@vellumai/cli 0.8.10-staging.1 → 0.8.11-dev.202606112057.e4bc22e

package/src/__tests__/helpers/env.ts

@@ -0,0 +1,19 @@
+/**
+ * Snapshot the given env vars now; returns a restore function suitable for
+ * `afterEach` that resets each var to its captured value (or deletes it).
+ */
+export function snapshotEnv(keys: readonly string[]): () => void {
+  const saved: Record<string, string | undefined> = {};
+  for (const key of keys) {
+    saved[key] = process.env[key];
+  }
+  return () => {
+    for (const key of keys) {
+      if (saved[key] === undefined) {
+        delete process.env[key];
+      } else {
+        process.env[key] = saved[key];
+      }
+    }
+  };
+}

package/src/__tests__/statefulset.test.ts

@@ -0,0 +1,149 @@
+import { describe, expect, test } from "bun:test";
+
+import {
+  buildServiceRunArgs,
+  getBuilderManagedEnvKeys,
+  type BuildServiceRunArgsOpts,
+  type DockerStatefulSetSpec,
+  type ServiceName,
+} from "../lib/statefulset.js";
+import { PROVIDER_ENV_VAR_NAMES } from "../shared/provider-env-vars.js";
+
+const SECRET_KEYS = [
+  "CES_SERVICE_TOKEN",
+  "ACTOR_TOKEN_SIGNING_KEY",
+  "GUARDIAN_BOOTSTRAP_SECRET",
+];
+
+describe("getBuilderManagedEnvKeys", () => {
+  test("gateway always-set keys cover spec static + secret entries and PATH", () => {
+    const { always } = getBuilderManagedEnvKeys("gateway");
+
+    const expected = [
+      "VELLUM_WORKSPACE_DIR",
+      "GATEWAY_SECURITY_DIR",
+      "ASSISTANT_HOST",
+      "CES_CREDENTIAL_URL",
+      "GATEWAY_IPC_SOCKET_DIR",
+      "ASSISTANT_IPC_SOCKET_DIR",
+      "GATEWAY_PORT",
+      "RUNTIME_HTTP_PORT",
+      ...SECRET_KEYS,
+      "PATH",
+    ];
+    for (const key of expected) {
+      expect(always.has(key)).toBe(true);
+    }
+
+    expect(always.has("VELLUM_DISABLE_PLATFORM")).toBe(false);
+    expect(always.has("VELLUM_DEVICE_ID")).toBe(false);
+  });
+
+  test("assistant always-set keys include secrets and builder-computed extras", () => {
+    const { always } = getBuilderManagedEnvKeys("assistant");
+
+    const expected = [
+      ...SECRET_KEYS,
+      "VELLUM_ASSISTANT_NAME",
+      "GATEWAY_INTERNAL_URL",
+      "RUNTIME_HTTP_HOST",
+      "PATH",
+    ];
+    for (const key of expected) {
+      expect(always.has(key)).toBe(true);
+    }
+  });
+
+  test("gateway hostForwarded equals the three spec host entries", () => {
+    const { hostForwarded } = getBuilderManagedEnvKeys("gateway");
+    const sorted = [...hostForwarded].sort((a, b) => a.name.localeCompare(b.name));
+    expect(sorted).toEqual([
+      { name: "VELAY_BASE_URL", hostVar: "VELAY_BASE_URL" },
+      { name: "VELLUM_ENVIRONMENT", hostVar: "VELLUM_ENVIRONMENT" },
+      { name: "VELLUM_PLATFORM_URL", hostVar: "VELLUM_PLATFORM_URL" },
+    ]);
+  });
+
+  test("assistant hostForwarded includes provider keys and platform URL", () => {
+    const { hostForwarded } = getBuilderManagedEnvKeys("assistant");
+    expect(hostForwarded).toContainEqual({
+      name: "ANTHROPIC_API_KEY",
+      hostVar: "ANTHROPIC_API_KEY",
+    });
+    for (const envVar of Object.values(PROVIDER_ENV_VAR_NAMES)) {
+      expect(hostForwarded).toContainEqual({ name: envVar, hostVar: envVar });
+    }
+    expect(hostForwarded).toContainEqual({
+      name: "VELLUM_PLATFORM_URL",
+      hostVar: "VELLUM_PLATFORM_URL",
+    });
+  });
+
+  test("hostForwarded keeps container name when hostVar differs", () => {
+    const spec: DockerStatefulSetSpec = {
+      startOrder: ["gateway"],
+      readiness: { endpoint: "/readyz", timeoutMs: 1, intervalMs: 1 },
+      volumeClaimTemplates: [],
+      containers: [
+        {
+          name: "gateway-sidecar",
+          internalName: "gateway",
+          network: "container",
+          env: [{ kind: "host", name: "CONTAINER_NAME", hostVar: "HOST_NAME" }],
+          volumeMounts: [],
+        },
+      ],
+    };
+
+    const { hostForwarded } = getBuilderManagedEnvKeys("gateway", spec);
+    expect(hostForwarded).toEqual([
+      { name: "CONTAINER_NAME", hostVar: "HOST_NAME" },
+    ]);
+  });
+
+  test("throws on unknown service name", () => {
+    expect(() => getBuilderManagedEnvKeys("bogus" as ServiceName)).toThrow(
+      'docker-statefulset: unknown service "bogus"',
+    );
+  });
+});
+
+describe("buildServiceRunArgs extra env routing", () => {
+  const opts: BuildServiceRunArgsOpts = {
+    gatewayPort: 18080,
+    imageTags: {
+      assistant: "assistant:test",
+      gateway: "gateway:test",
+      "credential-executor": "ces:test",
+    },
+    instanceName: "test-instance",
+    res: {
+      assistantContainer: "test-assistant",
+      cesContainer: "test-ces",
+      gatewayContainer: "test-gateway",
+      network: "test-net",
+    },
+    extraGatewayEnv: { VELLUM_DISABLE_PLATFORM: "1" },
+    extraAssistantEnv: { FOO: "bar" },
+  };
+
+  const runArgs = buildServiceRunArgs(opts);
+
+  test("extraGatewayEnv lands only in gateway args", () => {
+    const gatewayArgs = runArgs.gateway();
+    expect(gatewayArgs).toContain("VELLUM_DISABLE_PLATFORM=1");
+    expect(gatewayArgs).not.toContain("FOO=bar");
+  });
+
+  test("extraAssistantEnv lands only in assistant args", () => {
+    const assistantArgs = runArgs.assistant();
+    expect(assistantArgs).toContain("FOO=bar");
+    expect(assistantArgs).not.toContain("VELLUM_DISABLE_PLATFORM=1");
+  });
+
+  test("credential-executor args get neither extra env map", () => {
+    const cesArgs = runArgs["credential-executor"]();
+    expect(cesArgs).not.toContain("VELLUM_DISABLE_PLATFORM=1");
+    expect(cesArgs).not.toContain("FOO=bar");
+  });
+});

