local"),
+    getCesAuditDir("local"),
+    getCesToolStoreDir("local"),
+  ];
+  for (const dir of dirs) {
+    mkdirSync(dir, { recursive: true });
+  }
+}
 
 // ---------------------------------------------------------------------------
-// Data directory bootstrap
+// Path resolution
 // ---------------------------------------------------------------------------
 
-function ensureDataDirs(mode: CesMode): void {
-  mkdirSync(getCesDataRoot(mode), { recursive: true });
+/**
+ * Resolve the workspace directory.
+ *
+ * Priority:
+ * 1. `VELLUM_WORKSPACE_DIR` env var (set by the platform template)
+ * 2. Default: `~/.vellum/workspace`
+ */
+function getWorkspaceDir(): string {
+  return (
+    process.env["VELLUM_WORKSPACE_DIR"]?.trim() ||
+    join(homedir(), ".vellum", "workspace")
+  );
+}
+
+/**
+ * Resolve the CES security directory (contains key stores, encryption data).
+ *
+ * Priority:
+ * 1. `CREDENTIAL_SECURITY_DIR` env var (set by the platform template for
+ *    the CES container — `/ces-security` in managed mode)
+ * 2. Default: `~/.vellum/protected` (local mode)
+ */
+function getSecurityDir(): string {
+  return (
+    process.env["CREDENTIAL_SECURITY_DIR"]?.trim() ||
+    join(homedir(), ".vellum", "protected")
+  );
 }
 
 // ---------------------------------------------------------------------------
-// Credential CRUD handlers
+// Build RPC handler registry
 // ---------------------------------------------------------------------------
 
