@vellumai/credential-executor 0.12.2 → 0.12.3-staging.1

package/node_modules/@vellumai/service-contracts/src/__tests__/secret-detection.test.ts

@@ -63,6 +63,7 @@ const FIXTURES: Record<string, string> = {
   "Perplexity API Key": `pplx-${filler(40)}`,
   "Tavily API Key": `tvly-${filler(20)}`,
   "Firecrawl API Key": `fc-${filler(20)}`,
+  "Resend API Key": `re_${filler(8)}_${filler(24)}`,
 };
 
 describe("subpath export", () => {

package/node_modules/@vellumai/service-contracts/src/secret-detection.ts

@@ -230,6 +230,9 @@ export const PREFIX_PATTERNS: SecretPrefixPattern[] = [
 
   // -- Firecrawl --
   { label: "Firecrawl API Key", regex: /fc-[A-Za-z0-9]{20,}/ },
+  // Resend documents only the `re_` prefix; the segment shape is the observed
+  // key format. Strict on purpose: bare `re_` prefixes ordinary identifiers.
+  { label: "Resend API Key", regex: /re_[A-Za-z0-9]{8}_[A-Za-z0-9]{24,}/ },
 ];
 
 /**
@@ -362,7 +365,7 @@ export function isPlaceholderValue(value: string): boolean {
   // Strip known prefixes to isolate the variable part
   const variablePart = value
     .replace(
-      /^(?:AKIA|gh[pousr]_|github_pat_|glpat-|sk_live_|rk_live_|xoxb-|xoxp-|xapp-|sk-ant-|sk-proj-|sk-or-v1-|AIza|GOCSPX-|SK|SG\.|npm_|pypi-|key-|lin_api_|ntn_|fw_|pplx-|-----BEGIN [A-Z ]*PRIVATE KEY-----)/,
+      /^(?:AKIA|gh[pousr]_|github_pat_|glpat-|sk_live_|rk_live_|xoxb-|xoxp-|xapp-|sk-ant-|sk-proj-|sk-or-v1-|AIza|GOCSPX-|SK|SG\.|npm_|pypi-|key-|lin_api_|ntn_|fw_|pplx-|re_|-----BEGIN [A-Z ]*PRIVATE KEY-----)/,
       "",
     )
     .replace(/[^A-Za-z0-9]/g, "");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vellumai/credential-executor",
-  "version": "0.12.2",
+  "version": "0.12.3-staging.1",
   "license": "MIT",
   "type": "module",
   "exports": {

package/src/__tests__/local-standalone.test.ts

@@ -18,6 +18,8 @@ import { existsSync, mkdirSync, mkdtempSync, rmSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join, resolve } from "node:path";
 
+import { resolveIpcEndpoint } from "@vellumai/ipc-server-utils";
+
 import {
   CES_PROTOCOL_VERSION,
   CesRpcMethod,
@@ -136,24 +138,29 @@ afterEach(async () => {
 describe("local CES standalone sibling (real entrypoint)", () => {
   test("serves over a socket with no stdio parent, survives disconnect, exits on SIGTERM", async () => {
     tmpDir = mkdtempSync(join(tmpdir(), "ces-standalone-"));
-    const socketPath = join(tmpDir, "ces.sock");
     const securityDir = join(tmpDir, "protected");
     const workspaceDir = join(tmpDir, "workspace");
+    const bootstrapDir = join(securityDir, "credential-executor");
     mkdirSync(securityDir, { recursive: true });
     mkdirSync(workspaceDir, { recursive: true });
+    mkdirSync(bootstrapDir, { recursive: true });
+    const socketPath = resolveIpcEndpoint("ces", {
+      workspaceDir: bootstrapDir,
+    }).path;
 
     const localMain = resolve(__dirname, "..", "main.ts");
+    const env: Record<string, string | undefined> = {
+      ...process.env,
+      CREDENTIAL_SECURITY_DIR: securityDir,
+      VELLUM_WORKSPACE_DIR: workspaceDir,
+      CES_BOOTSTRAP_SOCKET_DIR: bootstrapDir,
+    };
 
     // stdin closed is how the CLI launches the sibling — CES serves over a
     // Unix socket, not stdio.
     proc = Bun.spawn({
       cmd: [process.execPath, localMain],
-      env: {
-        ...process.env,
-        CES_LOCAL_SOCKET: socketPath,
-        CREDENTIAL_SECURITY_DIR: securityDir,
-        VELLUM_WORKSPACE_DIR: workspaceDir,
-      },
+      env,
       stdin: "ignore",
       stdout: "ignore",
       stderr: "ignore",

package/src/__tests__/managed-integration.test.ts

@@ -54,7 +54,6 @@ import { createLocalSecureKeyBackend } from "../materializers/local-secure-key-b
 const SAVED_ENV_KEYS = [
   "CES_DATA_DIR",
   "CES_BOOTSTRAP_SOCKET_DIR",
-  "CES_BOOTSTRAP_SOCKET",
   "CES_HEALTH_PORT",
   "CES_MODE",
   "CREDENTIAL_SECURITY_DIR",

package/src/__tests__/managed-reconnect.test.ts

@@ -17,6 +17,7 @@ import { existsSync, mkdirSync, mkdtempSync, rmSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join, resolve } from "node:path";
 
