@vellumai/cli 0.8.9 → 0.8.10-dev.202606092334.09948c8

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vellumai/cli",
-  "version": "0.8.9",
+  "version": "0.8.10-dev.202606092334.09948c8",
   "description": "CLI tools for vellum-assistant",
   "type": "module",
   "exports": {

package/src/__tests__/confirm.test.ts

@@ -0,0 +1,85 @@
+import { describe, test, expect } from "bun:test";
+
+import { parseConfirmArgs } from "../commands/confirm.js";
+
+describe("parseConfirmArgs", () => {
+  test("parses a request id with the active assistant and defaults to allow", () => {
+    const r = parseConfirmArgs(["--request-id", "req-1"]);
+    expect(r).toEqual({
+      ok: true,
+      value: {
+        assistantId: undefined,
+        requestId: "req-1",
+        decision: "allow",
+        jsonOutput: false,
+      },
+    });
+  });
+
+  test("parses an explicit assistant plus request id", () => {
+    const r = parseConfirmArgs(["my-assistant", "--request-id", "req-1"]);
+    expect(r.ok).toBe(true);
+    if (!r.ok) return;
+    expect(r.value.assistantId).toBe("my-assistant");
+    expect(r.value.requestId).toBe("req-1");
+  });
+
+  test("honors an explicit deny decision", () => {
+    const r = parseConfirmArgs(["--request-id", "req-1", "--decision", "deny"]);
+    expect(r.ok).toBe(true);
+    if (!r.ok) return;
+    expect(r.value.decision).toBe("deny");
+  });
+
+  test("requires a request id", () => {
+    const r = parseConfirmArgs([]);
+    expect(r).toEqual({ ok: false, error: "--request-id is required." });
+  });
+
+  test("rejects an unknown decision", () => {
+    const r = parseConfirmArgs([
+      "--request-id",
+      "req-1",
+      "--decision",
+      "maybe",
+    ]);
+    expect(r).toEqual({
+      ok: false,
+      error: '--decision must be "allow" or "deny" (got "maybe").',
+    });
+  });
+
+  test("rejects a value-less --decision instead of defaulting to allow", () => {
+    // A trailing `--decision` with no value (e.g. an empty shell expansion)
+    // must not silently approve via the "allow" default.
+    const r = parseConfirmArgs(["--request-id", "req-1", "--decision"]);
+    expect(r).toEqual({
+      ok: false,
+      error: '--decision requires a value ("allow" or "deny").',
+    });
+  });
+
+  test("rejects an empty-string --decision value", () => {
+    const r = parseConfirmArgs(["--request-id", "req-1", "--decision", ""]);
+    expect(r).toEqual({
+      ok: false,
+      error: '--decision must be "allow" or "deny" (got "").',
+    });
+  });
+
+  test("rejects a value-less --request-id", () => {
+    const r = parseConfirmArgs(["--request-id"]);
+    expect(r).toEqual({
+      ok: false,
+      error: "--request-id requires a value.",
+    });
+  });
+
+  test("preserves --json alongside the request id", () => {
+    const r = parseConfirmArgs(["--json", "--request-id", "req-1"]);
+    expect(r.ok).toBe(true);
+    if (!r.ok) return;
+    expect(r.value.jsonOutput).toBe(true);
+    expect(r.value.requestId).toBe("req-1");
+  });
+});

package/src/commands/client.ts

@@ -85,6 +85,7 @@ interface ParsedArgs {
   flagEnvVars: Record<string, string>;
   /** Parsed --flag overrides: kebab-case key -> typed value (for web injection). */
   parsedFlagOverrides: Record<string, boolean | string>;
+  disablePlatform: boolean;
 }
 
 function readAssistantName(entry: AssistantEntry | null): string | undefined {
@@ -99,6 +100,8 @@ export function parseArgs(): ParsedArgs {
   const { envVars: cliFlagVars, remaining: argsWithoutFlags } =
     parseFeatureFlagArgs(process.argv.slice(3));
   const flagEnvVars = { ...readAmbientFlagEnvVars(), ...cliFlagVars };
+  const disablePlatformAmbient = process.env.VELLUM_DISABLE_PLATFORM?.trim().toLowerCase();
+  let disablePlatform = disablePlatformAmbient === "true" || disablePlatformAmbient === "1";
   const args = argsWithoutFlags;
 