-/**
- * Build the RPC handler registry. CES serves credential CRUD (get / set /
- * delete / list / bulk-set) backed by the secure key store. The
- * `update_managed_credential` handler is registered separately by the RPC
- * server when an `onApiKeyUpdate` callback is supplied. Local and managed modes
- * share the same registry — they differ only in where the secure key backend
- * reads from and whether the health server is started.
- */
-function buildCrudHandlers(
-  secureKeyBackend: SecureKeyBackend,
-): RpcHandlerRegistry {
-  const handlers: RpcHandlerRegistry = {};
+function buildHandlers(secureKeyBackend: SecureKeyBackend): RpcHandlerRegistry {
+  // -- Grant stores ----------------------------------------------------------
+  const persistentGrantStore = new PersistentGrantStore(
+    getCesGrantsDir("local"),
+  );
+  persistentGrantStore.init();
+
+  const temporaryGrantStore = new TemporaryGrantStore();
+
+  // -- Audit store -----------------------------------------------------------
+  const auditStore = new AuditStore(getCesAuditDir("local"));
+  auditStore.init();
+
+  // -- Credential backend (local) --------------------------------------------
+  // In local mode CES shares the filesystem with the assistant and can access
+  // the same credential metadata and secure-key stores.
+  const workspaceDir = getWorkspaceDir();
+  const credentialMetadataPath = join(
+    workspaceDir,
+    "data",
+    "credentials",
+    "metadata.json",
+  );
+  const metadataStore = new StaticCredentialMetadataStore(
+    credentialMetadataPath,
+  );
+
+  // Read-only OAuth connection lookup backed by the assistant's SQLite
+  // database. CES opens the database in read-only mode.
+  const oauthConnections = createLocalOAuthLookup(workspaceDir);
+
+  const localMaterialiser = new LocalMaterialiser({
+    secureKeyBackend,
+    tokenRefreshFn: createLocalTokenRefreshFn(workspaceDir, secureKeyBackend),
+  });
+
+  // -- Build handler registry ------------------------------------------------
+
+  // Start with the HTTP handler (make_authenticated_request)
+  const handlers = buildHandlersWithHttp({
+    persistentGrantStore,
+    temporaryGrantStore,
+    localMaterialiser,
+    localSubjectDeps: {
+      metadataStore,
+      oauthConnections,
+    },
+    auditStore,
+  });
+
+  // Register run_authenticated_command handler
+  registerCommandExecutionHandler(handlers, {
+    executorDeps: {
+      persistentStore: persistentGrantStore,
+      temporaryStore: temporaryGrantStore,
+      materializeCredential: async (handle) => {
+        // Resolve the subject first, then materialise through the local backend
+        const subjectResult = resolveLocalSubject(handle, {
+          metadataStore,
+          oauthConnections,
+        });
+        if (!subjectResult.ok) {
+          return { ok: false as const, error: subjectResult.error };
+        }
+
+        // Enforce credential-level policies for local static handles
+        if (subjectResult.subject.type === "local_static") {
+          const policyCheck = checkCredentialPolicy(
+            subjectResult.subject.metadata,
+            "run_authenticated_command",
+          );
+          if (!policyCheck.ok) {
+            return { ok: false as const, error: policyCheck.error! };
+          }
+        }
+
+        const matResult = await localMaterialiser.materialise(
+          subjectResult.subject,
+        );
+        if (!matResult.ok) {
+          return { ok: false as const, error: matResult.error };
+        }
+        return {
+          ok: true as const,
+          value: matResult.credential.value,
+          handleType: matResult.credential.handleType,
+        };
+      },
+      auditStore,
+      cesMode: "local",
+      egressHooks: buildCesEgressHooks(),
+    },
+    defaultWorkspaceDir: workspaceDir,
+  });
+
+  // Register manage_secure_command_tool handler
+  const toolRegistry = new Map<
+    string,
+    {
+      toolName: string;
+      credentialHandle: string;
+      description: string;
+      bundleDigest: string;
+    }
+  >();
+
+  registerManageSecureCommandToolHandler(handlers, {
+    downloadBundle: async (sourceUrl: string) => {
+      const urlError = validateSourceUrl(sourceUrl);
+      if (urlError) {
+        throw new Error(urlError);
+      }
+      const MAX_BUNDLE_SIZE = 100 * 1024 * 1024; // 100 MB
+      const resp = await fetch(sourceUrl, {
+        signal: AbortSignal.timeout(60_000),
+      });
+      if (!resp.ok) {
+        throw new Error(`HTTP ${resp.status}: ${resp.statusText}`);
+      }
+      const contentLength = resp.headers.get("content-length");
+      if (contentLength && parseInt(contentLength, 10) > MAX_BUNDLE_SIZE) {
+        throw new Error(
+          `Bundle too large: ${contentLength} bytes (max ${MAX_BUNDLE_SIZE})`,
+        );
+      }
+      // Stream the body and enforce the size limit on actual bytes received,
+      // since Content-Length can be absent (chunked encoding) or lie.
+      const body = resp.body;
+      if (!body) {
+        throw new Error("Response body is null");
+      }
+      const chunks: Uint8Array[] = [];
+      let totalBytes = 0;
+      for await (const chunk of body) {
+        totalBytes += chunk.byteLength;
+        if (totalBytes > MAX_BUNDLE_SIZE) {
+          throw new Error(
+            `Bundle too large: received >${MAX_BUNDLE_SIZE} bytes (max ${MAX_BUNDLE_SIZE})`,
+          );
+        }
+        chunks.push(chunk);
+      }
+      return Buffer.concat(chunks);
+    },
+    publishBundle: (request) => publishBundle({ ...request, cesMode: "local" }),
+    unregisterTool: (toolName: string) => {
+      const entry = toolRegistry.get(toolName);
+      const removed = toolRegistry.delete(toolName);
+      if (removed && entry?.bundleDigest) {
+        const stillInUse = Array.from(toolRegistry.values()).some(
+          (t) => t.bundleDigest === entry.bundleDigest,
+        );
+        if (!stillInUse) {
+          deleteBundleFromToolstore(entry.bundleDigest, "local");
+        }
+      }
+      return removed;
+    },
+    registerTool: (entry) => {
+      toolRegistry.set(entry.toolName, entry);
+    },
+  });
+
+  // Register grant management handlers
+  handlers[CesRpcMethod.RecordGrant] = createRecordGrantHandler({
+    persistentGrantStore,
+    temporaryGrantStore,
+  }) as (typeof handlers)[string];
 
