@defai.digital/automatosx 8.3.0 → 8.3.2

package/dist/index.js

@@ -8,6 +8,7 @@ import { realpathSync as realpathSync$1, access, realpath, existsSync, readFileS
 import os2, { homedir, cpus } from 'os';
 import { findUp } from 'find-up';
 import { exec, spawn, execSync, spawnSync } from 'child_process';
+import { z } from 'zod';
 import { promisify } from 'util';
 import yargs from 'yargs';
 import { hideBin } from 'yargs/helpers';
@@ -1031,22 +1032,207 @@ var init_path_resolver = __esm({
     };
   }
 });
-
-// src/providers/base-provider.ts
-var BaseProvider;
+function findOnPath(cmdBase) {
+  const isWindows2 = process.platform === "win32";
+  if (isWindows2) {
+    return findOnPathWindows(cmdBase);
+  }
+  return findOnPathUnix(cmdBase);
+}
+function findOnPathWindows(cmdBase) {
+  try {
+    const where = spawnSync("where", [cmdBase], {
+      windowsHide: true,
+      timeout: 3e3
+    });
+    if (where.status === 0) {
+      const lines = where.stdout.toString().split(/\r?\n/).map((s) => s.trim()).filter(Boolean);
+      const firstPath = lines[0];
+      if (firstPath) {
+        logger.debug("Found via where.exe", { cmdBase, path: firstPath });
+        return { found: true, path: firstPath };
+      }
+    }
+  } catch (error) {
+    logger.debug("where.exe failed, falling back to PATH scan", { error });
+  }
+  const pathext = (process.env.PATHEXT || ".EXE;.CMD;.BAT;.COM").toUpperCase().split(";").filter(Boolean);
+  const pathEntries = (process.env.PATH || "").split(delimiter).filter(Boolean);
+  for (const dir of pathEntries) {
+    for (const ext2 of pathext) {
+      const fullPath = `${dir}\\${cmdBase}${ext2}`;
+      if (existsSync(fullPath)) {
+        logger.debug("Found via PATH \xD7 PATHEXT", { cmdBase, path: fullPath });
+        return { found: true, path: fullPath };
+      }
+    }
+    const pathWithoutExt = `${dir}\\${cmdBase}`;
+    if (existsSync(pathWithoutExt)) {
+      logger.debug("Found via PATH (no ext)", { cmdBase, path: pathWithoutExt });
+      return { found: true, path: pathWithoutExt };
+    }
+  }
+  return { found: false };
+}
+function findOnPathUnix(cmdBase) {
+  try {
+    const which = spawnSync("which", [cmdBase], { timeout: 3e3 });
+    if (which.status === 0) {
+      const path6 = which.stdout.toString().trim();
+      if (path6) {
+        logger.debug("Found via which", { cmdBase, path: path6 });
+        return { found: true, path: path6 };
+      }
+    }
+  } catch (error) {
+    logger.debug("which failed", { cmdBase, error });
+  }
+  return { found: false };
+}
+var init_cli_provider_detector = __esm({
+  "src/core/cli-provider-detector.ts"() {
+    init_esm_shims();
+    init_logger();
+  }
+});
+function safeValidateExecutionRequest(request) {
+  return executionRequestSchema.safeParse(request);
+}
+function safeValidateExecutionResponse(response) {
+  return executionResponseSchema.safeParse(response);
+}
+var executionRequestSchema, tokenUsageSchema, finishReasonSchema, executionResponseSchema, costBreakdownSchema, providerErrorTypeSchema;
+var init_provider_schemas = __esm({
+  "src/providers/provider-schemas.ts"() {
+    init_esm_shims();
+    executionRequestSchema = z.object({
+      prompt: z.string().min(1, "Prompt cannot be empty"),
+      systemPrompt: z.string().optional(),
+      model: z.string().optional(),
+      maxTokens: z.number().int().positive().optional(),
+      temperature: z.number().min(0).max(2).optional(),
+      topP: z.number().min(0).max(1).optional(),
+      topK: z.number().int().positive().optional(),
+      stopSequences: z.array(z.string()).optional(),
+      stream: z.boolean().optional(),
+      metadata: z.record(z.string(), z.any()).optional()
+    }).describe("Provider execution request");
+    tokenUsageSchema = z.object({
+      prompt: z.number().int().nonnegative(),
+      completion: z.number().int().nonnegative(),
+      total: z.number().int().nonnegative()
+    }).refine(
+      (data) => data.total === data.prompt + data.completion,
+      "Total tokens must equal prompt + completion"
+    ).describe("Token usage information");
+    finishReasonSchema = z.enum([
+      "stop",
+      // Natural completion
+      "length",
+      // Max tokens reached
+      "content_filter",
+      // Content filtered
+      "tool_calls",
+      // Function/tool called
+      "error"
+      // Error occurred
+    ]).describe("Response finish reason");
+    executionResponseSchema = z.object({