   // Build parsedFlagOverrides from the extracted env vars:
@@ -133,6 +136,8 @@ export function parseArgs(): ParsedArgs {
     if (arg === "--help" || arg === "-h") {
       printUsage();
       process.exit(0);
+    } else if (arg === "--disable-platform") {
+      disablePlatform = true;
     } else if (
       (arg === "--url" ||
         arg === "-u" ||
@@ -252,6 +257,7 @@ export function parseArgs(): ParsedArgs {
     interfaceId,
     flagEnvVars,
     parsedFlagOverrides,
+    disablePlatform,
   };
 }
 
@@ -272,6 +278,7 @@ ${ANSI.bold}OPTIONS:${ANSI.reset}
     -a, --assistant-id <id>    Assistant ID
     -i, --interface <id>       Interface identifier: cli (default) or web
     --flag <key=value>         Feature flag override (repeatable, kebab-case key)
+    --disable-platform         Suppress all outbound platform API calls
     -h, --help                 Show this help message
 
 ${ANSI.bold}DEFAULTS:${ANSI.reset}
@@ -652,6 +659,7 @@ function getBaseDir(): string {
 async function runWebInterface(
   flagEnvVars: Record<string, string>,
   parsedFlagOverrides: Record<string, boolean | string>,
+  disablePlatform: boolean,
 ): Promise<void> {
   // Propagate flag env vars so child processes (e.g. hatch from the web UI) inherit them.
   Object.assign(process.env, flagEnvVars);
@@ -660,7 +668,7 @@ async function runWebInterface(
   // (HMR, __local endpoints, gateway proxy).
   const webSourceDir = findWebSourceDir();
   if (webSourceDir) {
-    return runViteDevServer(webSourceDir, flagEnvVars);
+    return runViteDevServer(webSourceDir, flagEnvVars, disablePlatform);
   }
 
   const distDir = findWebDistDir();
@@ -679,7 +687,7 @@ async function runWebInterface(
   const webUrl = getWebUrl();
   const safeJson = (v: unknown) =>
     JSON.stringify(v).replace(/</g, "\\u003c").replace(/>/g, "\\u003e");
-  const configJson = safeJson({ webUrl, platformUrl });
+  const configJson = safeJson({ webUrl, platformUrl, disablePlatform });
   const hasOverrides = Object.keys(parsedFlagOverrides).length > 0;
   const flagOverridesSnippet = hasOverrides
     ? `;window.__VELLUM_FLAG_OVERRIDES__=${safeJson(parsedFlagOverrides)}`
@@ -814,6 +822,7 @@ async function runWebInterface(
 async function runViteDevServer(
   webSourceDir: string,
   flagEnvVars: Record<string, string>,
+  disablePlatform: boolean,
 ): Promise<void> {
   const platformUrl = getPlatformUrl();
 
@@ -830,6 +839,7 @@ async function runViteDevServer(
       ...process.env,
       ...flagEnvVars,
       ...viteFlagVars,
+      ...(disablePlatform ? { VITE_VELLUM_DISABLE_PLATFORM: "true" } : {}),
       VITE_PLATFORM_MODE: "false",
       API_PROXY_TARGET: platformUrl,
       VELLUM_WEB_URL: getWebUrl(),
@@ -909,10 +919,15 @@ export async function client(): Promise<void> {
     interfaceId,
     flagEnvVars,
     parsedFlagOverrides,
+    disablePlatform,
   } = parseArgs();
 
+  if (disablePlatform) {
+    process.env.VELLUM_DISABLE_PLATFORM = "true";
+  }
+
   if (interfaceId === WEB_INTERFACE_ID) {
-    await runWebInterface(flagEnvVars, parsedFlagOverrides);
+    await runWebInterface(flagEnvVars, parsedFlagOverrides, disablePlatform);
     return;
   }
 