+  handlers[CesRpcMethod.ListGrants] = createListGrantsHandler({
+    persistentGrantStore,
+  }) as (typeof handlers)[string];
+
+  handlers[CesRpcMethod.RevokeGrant] = createRevokeGrantHandler({
+    persistentGrantStore,
+  }) as (typeof handlers)[string];
+
+  // Register audit record handler
+  handlers[CesRpcMethod.ListAuditRecords] = createListAuditRecordsHandler({
+    auditStore,
+  }) as (typeof handlers)[string];
+
+  // Register credential CRUD handlers
   handlers[CesRpcMethod.GetCredential] = (async (req: { account: string }) => {
     const value = await secureKeyBackend.get(req.account);
     return { found: value !== undefined, value };
@@ -120,16 +347,16 @@ function buildCrudHandlers(
 }
 
 // ---------------------------------------------------------------------------
-// Socket server (unified multi-connection model)
+// Main
 // ---------------------------------------------------------------------------
 
 /**
- * Serve RPC over a Unix socket using a concurrent multi-connection model.
+ * Serve RPC over a Unix socket for standalone-sibling mode.
  *
  * Binds the socket, accepts connections concurrently (each served by its own
  * CesRpcServer over the shared handler registry), and unlinks the socket when
- * the signal aborts. The listener stays open across connections so a client
- * that disconnects can reconnect without CES re-binding.
+ * the signal aborts. Temporary scaffolding — this serving path will be folded
+ * into a single unified CES entrypoint shared with the managed sidecar.
  */
 function serveStandaloneSocket(opts: {
   socketPath: string;
@@ -137,22 +364,8 @@ function serveStandaloneSocket(opts: {
   signal: AbortSignal;
   logger: Pick<Console, "log" | "warn" | "error">;
   log: ReturnType<typeof getLogger>;
-  onHandshakeComplete?: (
-    sessionId: string,
-    assistantApiKey?: string,
-    assistantId?: string,
-  ) => void;
-  onApiKeyUpdate?: (assistantApiKey: string, assistantId?: string) => void;
 }): void {
-  const {
-    socketPath,
-    handlers,
-    signal,
-    logger,
-    log,
-    onHandshakeComplete,
-    onApiKeyUpdate,
-  } = opts;
+  const { socketPath, handlers, signal, logger, log } = opts;
 
   mkdirSync(dirname(socketPath), { recursive: true });
   try {
@@ -164,11 +377,10 @@ function serveStandaloneSocket(opts: {
   const netServer = createNetServer();
 
   netServer.on("error", (err) => {
-    log.warn({ err }, "CES socket server error");
+    log.warn({ err }, "CES standalone socket server error");
   });
 
   netServer.on("connection", (socket: Socket) => {
-    connectionCount++;
     const readable = new Readable({ read() {} });
     const writable = new Writable({
       write(chunk, _encoding, callback) {
@@ -192,24 +404,19 @@ function serveStandaloneSocket(opts: {
       handlers,
       logger,
       signal,
-      onHandshakeComplete: (sessionId, apiKey, assistantId) => {
-        onHandshakeComplete?.(sessionId, apiKey, assistantId);
-      },
-      onApiKeyUpdate: onApiKeyUpdate ?? (() => {}),
+      onApiKeyUpdate: () => {},
+    });
+    void server.serve().catch((err) => {
+      server.close();
+      log.warn(
+        { err },
+        "CES standalone connection ended with a transport error",
+      );
     });
-    void server
-      .serve()
-      .catch((err) => {
-        server.close();
-        log.warn({ err }, "CES connection ended with a transport error");
-      })
-      .then(() => {
-        connectionCount = Math.max(0, connectionCount - 1);
-      });
   });
 
   netServer.listen(socketPath, () => {
-    log.info(`CES socket listening at ${socketPath}`);
+    log.info(`CES standalone socket listening at ${socketPath}`);
   });
 
   signal.addEventListener(
@@ -226,89 +433,20 @@ function serveStandaloneSocket(opts: {
   );
 }
 
