launch_modes

Refuse vLLM launch modes that would bypass Output Protection (OP).

Output Protection lives in the process that builds vLLM's OpenAI-compatible FastAPI application:

- `UserPublicKeyMiddleware` performs the key exchange per request.
- `EncryptedRequestOutput` encrypts each token as it is produced.

Two of vllm serve's dispatch branches never build the FastAPI application, and would therefore skip OP entirely:

- `--grpc` dispatches to `vllm.entrypoints.grpc_server.serve_grpc`, which serves gRPC.
- `VLLM_USE_RUST_FRONTEND=1` replaces the Python API server with the Rust frontend process.

Both are refused at OP startup. A server that silently stops encrypting is worse than a server that does not start.

Warning

Under almost no circumstances should you need to import this module directly. If stainedglass_output_protection is installed, vLLM loads it automatically via the vllm.general_plugins entry point.

Functions:

Name	Description
assert_supported_launch_mode	Reject the launch modes that would serve unencrypted model output.
patch_serve_subcommand	Patch vLLM's serve subcommand so OP unsupported launch modes fail before the engine starts.

assert_supported_launch_mode

assert_supported_launch_mode(cli_args: Namespace) -> None

Reject the launch modes that would serve unencrypted model output.

Parameters:

Name	Type	Description	Default
cli_args	Namespace	The parsed vllm serve command-line arguments.	required

Raises:

Type	Description
RuntimeError	If --grpc was requested.
RuntimeError	If the vLLM Rust frontend is enabled.

patch_serve_subcommand

patch_serve_subcommand() -> None

Patch vLLM's serve subcommand so OP unsupported launch modes fail before the engine starts.