package/src/commands/confirm.ts

@@ -0,0 +1,144 @@
+/**
+ * `vellum confirm <assistant> --request-id <id> --decision allow|deny`
+ *
+ * Resolve a pending tool confirmation on a running assistant via its
+ * runtime HTTP API. The assistant raises a `confirmation_request` event
+ * (with a `requestId`) when a tool exceeds the auto-approve risk
+ * threshold; this command answers it so the turn can proceed. Headless
+ * automation (e.g. the evals harness) uses it to approve requests that
+ * would otherwise hang waiting for an interactive user.
+ */
+
+import { extractFlag } from "../lib/arg-utils.js";
+import { AssistantClient } from "../lib/assistant-client.js";
+
+function printUsage(): void {
+  console.log(`vellum confirm - Resolve a pending tool confirmation
+
+USAGE:
+    vellum confirm [assistant] --request-id <id> [--decision allow|deny]
+
+ARGUMENTS:
+    [assistant]    Instance name (default: active assistant)
+
+OPTIONS:
+    --request-id <id>     The requestId from the confirmation_request event (required)
+    --decision <value>    allow or deny (default: allow)
+    --json                Output raw JSON response
+
+EXAMPLES:
+    vellum confirm --request-id ede263d9-cc45-4d63-86f8-a656d17b3a3a
+    vellum confirm my-assistant --request-id req-1 --decision deny
+    vellum confirm --json --request-id req-1
+`);
+}
+
+interface ParsedConfirmArgs {
+  assistantId?: string;
+  requestId: string;
+  decision: "allow" | "deny";
+  jsonOutput: boolean;
+}
+
+type ParseResult =
+  | { ok: true; value: ParsedConfirmArgs }
+  | { ok: false; error: string };
+
+/**
+ * Parse `vellum confirm` arguments. Pure: does no I/O and never exits, so the
+ * positional/flag rules can be unit-tested. Defaults the decision to `allow`,
+ * which is the common automation case (approve and continue).
+ */
+export function parseConfirmArgs(rawArgs: string[]): ParseResult {
+  const jsonOutput = rawArgs.includes("--json");
+  let args = rawArgs.filter((a) => a !== "--json");
+
+  const requestIdFlagPresent = args.includes("--request-id");
+  const [requestId, afterRequestId] = extractFlag(args, "--request-id");
+  args = afterRequestId;
+
+  const decisionFlagPresent = args.includes("--decision");
+  const [decisionRaw, afterDecision] = extractFlag(args, "--decision");
+  args = afterDecision;
+
+  // `extractFlag` strips a trailing value-less flag, which would otherwise let
+  // the next positional masquerade as the flag's value (or, for --decision,
+  // silently fall back to "allow" and approve a tool call the caller never
+  // meant to approve). Treat a flag supplied without a value as an error.
+  if (requestIdFlagPresent && requestId === undefined) {
+    return { ok: false, error: "--request-id requires a value." };
+  }
+  if (!requestId) {
+    return { ok: false, error: "--request-id is required." };
+  }
+
+  if (decisionFlagPresent && decisionRaw === undefined) {
+    return {
+      ok: false,
+      error: '--decision requires a value ("allow" or "deny").',
+    };
+  }
+  const decision = decisionRaw ?? "allow";
+  if (decision !== "allow" && decision !== "deny") {
+    return {
+      ok: false,
+      error: `--decision must be "allow" or "deny" (got "${decision}").`,
+    };
+  }
+
+  if (args.length >= 2) {
+    return { ok: false, error: "unexpected extra arguments." };
+  }
+
+  return {
+    ok: true,
+    value: { assistantId: args[0], requestId, decision, jsonOutput },
+  };
+}
+
+function exitWithUsage(error: string): never {
+  console.error(`Error: ${error}`);
+  console.error("");
+  printUsage();
+  process.exit(1);
+}
+
+export async function confirm(): Promise<void> {
+  const rawArgs = process.argv.slice(3);
+
+  if (rawArgs.includes("--help") || rawArgs.includes("-h")) {
+    printUsage();
+    return;
+  }
+
+  const parsed = parseConfirmArgs(rawArgs);
+  if (!parsed.ok) {
+    exitWithUsage(parsed.error);
+  }
+
+  const { assistantId, requestId, decision, jsonOutput } = parsed.value;
+
+  const client = new AssistantClient({ assistantId });
+
+  const response = await client.post("/confirm", { requestId, decision });
+
+  if (!response.ok) {
+    const body = await response.text().catch(() => "");
+    console.error(
+      `Error: HTTP ${response.status}: ${body || response.statusText}`,
+    );
+    process.exit(1);
+  }
+
+  const result = (await response.json()) as { accepted: boolean };
+
+  if (jsonOutput) {
+    console.log(JSON.stringify(result, null, 2));
+  } else {
+    console.log(
+      result.accepted
+        ? `Confirmation resolved (${decision})`
+        : `Confirmation not accepted`,
+    );
+  }
+}

package/src/commands/hatch.ts

@@ -181,6 +181,7 @@ interface HatchArgs {
   configValues: Record<string, string>;
   flagEnvVars: Record<string, string>;
   analyze: boolean;
+  disablePlatform: boolean;
 }
 