-// ---------------------------------------------------------------------------
-// Health server (managed mode only)
-// ---------------------------------------------------------------------------
-
-let connectionCount = 0;
-
-function startHealthServer(
-  port: number,
-  signal: AbortSignal,
-  credentialDeps: CredentialRouteDeps | null,
-): ReturnType<typeof Bun.serve> {
-  const server = Bun.serve({
-    port,
-    async fetch(req) {
-      const url = new URL(req.url);
-      if (url.pathname === "/healthz") {
-        return new Response(JSON.stringify({ status: "ok" }), {
-          headers: { "Content-Type": "application/json" },
-        });
-      }
-      if (url.pathname === "/readyz") {
-        // Always return 200 — pod readiness must not depend on whether the
-        // assistant has connected.  When the CES feature flag is off the
-        // assistant never connects, and a 503 here would block pod
-        // scheduling during dark-launch.  The sidecar can't do useful work
-        // without a connection anyway, so readiness is purely about the
-        // process being up and able to accept a future connection.
-        return new Response(
-          JSON.stringify({
-            status: "ok",
-            connections: connectionCount,
-            rpcConnected: connectionCount > 0,
-          }),
-          {
-            status: 200,
-            headers: { "Content-Type": "application/json" },
-          },
-        );
-      }
-
-      // Credential CRUD routes (only if service token is configured)
-      if (credentialDeps) {
-        const credentialResponse = await handleCredentialRoute(
-          req,
-          credentialDeps,
-        );
-        if (credentialResponse) return credentialResponse;
-      }
-
-      // Log export route
-      const logExportResponse = await handleLogExportRoute(
-        req,
-        getCesLogDir("managed"),
-      );
-      if (logExportResponse) return logExportResponse;
-
-      return new Response("Not Found", { status: 404 });
-    },
-  });
-
-  signal.addEventListener(
-    "abort",
-    () => {
-      server.stop(true);
-    },
-    { once: true },
-  );
-
-  return server;
-}
-
-// ---------------------------------------------------------------------------
-// Main
-// ---------------------------------------------------------------------------
-
 async function main(): Promise<void> {
-  const mode = getCesMode();
-  ensureDataDirs(mode);
+  ensureDataDirs();
 
-  initLogger({ dir: getCesLogDir(mode), retentionDays: 30 });
+  initLogger({ dir: getCesLogDir(), retentionDays: 30 });
+  const log = getLogger("main");
+
+  // `CES_STANDALONE=1` runs CES as an independent, CLI-launched sibling over a
+  // Unix socket; otherwise CES is the assistant's stdio child, as today.
+  const standalone = process.env["CES_STANDALONE"] === "1";
 
   log.info(
-    `Starting CES v${CES_PROTOCOL_VERSION} (${mode} mode, socket transport)`,
+    `Starting CES v${CES_PROTOCOL_VERSION} (local mode, ${
+      standalone ? "standalone socket" : "stdio"
+    } transport)`,
   );
 
   const controller = new AbortController();
@@ -321,57 +459,24 @@ async function main(): Promise<void> {
   process.on("SIGTERM", shutdown);
   process.on("SIGINT", shutdown);
 
-  // -- Secure key backend + migrations --------------------------------------
-  // The secure key backend path differs by mode:
-  // - Local: dirname(getSecurityDir()) — the parent of ~/.vellum/protected
-  //   (or CREDENTIAL_SECURITY_DIR when set by the CLI).
-  // - Managed: join(assistantDataMount, ".vellum") — the assistant data mount.
-  const secureKeyBackend =
-    mode === "managed"
-      ? createLocalSecureKeyBackend(
-          join(
-            process.env["CES_ASSISTANT_DATA_MOUNT"] ?? "/assistant-data-ro",
-            ".vellum",
-          ),
-        )
-      : createLocalSecureKeyBackend(dirname(getSecurityDir()));
-
+  // Build the credential backend and run one-time migrations before starting
+  // the RPC server. Migrations complete synchronously before any connection
+  // is accepted — the backend is then passed to buildHandlers so it is not
+  // re-instantiated.
+  const secureKeyBackend = createLocalSecureKeyBackend(
+    dirname(getSecurityDir()),
+  );
   await runCesMigrations(
-    getCesDataRoot(mode),
+    getCesDataRoot("local"),
     secureKeyBackend,
     CES_MIGRATIONS,
   );
-  log.info(`CES ${mode} startup: migrations complete`);
-
-  // -- Build handlers --------------------------------------------------------
-  // The per-connection session ID lives in each CesRpcServer's SessionContext;
-  // handlers read it at call time. The registry is shared across connections
-  // and identical in both modes.
-  const handlers = buildCrudHandlers(secureKeyBackend);
-
-  // -- Health server (managed only) -----------------------------------------
-  if (mode === "managed") {
-    const serviceToken = process.env["CES_SERVICE_TOKEN"] ?? "";
-    let credentialDeps: CredentialRouteDeps | null = null;
-
-    if (serviceToken) {
-      credentialDeps = { backend: secureKeyBackend, serviceToken };
-      log.info("Credential CRUD routes enabled (CES_SERVICE_TOKEN configured)");
-    } else {
-      log.warn(
-        "CES_SERVICE_TOKEN not set — credential CRUD HTTP routes are disabled. " +
-          "Set CES_SERVICE_TOKEN to enable credential management over HTTP.",
-      );
-    }
+  log.info("CES local startup: migrations complete");
 