+      content: z.string(),
+      model: z.string(),
+      tokensUsed: tokenUsageSchema,
+      latencyMs: z.number().nonnegative(),
+      finishReason: finishReasonSchema,
+      cached: z.boolean().default(false),
+      metadata: z.record(z.string(), z.any()).optional()
+    }).describe("Provider execution response");
+    z.object({
+      available: z.boolean(),
+      latencyMs: z.number().nonnegative(),
+      errorRate: z.number().min(0).max(1),
+      consecutiveFailures: z.number().int().nonnegative(),
+      lastCheckTime: z.number().int().nonnegative().optional()
+    }).describe("Provider health status");
+    z.object({
+      supportsStreaming: z.boolean().default(false),
+      supportsEmbedding: z.boolean().default(false),
+      supportsVision: z.boolean().default(false),
+      supportsFunctionCalling: z.boolean().default(false),
+      maxContextTokens: z.number().int().positive(),
+      supportedModels: z.array(z.string()).min(1)
+    }).describe("Provider capabilities");
+    z.object({
+      hasCapacity: z.boolean(),
+      requestsRemaining: z.number().int().nonnegative(),
+      tokensRemaining: z.number().int().nonnegative(),
+      resetAtMs: z.number().int().positive()
+    }).describe("Rate limit status");
+    costBreakdownSchema = z.object({
+      prompt: z.number().nonnegative(),
+      completion: z.number().nonnegative(),
+      embedding: z.number().nonnegative().optional(),
+      other: z.number().nonnegative().optional()
+    }).describe("Cost breakdown");
+    z.object({
+      amount: z.number().nonnegative(),
+      currency: z.string().length(3).default("USD"),
+      breakdown: costBreakdownSchema
+    }).describe("Cost estimate");
+    z.object({
+      totalRequests: z.number().int().nonnegative(),
+      totalTokens: z.number().int().nonnegative(),
+      totalCost: z.number().nonnegative(),
+      successRate: z.number().min(0).max(1),
+      averageLatencyMs: z.number().nonnegative().optional(),
+      lastRequestTime: z.number().int().nonnegative().optional()
+    }).describe("Provider usage statistics");
+    providerErrorTypeSchema = z.enum([
+      "not_found",
+      "timeout",
+      "rate_limit",
+      "auth_error",
+      "invalid_request",
+      "api_error",
+      "network_error",
+      "config_error",
+      "exec_error",
+      "unknown"
+    ]).describe("Provider error type");
+    z.object({
+      type: providerErrorTypeSchema,
+      message: z.string(),
+      code: z.string().optional(),
+      retryable: z.boolean().default(false),
+      details: z.record(z.string(), z.any()).optional()
+    }).describe("Provider error");
+  }
+});
+var execAsync, BaseProvider;
 var init_base_provider = __esm({
   "src/providers/base-provider.ts"() {
     init_esm_shims();
     init_logger();
     init_errors();
+    init_cli_provider_detector();
+    init_provider_schemas();
+    execAsync = promisify(exec);
     BaseProvider = class _BaseProvider {
       /**
        * Whitelist of allowed provider names for security
+       * v8.3.0: Support both old (claude-code, gemini-cli) and new (claude, gemini) names for backward compatibility
+       * v8.3.1: Added 'grok' for Grok CLI integration
        */
       static ALLOWED_PROVIDER_NAMES = [
         "claude",
+        "claude-code",
+        // Backward compatibility - maps to claude CLI
         "gemini",
+        "gemini-cli",
+        // Backward compatibility - maps to gemini CLI
+        "openai",
         "codex",
+        "grok",
+        // Grok CLI (Z.AI GLM 4.6 or X.AI Grok)
         "test-provider"
         // For unit tests
       ];
@@ -1060,7 +1246,7 @@ var init_base_provider = __esm({
             "E1001" /* CONFIG_INVALID */
           );
         }
-        this.config = config;
+        this.config = { ...config, name: providerName };
         this.health = {
           available: false,
           latencyMs: 0,
@@ -1069,6 +1255,78 @@ var init_base_provider = __esm({
           lastCheck: Date.now()
         };
       }
+      /**
+       * Execute CLI command - Template method pattern
+       * Common logic here, provider-specific parts via getCLICommand() and getMockResponse()
+       */
+      async executeCLI(prompt) {
+        if (process.env.AUTOMATOSX_MOCK_PROVIDERS === "true") {
+          logger.debug("Mock mode: returning test response");
+          return this.getMockResponse();
+        }
+        try {
+          const escapedPrompt = this.escapeShellArg(prompt);