+import { resolveIpcEndpoint } from "@vellumai/ipc-server-utils";
 import {
   CES_PROTOCOL_VERSION,
   type HandshakeAck,
@@ -172,7 +173,9 @@ describe("managed CES reconnection (real entrypoint)", () => {
     tmpDir = mkdtempSync(join(tmpdir(), "ces-reconnect-"));
     const dataDir = join(tmpDir, "ces-data");
     const socketDir = join(tmpDir, "bootstrap");
-    const socketPath = join(socketDir, "ces.sock");
+    const socketPath = resolveIpcEndpoint("ces", {
+      workspaceDir: socketDir,
+    }).path;
     const assistantDataMount = join(tmpDir, "assistant-data-ro");
     mkdirSync(dataDir, { recursive: true });
     mkdirSync(socketDir, { recursive: true });
@@ -187,7 +190,7 @@ describe("managed CES reconnection (real entrypoint)", () => {
         ...process.env,
         CES_MODE: "managed",
         CES_DATA_DIR: dataDir,
-        CES_BOOTSTRAP_SOCKET: socketPath,
+        CES_BOOTSTRAP_SOCKET_DIR: socketDir,
         CES_HEALTH_PORT: String(healthPort),
         CES_ASSISTANT_DATA_MOUNT: assistantDataMount,
       },

package/src/__tests__/transport.test.ts

@@ -17,6 +17,7 @@ import { readFileSync } from "node:fs";
 import { resolve } from "node:path";
 import { PassThrough } from "node:stream";
 
+import { resolveIpcEndpoint } from "@vellumai/ipc-server-utils";
 import {
   CES_PROTOCOL_VERSION,
   type HandshakeAck,
@@ -399,36 +400,49 @@ describe("CES data paths", () => {
     expect(root).not.toMatch(/workspace/);
   });
 
-  test("getBootstrapSocketPath defaults to /run/ces-bootstrap/ces.sock", () => {
-    const saved = process.env["CES_BOOTSTRAP_SOCKET"];
-    delete process.env["CES_BOOTSTRAP_SOCKET"];
+  test("getBootstrapSocketPath defaults to /run/ces-bootstrap", () => {
+    const savedDir = process.env["CES_BOOTSTRAP_SOCKET_DIR"];
+    delete process.env["CES_BOOTSTRAP_SOCKET_DIR"];
     try {
-      expect(getBootstrapSocketPath()).toBe("/run/ces-bootstrap/ces.sock");
+      expect(getBootstrapSocketPath()).toBe(
+        resolveIpcEndpoint("ces", {
+          workspaceDir: "/run/ces-bootstrap",
+        }).path,
+      );
     } finally {
-      if (saved !== undefined) process.env["CES_BOOTSTRAP_SOCKET"] = saved;
+      if (savedDir !== undefined) {
+        process.env["CES_BOOTSTRAP_SOCKET_DIR"] = savedDir;
+      } else {
+        delete process.env["CES_BOOTSTRAP_SOCKET_DIR"];
+      }
     }
   });
 
-  test("getBootstrapSocketPath respects CES_BOOTSTRAP_SOCKET env var", () => {
-    const savedSocket = process.env["CES_BOOTSTRAP_SOCKET"];
+  test("getBootstrapSocketPath uses CES_BOOTSTRAP_SOCKET_DIR via resolveIpcEndpoint", () => {
     const savedDir = process.env["CES_BOOTSTRAP_SOCKET_DIR"];
-    // CES_BOOTSTRAP_SOCKET_DIR takes precedence; clear it so the
-    // CES_BOOTSTRAP_SOCKET fallback is actually exercised.
-    delete process.env["CES_BOOTSTRAP_SOCKET_DIR"];
-    process.env["CES_BOOTSTRAP_SOCKET"] = "/tmp/test-ces.sock";
+    const savedWorkspace = process.env["VELLUM_WORKSPACE_DIR"];
+    process.env["CES_BOOTSTRAP_SOCKET_DIR"] = "/tmp/ces-bootstrap";
+    process.env["VELLUM_WORKSPACE_DIR"] = "/tmp/ces-ws";
     try {
-      expect(getBootstrapSocketPath()).toBe("/tmp/test-ces.sock");
+      expect(getBootstrapSocketPath()).toBe(
+        resolveIpcEndpoint("ces", {
+          workspaceDir: "/tmp/ces-bootstrap",
+        }).path,
+      );
+      expect(getBootstrapSocketPath()).not.toBe(
+        resolveIpcEndpoint("ces", { workspaceDir: "/tmp/ces-ws" }).path,
+      );
     } finally {
-      if (savedSocket !== undefined) {
-        process.env["CES_BOOTSTRAP_SOCKET"] = savedSocket;
-      } else {
-        delete process.env["CES_BOOTSTRAP_SOCKET"];
-      }
       if (savedDir !== undefined) {
         process.env["CES_BOOTSTRAP_SOCKET_DIR"] = savedDir;
       } else {
         delete process.env["CES_BOOTSTRAP_SOCKET_DIR"];
       }
+      if (savedWorkspace !== undefined) {
+        process.env["VELLUM_WORKSPACE_DIR"] = savedWorkspace;
+      } else {
+        delete process.env["VELLUM_WORKSPACE_DIR"];
+      }
     }
   });
 });