package/src/__tests__/upgrade-replay-env.test.ts

@@ -0,0 +1,165 @@
+import { afterEach, beforeEach, describe, expect, test } from "bun:test";
+
+import { resetHostDeviceIdCache } from "../lib/device-id.js";
+import type { DockerStatefulSetSpec } from "../lib/statefulset.js";
+import { buildReplayEnv, buildReplayState } from "../lib/upgrade-lifecycle.js";
+import { snapshotEnv } from "./helpers/env.js";
+
+const restoreEnv = snapshotEnv([
+  "VELLUM_PLATFORM_URL",
+  "ANTHROPIC_API_KEY",
+  "VELLUM_DEVICE_ID",
+]);
+
+afterEach(() => {
+  restoreEnv();
+  resetHostDeviceIdCache();
+});
+
+describe("buildReplayEnv", () => {
+  test("gateway: drops secrets, statics, and PATH; keeps flag overrides", () => {
+    const captured = {
+      GUARDIAN_BOOTSTRAP_SECRET: "s1",
+      CES_SERVICE_TOKEN: "s2",
+      ACTOR_TOKEN_SIGNING_KEY: "s3",
+      PATH: "/usr/bin",
+      GATEWAY_PORT: "18080",
+      VELLUM_DISABLE_PLATFORM: "1",
+      VELLUM_DEVICE_ID: "abc",
+    };
+
+    expect(buildReplayEnv(captured, "gateway")).toEqual({
+      VELLUM_DISABLE_PLATFORM: "1",
+      VELLUM_DEVICE_ID: "abc",
+    });
+  });
+
+  test("gateway: captured VELLUM_PLATFORM_URL dropped when set on host", () => {
+    process.env.VELLUM_PLATFORM_URL = "https://host.example.com";
+    const replay = buildReplayEnv(
+      { VELLUM_PLATFORM_URL: "https://stale.example.com" },
+      "gateway",
+    );
+    expect(replay).toEqual({});
+  });
+
+  test("gateway: captured VELLUM_PLATFORM_URL kept when unset on host", () => {
+    delete process.env.VELLUM_PLATFORM_URL;
+    const replay = buildReplayEnv(
+      { VELLUM_PLATFORM_URL: "https://stale.example.com" },
+      "gateway",
+    );
+    expect(replay).toEqual({
+      VELLUM_PLATFORM_URL: "https://stale.example.com",
+    });
+  });
+
+  test("assistant: drops builder-computed extras, secrets, and PATH; keeps custom flags", () => {
+    delete process.env.ANTHROPIC_API_KEY;
+    const captured = {
+      VELLUM_ASSISTANT_NAME: "my-assistant",
+      GATEWAY_INTERNAL_URL: "http://localhost:8080",
+      GUARDIAN_BOOTSTRAP_SECRET: "s1",
+      CES_SERVICE_TOKEN: "s2",
+      ACTOR_TOKEN_SIGNING_KEY: "s3",
+      PATH: "/usr/bin",
+      MY_CUSTOM_FLAG: "yes",
+      ANTHROPIC_API_KEY: "sk-captured",
+    };
+
+    expect(buildReplayEnv(captured, "assistant")).toEqual({
+      MY_CUSTOM_FLAG: "yes",
+      ANTHROPIC_API_KEY: "sk-captured",
+    });
+  });
+
+  test("assistant: captured ANTHROPIC_API_KEY dropped when set on host", () => {
+    process.env.ANTHROPIC_API_KEY = "sk-host";
+    const replay = buildReplayEnv(
+      { ANTHROPIC_API_KEY: "sk-captured", MY_CUSTOM_FLAG: "yes" },
+      "assistant",
+    );
+    expect(replay).toEqual({ MY_CUSTOM_FLAG: "yes" });
+  });
+
+  test("a secret added to the spec is auto-excluded with no code change", () => {
+    const spec: DockerStatefulSetSpec = {
