Update

What the source does

• FilesystemNone observedNo reads or writes in the source
• NetworkNone observedNo outbound calls in the source
• ShellNone observedNo commands run in the source
• DependenciesPinnedNothing floats
• SecretsNone foundNo keys in source

Five audit layers

Gates applied: no behavioural pass.

assistant/CLAUDE.md

assistant/src/approvals/CLAUDE.md

assistant/src/notifications/CLAUDE.md

assistant/src/runtime/CLAUDE.md

gateway/CLAUDE.md

Audit 0.4.1 · source sha 19bc86343b63 · 14 Oct 2026Report an issue or request a re-scan

• Publishervellum-ai GitHub organizationOwner of the repository this skill is read from
• Source foldervellum-ai/vellum-assistant/.claude/skills/updateThe exact folder we audited
• LicenceMITAs the repository states it
• Commit pinned for this verdict19bc86343b63A new audit runs when the source changes
• Repository statusNot archivedLast push 1 day ago
• Sandboxed runNot runSkills are read, not executed; layer L4 is skipped

Its description: Restart the Vellum assistant and gateway services. Smart branch handling: pulls from main by default, restarts in-place on feature branches, or switches to a specified branch. Pass --pull to force-pull on the current…

---
name: update
description: >
  Restart the Vellum assistant and gateway services. Smart branch handling: pulls from main by default, restarts in-place on feature branches, or switches to a specified branch. Pass --pull to force-pull on the current branch.
---

# Update - Restart Vellum (with Smart Branch Handling)

Restart the Vellum assistant and gateway services with branch-aware git behavior.

## Arguments

The user may pass `$ARGUMENTS` to control branch behavior:

| Invocation | Behavior |
|---|---|
| `/update` (no args, on `main`) | Pull latest from `origin/main` (default) |
| `/update` (no args, on a feature branch) | Skip git ops - restart with the current checkout |
| `/update <branch>` | Check out that branch, pull if it has a remote |
| `/update --pull` | Force pull on whatever branch you're currently on |

## Steps

0. Ensure Bun is on PATH:
   ```bash
   export PATH="$HOME/.bun/bin:$PATH"
   ```

1. Preflight snapshot - capture current state before making changes:
   ```bash
   vellum ps
   ```

2. Quiesce with `vellum sleep` - stop assistant and gateway processes. This is directory-agnostic and stops processes globally regardless of CWD:
   ```bash
   vellum sleep || true
   ```

3. Verify stopped - run `vellum ps` and confirm no running processes. If `vellum ps` shows processes still running, run fallback cleanup to force-kill them:
   ```bash
   vellum ps
   ```

   **Fallback cleanup if `vellum ps` confirms processes are still running:**
   ```bash
   pkill -x "vellum-assistant" || true
   pkill -f "gateway/src/index" || true
   lsof -ti :7830 | xargs kill -9 2>/dev/null || true
   lsof -ti :7821 | xargs kill -9 2>/dev/null || true
   ```
   After fallback cleanup, run `vellum ps` again to confirm all processes are stopped.

4. Smart branch handling - determine what git operations (if any) to perform:

   ```bash
   CURRENT=$(git branch --show-current)
   GIT_OPS_RAN=false
   ```

   **Case A - `--pull` flag:** Force pull on the current branch.
   ```bash
   if [[ "$ARGUMENTS" == "--pull" ]]; then
     git pull
     GIT_OPS_RAN=true
   fi
   ```

   **Case B - Explicit branch name provided:** Check out the requested branch, pulling if possible. Before checking out, verify the working tree is clean - if there are uncommitted changes, **stop and warn the user** rather than silently losing work. Do NOT stash automatically.
   ```bash
   if [[ -n "$ARGUMENTS" && "$ARGUMENTS" != "--pull" ]]; then
     if ! git diff --quiet || ! git diff --cached --quiet; then
       echo "ERROR: Uncommitted changes detected. Commit or stash them before switching branches."
       # Stop and report the error to the user. Do not proceed.
     fi
     git checkout "$ARGUMENTS"
     git pull origin "$ARGUMENTS" 2>/dev/null || true
     GIT_OPS_RAN=true
   fi
   ```

   **Case C - No args, on `main`:** Pull latest from origin (preserves current default behavior).
   ```bash
   if [[ -z "$ARGUMENTS" && "$CURRENT" == "main" ]]; then
     git pull origin main
     GIT_OPS_RAN=true
   fi
   ```

   **Case D - No args, on a feature branch:** Skip git ops entirely - just restart with the current checkout.
   ```bash
   if [[ -z "$ARGUMENTS" && "$CURRENT" != "main" ]]; then
     echo "On branch '$CURRENT' - skipping git pull, restarting with current checkout"
   fi
   ```

5. Install dependencies - only if git operations ran (dependencies are unlikely to have changed for a local-only restart):
   ```bash
   if [[ "$GIT_OPS_RAN" == "true" ]]; then
     cd assistant && bun install && cd ..
     cd gateway && bun install && cd ..
   fi
   ```

6. Restart with `vellum wake` - start assistant and gateway from the current checkout. `vellum wake` must be run from the checkout directory that should supply the new assistant code:
   ```bash
   vellum wake
   ```

7. Verify fresh state - run `vellum ps` to confirm processes are running:
   ```bash
   sleep 5
   echo ""
   echo "=== Startup Summary ==="
   vellum ps
   echo "======================="
   ```

## Report

Tailor the report to what actually happened:

- **If git pulled (Cases A, B, C):** Report what was pulled (new commits), the branch, and whether dependencies were updated.
- **If restarted in-place (Case D):** Report that services were restarted on the current branch with no git changes.
- **Always include:** The startup summary block output (assistant health, gateway health).

Excerpt, first 4,397 characters of SKILL.md, verbatim from the audited commit. It is text from someone else’s repository, quoted so you can judge it before your agent reads it.

git clone https://github.com/vellum-ai/vellum-assistant
git -C vellum-assistant checkout 19bc86343b63

Works in

1. 2026-10-14
   ✓SAFE B 89 / 100

   first audit · source 19bc86343b63

Questions about Update

• github.com/vellum-ai/vellum-assistant/tree/main/.claude/skills/u — the audited source at commit 19bc86343b63 and every finding aboveObserved · 14 Oct 2026

Spotted something wrong? Report a correction · Methodology