+          const cliCommand = this.getCLICommand();
+          logger.debug(`Executing ${cliCommand} CLI`, {
+            command: cliCommand,
+            promptLength: prompt.length
+          });
+          const { stdout, stderr } = await execAsync(
+            `${cliCommand} ${escapedPrompt}`,
+            {
+              timeout: this.config.timeout || 12e4,
+              maxBuffer: 10 * 1024 * 1024,
+              shell: "/bin/bash",
+              // Enable shell to support complex commands
+              env: {
+                ...process.env,
+                // Force non-interactive mode for CLIs
+                TERM: "dumb",
+                NO_COLOR: "1",
+                // Disable TTY checks for codex and other CLIs
+                FORCE_COLOR: "0",
+                CI: "true",
+                // Many CLIs disable TTY checks in CI mode
+                NO_UPDATE_NOTIFIER: "1",
+                // Disable interactive prompts
+                DEBIAN_FRONTEND: "noninteractive"
+              }
+            }
+          );
+          if (stderr) {
+            logger.warn(`${cliCommand} CLI stderr output`, { stderr: stderr.trim() });
+          }
+          if (!stdout) {
+            throw new Error(`${cliCommand} CLI returned empty output. stderr: ${stderr || "none"}`);
+          }
+          logger.debug(`${cliCommand} CLI execution successful`, {
+            responseLength: stdout.trim().length
+          });
+          return stdout.trim();
+        } catch (error) {
+          logger.error(`${this.getCLICommand()} CLI execution failed`, { error });
+          throw this.handleError(error);
+        }
+      }
+      /**
+       * Check if CLI is available - Template method pattern
+       * Uses getCLICommand() to determine which CLI to check
+       */
+      async checkCLIAvailable() {
+        try {
+          const cliCommand = this.getCLICommand();
+          const path6 = await findOnPath(cliCommand);
+          const available = path6 !== null;
+          logger.debug(`${cliCommand} CLI availability check`, {
+            available,
+            path: path6 || "not found"
+          });
+          return available;
+        } catch (error) {
+          logger.debug(`${this.getCLICommand()} CLI availability check failed`, { error });
+          return false;
+        }
+      }
       /**
        * Get provider name
        */
@@ -1081,6 +1339,16 @@ var init_base_provider = __esm({
       async execute(request) {
         const startTime = Date.now();
         try {
+          const requestValidation = safeValidateExecutionRequest(request);
+          if (!requestValidation.success) {
+            const validationErrors = requestValidation.error.issues.map(
+              (e) => `${e.path.join(".")}: ${e.message}`
+            ).join("; ");
+            throw new ProviderError(
+              `Invalid execution request: ${validationErrors}`,
+              "E1305" /* PROVIDER_EXEC_ERROR */
+            );
+          }
           logger.debug(`Executing request with ${this.config.name}`, {
             prompt: request.prompt.substring(0, 100) + "..."
           });
@@ -1093,7 +1361,7 @@ ${request.prompt}`;
           const result = await this.executeCLI(fullPrompt);
           this.health.consecutiveFailures = 0;
           this.health.available = true;
-          return {
+          const response = {
             content: result,
             model: "default",
             // v8.3.0: CLI determines model
@@ -1107,6 +1375,14 @@ ${request.prompt}`;
             finishReason: "stop",
             cached: false
           };
+          const responseValidation = safeValidateExecutionResponse(response);
+          if (!responseValidation.success) {
+            logger.error("Invalid execution response generated", {
+              errors: responseValidation.error.issues,
+              response
+            });
+          }
+          return response;
         } catch (error) {
           this.health.consecutiveFailures++;
           this.health.available = false;
@@ -1164,9 +1440,15 @@ ${request.prompt}`;
       }
       /**
        * Escape shell command arguments to prevent injection
+       *
+       * v8.3.0 Security Fix: Use POSIX shell single-quote escaping
+       * Wraps argument in single quotes and escapes any existing single quotes
+       * This prevents command injection by ensuring the entire string is treated as a literal.