+      startOrder: ["gateway"],
+      readiness: { endpoint: "/readyz", timeoutMs: 1, intervalMs: 1 },
+      volumeClaimTemplates: [],
+      containers: [
+        {
+          name: "gateway-sidecar",
+          internalName: "gateway",
+          network: "container",
+          env: [
+            { kind: "secret", name: "FUTURE_SECRET", secret: "signingKey" },
+          ],
+          volumeMounts: [],
+        },
+      ],
+    };
+
+    const replay = buildReplayEnv(
+      { FUTURE_SECRET: "leaky", VELLUM_DEVICE_ID: "abc" },
+      "gateway",
+      spec,
+    );
+    expect(replay).toEqual({ VELLUM_DEVICE_ID: "abc" });
+  });
+});
+
+describe("buildReplayState", () => {
+  beforeEach(() => {
+    // VELLUM_DEVICE_ID env precedence keeps getOrCreateHostDeviceId off the
+    // filesystem in tests.
+    process.env.VELLUM_DEVICE_ID = "host-device-id";
+    resetHostDeviceIdCache();
+  });
+
+  test("backfills VELLUM_DEVICE_ID on gateway replay env when absent", () => {
+    const state = buildReplayState({}, { VELLUM_DISABLE_PLATFORM: "1" });
+    expect(state.extraGatewayEnv).toEqual({
+      VELLUM_DISABLE_PLATFORM: "1",
+      VELLUM_DEVICE_ID: "host-device-id",
+    });
+  });
+
+  test("captured VELLUM_DEVICE_ID wins over host-derived id", () => {
+    const state = buildReplayState({}, { VELLUM_DEVICE_ID: "existing" });
+    expect(state.extraGatewayEnv.VELLUM_DEVICE_ID).toBe("existing");
+  });
+
+  test("backfills VELLUM_DEVICE_ID on assistant replay env when absent", () => {
+    const state = buildReplayState({}, {});
+    expect(state.extraAssistantEnv.VELLUM_DEVICE_ID).toBe("host-device-id");
+  });
+
+  test("assistant backfill inherits captured gateway VELLUM_DEVICE_ID", () => {
+    const state = buildReplayState({}, { VELLUM_DEVICE_ID: "gw-captured" });
+    expect(state.extraGatewayEnv.VELLUM_DEVICE_ID).toBe("gw-captured");
+    expect(state.extraAssistantEnv.VELLUM_DEVICE_ID).toBe("gw-captured");
+  });
+
+  test("captured assistant VELLUM_DEVICE_ID wins over host-derived id", () => {
+    const state = buildReplayState({ VELLUM_DEVICE_ID: "existing" }, {});
+    expect(state.extraAssistantEnv.VELLUM_DEVICE_ID).toBe("existing");
+  });
+
+  test("plucks secrets from the captured envs", () => {
+    const state = buildReplayState(
+      { CES_SERVICE_TOKEN: "ces-token", ACTOR_TOKEN_SIGNING_KEY: "sign-key" },
+      { GUARDIAN_BOOTSTRAP_SECRET: "bootstrap" },
+    );
+    expect(state.bootstrapSecret).toBe("bootstrap");
+    expect(state.cesServiceToken).toBe("ces-token");
+    expect(state.signingKey).toBe("sign-key");
+  });
+
+  test("generates fresh secrets when missing from captured env", () => {
+    const state = buildReplayState({}, {});
+    expect(state.bootstrapSecret).toBeUndefined();
+    expect(state.cesServiceToken).toMatch(/^[0-9a-f]{64}$/);
+    expect(state.signingKey).toMatch(/^[0-9a-f]{64}$/);
+  });
+});