-    const healthPort = getHealthPort();
-    startHealthServer(healthPort, controller.signal, credentialDeps);
-    log.info(`Health server listening on port ${healthPort}`);
-  }
-
-  // -- Socket server ---------------------------------------------------------
-  const socketPath =
-    mode === "managed" ? getBootstrapSocketPath() : getLocalSocketPath();
+  // Build the handler registry with all available RPC implementations.
+  // The handshake session ID is captured per connection in the server's
+  // SessionContext; handlers read it at call time for audit records.
+  const handlers = buildHandlers(secureKeyBackend);
 
   const rpcLog = getLogger("rpc");
   const rpcLogger = {
@@ -380,36 +485,43 @@ async function main(): Promise<void> {
     error: (msg: string, ...args: unknown[]) => rpcLog.error({ args }, msg),
   };
 
-  // Managed mode registers the `update_managed_credential` handler (via the
-  // `onApiKeyUpdate` hook) so the assistant can push its API key/ID after hatch.
-  // The push is acknowledged and logged; CES stores credentials via the CRUD
-  // handlers and no longer materializes platform tokens itself.
-  serveStandaloneSocket({
-    socketPath,
+  if (standalone) {
+    // Serve over a Unix socket and run until a shutdown signal — no stdio
+    // parent to anchor the lifecycle.
+    serveStandaloneSocket({
+      socketPath: getLocalSocketPath(),
+      handlers,
+      signal: controller.signal,
+      logger: rpcLogger,
+      log,
+    });
+    await new Promise<void>((resolve) => {
+      if (controller.signal.aborted) {
+        resolve();
+        return;
+      }
+      controller.signal.addEventListener("abort", () => resolve(), {
+        once: true,
+      });
+    });
+    log.info("Server stopped.");
+    return;
+  }
+
+  // Default: serve the spawning assistant over stdio. stdin closing (parent
+  // exit) or SIGTERM shuts CES down.
+  const server = new CesRpcServer({
+    input: process.stdin,
+    output: process.stdout,
     handlers,
-    signal: controller.signal,
     logger: rpcLogger,
-    log,
-    onApiKeyUpdate:
-      mode === "managed"
-        ? (_newKey: string, newAssistantId?: string) => {
-            log.info("Assistant API key updated via RPC");
-            if (newAssistantId) {
-              log.info("Assistant ID updated via RPC");
-            }
-          }
-        : undefined,
+    signal: controller.signal,
+    // Local mode reads API keys from env/store directly — no-op handler so
+    // update_managed_credential is still registered and returns success.
+    onApiKeyUpdate: () => {},
   });
 
-  await new Promise<void>((resolve) => {
-    if (controller.signal.aborted) {
-      resolve();
-      return;
-    }
-    controller.signal.addEventListener("abort", () => resolve(), {
-      once: true,
-    });
-  });
+  await server.serve();
   log.info("Server stopped.");
 }
 
@@ -417,7 +529,7 @@ main().catch((err) => {
   try {
     getLogger("main").fatal({ err }, "Fatal error");
   } catch {
-    process.stderr.write(`[ces-${getCesMode()}] Fatal: ${err}\n`);
+    process.stderr.write(`[ces-local] Fatal: ${err}\n`);
   }
   process.exit(1);
 });