Changes needed for Vellum Assistant on Mac Mini

[dvargasfuertes]

https://www.loom.com/share/4c4cb93b8e5f4fd0a58d313bafd1585f

---

[devin-ai-integration]

Devin Review found 1 potential issue.

View 5 additional findings in Devin Review.

[devin-ai-integration]

🟡 Temp file leaked when recoverFromCurlFailure throws during SCP/SSH exec

The new resolveInstallScriptPath() writes the embedded install script to a temp file (/tmp/vellum-install-<pid>.sh). In recoverFromCurlFailure, the cleanup unlinkSync at line 486 is placed after both exec calls but is not in a finally block. If exec("gcloud", scpArgs) at line 473 or exec("gcloud", sshArgs) at line 485 throws, the temp file is never deleted.

Root Cause

Previously, resolveInstallScriptPath returned a path to an existing file on the filesystem (no temp file was created), so there was nothing to clean up. Now that the function writes embedded content to a temp file (cli/src/lib/gcp.ts:375-378), all callers must ensure cleanup even on error paths.

The hatchCustom function in cli/src/commands/hatch.ts:503-505 correctly uses a finally block for cleanup. But recoverFromCurlFailure in gcp.ts does not:

await exec("gcloud", scpArgs);      // can throw
await exec("gcloud", sshArgs);      // can throw
try { unlinkSync(installScriptPath); } catch {}  // skipped if above throws

Impact: A temp file is left behind in /tmp on every failed recovery attempt. Low severity since it's in the OS temp directory and only on error paths.

Prompt for agents

In cli/src/lib/gcp.ts, in the recoverFromCurlFailure function (lines 454-487), wrap the SCP and SSH exec calls (lines 473 and 485) in a try/finally block so that the temp file at installScriptPath is always cleaned up, even if exec throws. Move the unlinkSync at line 486 into the finally block. This matches the pattern used in cli/src/commands/hatch.ts lines 482-505 where the hatchCustom function correctly uses try/finally for temp file cleanup.

---

Was this helpful? React with 👍 or 👎 to provide feedback.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: a7f8230e81

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[chatgpt-codex-connector]

Create temp install script inside cleanup guard

resolveInstallScriptPath() now writes a temporary file and can throw (for example when /tmp is full or not writable), but it is called before entering the try/finally cleanup block. In that failure path, startupScriptPath is never deleted, leaving a startup script in /tmp that includes sensitive values like ANTHROPIC_API_KEY and RUNTIME_PROXY_BEARER_TOKEN; moving temp install-script creation inside the guarded block (or adding an outer finally) avoids this leak.

Useful? React with 👍 / 👎.