package/src/__tests__/wake.test.ts

@@ -58,10 +58,27 @@ mock.module("../lib/docker.js", () => ({
 const seedGuardianTokenFromSiblingEnvMock = mock<
   typeof guardianToken.seedGuardianTokenFromSiblingEnv
 >(() => false);
+// Default: a token exists, so the re-provision recovery path is skipped. Tests
+// that exercise recovery override loadGuardianToken to return null.
+const loadGuardianTokenMock = mock<typeof guardianToken.loadGuardianToken>(
+  () => ({ accessToken: "existing" }) as ReturnType<
+    typeof guardianToken.loadGuardianToken
+  >,
+);
+const resetGuardianBootstrapMock = mock<
+  typeof guardianToken.resetGuardianBootstrap
+>(async () => {});
+const leaseGuardianTokenMock = mock<typeof guardianToken.leaseGuardianToken>(
+  async () =>
+    ({}) as Awaited<ReturnType<typeof guardianToken.leaseGuardianToken>>,
+);
 
 mock.module("../lib/guardian-token.js", () => ({
   ...realGuardianToken,
   seedGuardianTokenFromSiblingEnv: seedGuardianTokenFromSiblingEnvMock,
+  loadGuardianToken: loadGuardianTokenMock,
+  resetGuardianBootstrap: resetGuardianBootstrapMock,
+  leaseGuardianToken: leaseGuardianTokenMock,
 }));
 
 const resolveProcessStateMock = mock<typeof processLib.resolveProcessState>(
@@ -169,6 +186,16 @@ beforeEach(() => {
   startGatewayMock.mockResolvedValue("http://127.0.0.1:7830");
   seedGuardianTokenFromSiblingEnvMock.mockReset();
   seedGuardianTokenFromSiblingEnvMock.mockReturnValue(false);
+  loadGuardianTokenMock.mockReset();
+  loadGuardianTokenMock.mockReturnValue({ accessToken: "existing" } as ReturnType<
+    typeof guardianToken.loadGuardianToken
+  >);
+  resetGuardianBootstrapMock.mockReset();
+  resetGuardianBootstrapMock.mockResolvedValue(undefined);
+  leaseGuardianTokenMock.mockReset();
+  leaseGuardianTokenMock.mockResolvedValue(
+    {} as Awaited<ReturnType<typeof guardianToken.leaseGuardianToken>>,
+  );
   maybeStartNgrokTunnelMock.mockReset();
   maybeStartNgrokTunnelMock.mockResolvedValue(null);
 });
@@ -212,4 +239,45 @@ describe("vellum wake", () => {
       },
     );
   });
+
+  test("re-provisions the guardian token when missing and --repair-guardian is passed", async () => {
+    process.argv = ["bun", "vellum", "wake", "--repair-guardian", "local-assistant"];
+    loadGuardianTokenMock.mockReturnValue(null);
+
+    await wake();
+
+    // Resets the gateway's spent bootstrap state, then re-leases against the
+    // loopback gateway with the lockfile's bootstrap secret.
+    expect(resetGuardianBootstrapMock).toHaveBeenCalledWith(
+      "http://127.0.0.1:7830",
+      "generated-bootstrap-secret",
+    );
+    expect(leaseGuardianTokenMock).toHaveBeenCalledWith(
+      "http://127.0.0.1:7830",
+      "local-assistant",
+      "generated-bootstrap-secret",
+    );
+  });
+
+  test("does NOT re-provision without --repair-guardian, even when the token is missing", async () => {
+    // The automatic connect-repair path spawns `wake <id>` with no flags. A
+    // re-lease here would revoke other device-bound tokens (other tabs / local
+    // clients), so it must never run from auto-repair.
+    process.argv = ["bun", "vellum", "wake", "local-assistant"];
+    loadGuardianTokenMock.mockReturnValue(null);
+
+    await wake();
+
+    expect(resetGuardianBootstrapMock).not.toHaveBeenCalled();
+    expect(leaseGuardianTokenMock).not.toHaveBeenCalled();
+  });
+
+  test("skips re-provision when a guardian token already exists", async () => {
+    process.argv = ["bun", "vellum", "wake", "--repair-guardian", "local-assistant"];
+    // loadGuardianToken returns a token by default — recovery must not run.
+    await wake();
+
+    expect(resetGuardianBootstrapMock).not.toHaveBeenCalled();
+    expect(leaseGuardianTokenMock).not.toHaveBeenCalled();
+  });
 });