+       *
+       * Example: hello'world becomes 'hello'\''world'
        */
       escapeShellArg(arg) {
-        return arg.replace(/["'\\]/g, "\\$&");
+        return "'" + arg.replace(/'/g, "'\\''") + "'";
       }
       // v8.3.0: Stub implementations for backward compatibility with Provider interface
       // These will be removed when we update the interface in Phase 4
@@ -1267,128 +1549,28 @@ ${request.prompt}`;
     };
   }
 });
-function findOnPath(cmdBase) {
-  const isWindows2 = process.platform === "win32";
-  if (isWindows2) {
-    return findOnPathWindows(cmdBase);
-  }
-  return findOnPathUnix(cmdBase);
-}
-function findOnPathWindows(cmdBase) {
-  try {
-    const where = spawnSync("where", [cmdBase], {
-      windowsHide: true,
-      timeout: 3e3
-    });
-    if (where.status === 0) {
-      const lines = where.stdout.toString().split(/\r?\n/).map((s) => s.trim()).filter(Boolean);
-      const firstPath = lines[0];
-      if (firstPath) {
-        logger.debug("Found via where.exe", { cmdBase, path: firstPath });
-        return { found: true, path: firstPath };
-      }
-    }
-  } catch (error) {
-    logger.debug("where.exe failed, falling back to PATH scan", { error });
-  }
-  const pathext = (process.env.PATHEXT || ".EXE;.CMD;.BAT;.COM").toUpperCase().split(";").filter(Boolean);
-  const pathEntries = (process.env.PATH || "").split(delimiter).filter(Boolean);
-  for (const dir of pathEntries) {
-    for (const ext2 of pathext) {
-      const fullPath = `${dir}\\${cmdBase}${ext2}`;
-      if (existsSync(fullPath)) {
-        logger.debug("Found via PATH \xD7 PATHEXT", { cmdBase, path: fullPath });
-        return { found: true, path: fullPath };
-      }
-    }
-    const pathWithoutExt = `${dir}\\${cmdBase}`;
-    if (existsSync(pathWithoutExt)) {
-      logger.debug("Found via PATH (no ext)", { cmdBase, path: pathWithoutExt });
-      return { found: true, path: pathWithoutExt };
-    }
-  }
-  return { found: false };
-}
-function findOnPathUnix(cmdBase) {
-  try {
-    const which = spawnSync("which", [cmdBase], { timeout: 3e3 });
-    if (which.status === 0) {
-      const path6 = which.stdout.toString().trim();
-      if (path6) {
-        logger.debug("Found via which", { cmdBase, path: path6 });
-        return { found: true, path: path6 };
-      }
-    }
-  } catch (error) {
-    logger.debug("which failed", { cmdBase, error });
-  }
-  return { found: false };
-}
-var init_cli_provider_detector = __esm({
-  "src/core/cli-provider-detector.ts"() {
-    init_esm_shims();
-    init_logger();
-  }
-});
 
 // src/providers/claude-provider.ts
 var claude_provider_exports = {};
 __export(claude_provider_exports, {
   ClaudeProvider: () => ClaudeProvider
 });
-var execAsync, ClaudeProvider;
+var ClaudeProvider;
 var init_claude_provider = __esm({
   "src/providers/claude-provider.ts"() {
     init_esm_shims();
     init_base_provider();
-    init_logger();
-    init_cli_provider_detector();
-    execAsync = promisify(exec);
     ClaudeProvider = class extends BaseProvider {
       constructor(config) {
         super(config);
       }
-      /**
-       * Execute CLI command: claude "<prompt>"
-       */
-      async executeCLI(prompt) {
-        if (process.env.AUTOMATOSX_MOCK_PROVIDERS === "true") {
-          return `[Mock Claude Response]
-
-${prompt.substring(0, 100)}...