package/src/main.ts

@@ -41,7 +41,6 @@ import {
   getCesLogDir,
   getCesMode,
   getHealthPort,
-  getLocalSocketPath,
   getSecurityDir,
   type CesMode,
 } from "./paths.js";
@@ -399,8 +398,7 @@ async function main(): Promise<void> {
   }
 
   // -- Socket server ---------------------------------------------------------
-  const socketPath =
-    mode === "managed" ? getBootstrapSocketPath() : getLocalSocketPath();
+  const socketPath = getBootstrapSocketPath();
 
   const rpcLog = getLogger("rpc");
   const rpcLogger = {

package/src/paths.ts

@@ -22,6 +22,8 @@
 import { join } from "node:path";
 import { homedir } from "node:os";
 
+import { resolveIpcEndpoint } from "@vellumai/ipc-server-utils";
+
 // ---------------------------------------------------------------------------
 // Mode detection
 // ---------------------------------------------------------------------------
@@ -90,65 +92,28 @@ export function getCesLogDir(mode?: CesMode): string {
 }
 
 // ---------------------------------------------------------------------------
-// Bootstrap socket path (managed mode only)
+// CES socket path (local sibling and managed sidecar)
 // ---------------------------------------------------------------------------
 
-/** Default directory for the bootstrap Unix socket shared volume. */
+/** Default directory for the CES Unix socket. */
 const BOOTSTRAP_SOCKET_DIR = "/run/ces-bootstrap";
 
-/** Default bootstrap socket filename. */
-const BOOTSTRAP_SOCKET_NAME = "ces.sock";
-
 /**
- * Return the path to the bootstrap Unix socket.
+ * Return the path to the CES Unix socket used in every environment.
  *
- * In managed mode, CES listens on this socket for exactly one assistant
- * connection, then unlinks it. The path is on a shared `emptyDir` volume
- * visible to both containers.
+ * Local siblings and managed sidecars share this resolver. The assistant
+ * dials the same path CES binds.
  *
- * Priority:
- * 1. `CES_BOOTSTRAP_SOCKET_DIR` env var (directory) — appends `ces.sock`
- * 2. `CES_BOOTSTRAP_SOCKET` env var (full file path override)
- * 3. Hardcoded default: `/run/ces-bootstrap/ces.sock`
+ * Uses `CES_BOOTSTRAP_SOCKET_DIR` when set, otherwise `/run/ces-bootstrap`.
+ * `ces.sock` is resolved through `resolveIpcEndpoint` so macOS AF_UNIX
+ * limits and Windows named pipes stay consistent.
  *
- * The pod template exports `CES_BOOTSTRAP_SOCKET_DIR`; the full-path
- * override is kept for local testing convenience.
+ * The pod template and local CLI export `CES_BOOTSTRAP_SOCKET_DIR`.
  */
 export function getBootstrapSocketPath(): string {
-  const dir = process.env["CES_BOOTSTRAP_SOCKET_DIR"];
-  if (dir) {
-    return join(dir, BOOTSTRAP_SOCKET_NAME);
-  }
-  return (
-    process.env["CES_BOOTSTRAP_SOCKET"] ??
-    join(BOOTSTRAP_SOCKET_DIR, BOOTSTRAP_SOCKET_NAME)
-  );
-}
-
-// ---------------------------------------------------------------------------
-// Local-mode CES socket
-// ---------------------------------------------------------------------------
-
-/** Default local-mode CES socket filename (under the local data root). */
-const LOCAL_SOCKET_NAME = "ces.sock";
-
-/**
- * Return the path to the local-mode CES Unix socket.
- *
- * Used when local CES runs as a CLI-launched sibling process. The socket
- * lives under the CES-private local data root, whose directory permissions
- * are the access boundary.
- *
- * Priority:
- * 1. `CES_LOCAL_SOCKET` env var (full file path override; the CLI sets this
- *    when launching the sibling).
- * 2. Default: `<localDataRoot>/ces.sock`.
- */
-export function getLocalSocketPath(): string {
-  return (
-    process.env["CES_LOCAL_SOCKET"] ??
-    join(getCesDataRoot("local"), LOCAL_SOCKET_NAME)
-  );
+  const dir =
+    process.env["CES_BOOTSTRAP_SOCKET_DIR"]?.trim() || BOOTSTRAP_SOCKET_DIR;
+  return resolveIpcEndpoint("ces", { workspaceDir: dir }).path;
 }
 
 // ---------------------------------------------------------------------------