package/src/commands/backup.ts

@@ -16,6 +16,7 @@ import {
   platformRequestSignedUrl,
   readPlatformToken,
 } from "../lib/platform-client.js";
+import { loopbackSafeFetch } from "../lib/loopback-fetch.js";
 
 export async function backup(): Promise<void> {
   const args = process.argv.slice(3);
@@ -112,7 +113,7 @@ export async function backup(): Promise<void> {
   // Call the export endpoint
   let response: Response;
   try {
-    response = await fetch(`${entry.runtimeUrl}/v1/migrations/export`, {
+    response = await loopbackSafeFetch(`${entry.runtimeUrl}/v1/migrations/export`, {
       method: "POST",
       headers: {
         Authorization: `Bearer ${accessToken}`,
@@ -138,7 +139,7 @@ export async function backup(): Promise<void> {
       }
       if (refreshedToken) {
         accessToken = refreshedToken;
-        response = await fetch(`${entry.runtimeUrl}/v1/migrations/export`, {
+        response = await loopbackSafeFetch(`${entry.runtimeUrl}/v1/migrations/export`, {
           method: "POST",
           headers: {
             Authorization: `Bearer ${accessToken}`,

package/src/commands/client.ts

@@ -56,6 +56,7 @@ import {
   readPlatformToken,
 } from "../lib/platform-client";
 import { tuiLog } from "../lib/tui-log";
+import { loopbackSafeFetch } from "../lib/loopback-fetch.js";
 
 const SUPPORTED_INTERFACES = ["cli", "web"] as const;
 type SupportedInterface = (typeof SUPPORTED_INTERFACES)[number];
@@ -85,6 +86,7 @@ interface ParsedArgs {
   flagEnvVars: Record<string, string>;
   /** Parsed --flag overrides: kebab-case key -> typed value (for web injection). */
   parsedFlagOverrides: Record<string, boolean | string>;
+  disablePlatform: boolean;
 }
 
 function readAssistantName(entry: AssistantEntry | null): string | undefined {
@@ -99,6 +101,8 @@ export function parseArgs(): ParsedArgs {
   const { envVars: cliFlagVars, remaining: argsWithoutFlags } =
     parseFeatureFlagArgs(process.argv.slice(3));
   const flagEnvVars = { ...readAmbientFlagEnvVars(), ...cliFlagVars };
+  const disablePlatformAmbient = process.env.VELLUM_DISABLE_PLATFORM?.trim().toLowerCase();
+  let disablePlatform = disablePlatformAmbient === "true" || disablePlatformAmbient === "1";
   const args = argsWithoutFlags;
 
   // Build parsedFlagOverrides from the extracted env vars:
@@ -133,6 +137,8 @@ export function parseArgs(): ParsedArgs {
     if (arg === "--help" || arg === "-h") {
       printUsage();
       process.exit(0);
+    } else if (arg === "--disable-platform") {
+      disablePlatform = true;
     } else if (
       (arg === "--url" ||
         arg === "-u" ||
@@ -252,6 +258,7 @@ export function parseArgs(): ParsedArgs {
     interfaceId,
     flagEnvVars,
     parsedFlagOverrides,
+    disablePlatform,
   };
 }
 