 function parseArgs(): HatchArgs {
@@ -188,6 +189,8 @@ function parseArgs(): HatchArgs {
     process.argv.slice(3),
   );
   const flagEnvVars = { ...readAmbientFlagEnvVars(), ...cliFlagVars };
+  const disablePlatformAmbient = process.env.VELLUM_DISABLE_PLATFORM?.trim().toLowerCase();
+  let disablePlatform = disablePlatformAmbient === "true" || disablePlatformAmbient === "1";
   let species: Species = DEFAULT_SPECIES;
   let detached = false;
   let keepAlive = false;
@@ -233,6 +236,9 @@ function parseArgs(): HatchArgs {
       console.log(
         "  --analyze                 Emit a structured hatch-timing log line on stdout",
       );
+      console.log(
+        "  --disable-platform        Suppress all outbound platform API calls",
+      );
       process.exit(0);
     } else if (arg === "-d") {
       detached = true;
@@ -293,11 +299,13 @@ function parseArgs(): HatchArgs {
       const value = next.slice(eqIndex + 1);
       configValues[key] = value;
       i++;
+    } else if (arg === "--disable-platform") {
+      disablePlatform = true;
     } else if (VALID_SPECIES.includes(arg as Species)) {
       species = arg as Species;
     } else {
       console.error(
-        `Error: Unknown argument '${arg}'. Valid options: ${VALID_SPECIES.join(", ")}, -d, --watch, --source <path>, --keep-alive, --name <name>, --remote <${VALID_REMOTE_HOSTS.join("|")}>, --config <key=value>, --flag <key=value>, --analyze`,
+        `Error: Unknown argument '${arg}'. Valid options: ${VALID_SPECIES.join(", ")}, -d, --watch, --source <path>, --keep-alive, --name <name>, --remote <${VALID_REMOTE_HOSTS.join("|")}>, --config <key=value>, --flag <key=value>, --analyze, --disable-platform`,
       );
       process.exit(1);
     }
@@ -314,6 +322,7 @@ function parseArgs(): HatchArgs {
     configValues,
     flagEnvVars,
     analyze,
+    disablePlatform,
   };
 }
 
@@ -549,8 +558,14 @@ export async function hatch(): Promise<void> {
     configValues,
     flagEnvVars,
     analyze,
+    disablePlatform,
   } = parseArgs();
 
+  if (disablePlatform) {
+    process.env.VELLUM_DISABLE_PLATFORM = "true";
+    flagEnvVars.VELLUM_DISABLE_PLATFORM = "true";
+  }
+
   if (watch && remote !== "local" && remote !== "docker") {
     console.error(
       "Error: --watch is only supported for local and docker hatch targets.",

package/src/index.ts

@@ -4,6 +4,7 @@ import cliPkg from "../package.json";
 import { backup } from "./commands/backup";
 import { clean } from "./commands/clean";
 import { client } from "./commands/client";
+import { confirm } from "./commands/confirm";
 import { connect } from "./commands/connect";
 import { devices } from "./commands/devices";
 import { env } from "./commands/env";
@@ -40,6 +41,7 @@ const commands = {
   backup,
   clean,
   client,
+  confirm,
   connect,
   devices,
   env,
@@ -81,6 +83,7 @@ function printHelp(): void {
   console.log("  backup   Export a backup of a running assistant");
   console.log("  clean    Kill orphaned vellum processes");
   console.log("  client   Connect to a hatched assistant");
+  console.log("  confirm  Resolve a pending tool confirmation on an assistant");
   console.log("  connect  Import an assistant paired from another machine");
   console.log("  devices  List or revoke devices paired to a local assistant");
   console.log("  env      Manage the default CLI environment");

package/src/lib/docker.ts

@@ -1323,6 +1323,10 @@ export async function hatchDocker(
       : ownSecret;
 
     emitProgress(4, 6, "Starting containers...");
+    if (flagEnvVars.VELLUM_DISABLE_PLATFORM) {
+      extraAssistantEnv.VELLUM_DISABLE_PLATFORM =
+        flagEnvVars.VELLUM_DISABLE_PLATFORM;
+    }
     const extraGatewayEnv =
       Object.keys(flagEnvVars).length > 0 ? flagEnvVars : undefined;
     await startContainers(

package/src/lib/local.ts

@@ -961,6 +961,7 @@ export async function startLocalDaemon(
         "VELLUM_DEBUG",
         "VELLUM_DEV",
         "VELLUM_DESKTOP_APP",
+        "VELLUM_DISABLE_PLATFORM",
         "VELLUM_WORKSPACE_DIR",
       ]) {
         if (process.env[key]) {