@@ -272,6 +279,7 @@ ${ANSI.bold}OPTIONS:${ANSI.reset}
     -a, --assistant-id <id>    Assistant ID
     -i, --interface <id>       Interface identifier: cli (default) or web
     --flag <key=value>         Feature flag override (repeatable, kebab-case key)
+    --disable-platform         Suppress all outbound platform API calls
     -h, --help                 Show this help message
 
 ${ANSI.bold}DEFAULTS:${ANSI.reset}
@@ -451,6 +459,7 @@ async function handleLocalEndpoints(
         result = replacePlatformAssistants(
           lockfilePaths,
           body.platformAssistants as Array<Record<string, unknown>>,
+          body.organizationId as string | undefined,
         );
       } else {
         result = upsertLockfileAssistant(
@@ -611,7 +620,7 @@ async function handleLocalEndpoints(
 
     try {
       const hasBody = req.method !== "GET" && req.method !== "HEAD";
-      const proxyRes = await fetch(targetUrl, {
+      const proxyRes = await loopbackSafeFetch(targetUrl, {
         method: req.method,
         headers,
         body: hasBody ? req.body : undefined,
@@ -652,6 +661,7 @@ function getBaseDir(): string {
 async function runWebInterface(
   flagEnvVars: Record<string, string>,
   parsedFlagOverrides: Record<string, boolean | string>,
+  disablePlatform: boolean,
 ): Promise<void> {
   // Propagate flag env vars so child processes (e.g. hatch from the web UI) inherit them.
   Object.assign(process.env, flagEnvVars);
@@ -660,7 +670,7 @@ async function runWebInterface(
   // (HMR, __local endpoints, gateway proxy).
   const webSourceDir = findWebSourceDir();
   if (webSourceDir) {
-    return runViteDevServer(webSourceDir, flagEnvVars);
+    return runViteDevServer(webSourceDir, flagEnvVars, disablePlatform);
   }
 
   const distDir = findWebDistDir();
@@ -679,7 +689,7 @@ async function runWebInterface(
   const webUrl = getWebUrl();
   const safeJson = (v: unknown) =>
     JSON.stringify(v).replace(/</g, "\\u003c").replace(/>/g, "\\u003e");
-  const configJson = safeJson({ webUrl, platformUrl });
+  const configJson = safeJson({ webUrl, platformUrl, disablePlatform });
   const hasOverrides = Object.keys(parsedFlagOverrides).length > 0;
   const flagOverridesSnippet = hasOverrides
     ? `;window.__VELLUM_FLAG_OVERRIDES__=${safeJson(parsedFlagOverrides)}`
@@ -751,7 +761,7 @@ async function runWebInterface(
         try {
           const hasBody = req.method !== "GET" && req.method !== "HEAD";
           const body = hasBody ? await req.arrayBuffer() : undefined;
-          const proxyRes = await fetch(target.toString(), {
+          const proxyRes = await loopbackSafeFetch(target.toString(), {
             method: req.method,
             headers,
             body,
@@ -814,6 +824,7 @@ async function runWebInterface(
 async function runViteDevServer(
   webSourceDir: string,
   flagEnvVars: Record<string, string>,
+  disablePlatform: boolean,
 ): Promise<void> {
   const platformUrl = getPlatformUrl();
 
@@ -830,6 +841,7 @@ async function runViteDevServer(
       ...process.env,
       ...flagEnvVars,
       ...viteFlagVars,
+      ...(disablePlatform ? { VITE_VELLUM_DISABLE_PLATFORM: "true" } : {}),
       VITE_PLATFORM_MODE: "false",
       API_PROXY_TARGET: platformUrl,
       VELLUM_WEB_URL: getWebUrl(),
@@ -909,10 +921,15 @@ export async function client(): Promise<void> {
     interfaceId,
     flagEnvVars,
     parsedFlagOverrides,
+    disablePlatform,
   } = parseArgs();
 
+  if (disablePlatform) {
+    process.env.VELLUM_DISABLE_PLATFORM = "true";
+  }
+
   if (interfaceId === WEB_INTERFACE_ID) {
-    await runWebInterface(flagEnvVars, parsedFlagOverrides);
+    await runWebInterface(flagEnvVars, parsedFlagOverrides, disablePlatform);
     return;
   }