-
-Mock response.`;
-        }
-        try {
-          const escapedPrompt = this.escapeShellArg(prompt);
-          const { stdout, stderr } = await execAsync(
-            `claude "${escapedPrompt}"`,
-            {
-              timeout: this.config.timeout || 12e4,
-              // 2 min default
-              maxBuffer: 10 * 1024 * 1024
-              // 10MB
-            }
-          );
-          if (stderr && !stdout) {
-            throw new Error(`Claude CLI error: ${stderr}`);
-          }
-          return stdout.trim();
-        } catch (error) {
-          logger.error("Claude CLI execution failed", { error });
-          throw this.handleError(error);
-        }
+      getCLICommand() {
+        return "claude";
       }
-      /**
-       * Check if claude CLI is available
-       */
-      async checkCLIAvailable() {
-        try {
-          const path6 = await findOnPath("claude");
-          return path6 !== null;
-        } catch {
-          return false;
-        }
+      getMockResponse() {
+        return `[Mock Claude Response]
+
+This is a mock response for testing purposes.`;
       }
     };
   }
@@ -1399,134 +1581,44 @@ var gemini_provider_exports = {};
 __export(gemini_provider_exports, {
   GeminiProvider: () => GeminiProvider
 });
-var execAsync2, GeminiProvider;
+var GeminiProvider;
 var init_gemini_provider = __esm({
   "src/providers/gemini-provider.ts"() {
     init_esm_shims();
     init_base_provider();
-    init_logger();
-    init_cli_provider_detector();
-    execAsync2 = promisify(exec);
     GeminiProvider = class extends BaseProvider {
       constructor(config) {
         super(config);
       }
-      /**
-       * Execute: gemini "prompt"
-       */
-      async executeCLI(prompt) {
-        if (process.env.AUTOMATOSX_MOCK_PROVIDERS === "true") {
-          logger.debug("Using mock Gemini provider");
-          return `[Mock Gemini Response]
-
-Received: ${prompt.substring(0, 100)}...
-
-This is a mock response.`;
-        }
-        try {
-          const escapedPrompt = this.escapeShellArg(prompt);
-          logger.debug("Executing Gemini CLI", {
-            command: "gemini",
-            promptLength: prompt.length
-          });
-          const { stdout, stderr } = await execAsync2(
-            `gemini "${escapedPrompt}"`,
-            {
-              timeout: this.config.timeout || 12e4,
-              // 2 min default
-              maxBuffer: 10 * 1024 * 1024,
-              // 10MB buffer
-              env: { ...process.env }
-            }
-          );
-          if (stderr && !stdout) {
-            throw new Error(`Gemini CLI error: ${stderr}`);
-          }
-          const result = stdout.trim();
-          logger.debug("Gemini CLI execution successful", {
-            responseLength: result.length
-          });
-          return result;
-        } catch (error) {
-          logger.error("Gemini CLI execution failed", {
-            error: error instanceof Error ? error.message : String(error)
-          });
-          throw this.handleError(error);
-        }
+      getCLICommand() {
+        return "gemini";
       }
-      /**
-       * Check if gemini CLI is available on PATH
-       */
-      async checkCLIAvailable() {
-        try {
-          const path6 = await findOnPath("gemini");
-          const available = path6 !== null;
-          logger.debug("Gemini CLI availability check", {
-            available,
-            path: path6 || "not found"
-          });
-          return available;
-        } catch (error) {
-          logger.debug("Gemini CLI availability check failed", { error });
-          return false;
-        }
+      getMockResponse() {
+        return `[Mock Gemini Response]
+
+This is a mock response for testing purposes.`;
       }
     };
   }
 });
-var execAsync3, OpenAIProvider;
+
+// src/providers/openai-provider.ts
+var OpenAIProvider;
 var init_openai_provider = __esm({
   "src/providers/openai-provider.ts"() {
     init_esm_shims();
     init_base_provider();
-    init_logger();
-    init_cli_provider_detector();
-    execAsync3 = promisify(exec);
     OpenAIProvider = class extends BaseProvider {
       constructor(config) {
         super(config);
       }
-      /**
-       * Execute CLI command: codex "<prompt>"
-       */
-      async executeCLI(prompt) {
-        if (process.env.AUTOMATOSX_MOCK_PROVIDERS === "true") {
-          return `[Mock OpenAI/Codex Response]
-
-${prompt.substring(0, 100)}...
-
-Mock response.`;
-        }
-        try {
-          const escapedPrompt = this.escapeShellArg(prompt);
-          const { stdout, stderr } = await execAsync3(
-            `codex "${escapedPrompt}"`,
-            {
-              timeout: this.config.timeout || 12e4,
-              // 2 min default
-              maxBuffer: 10 * 1024 * 1024
-              // 10MB
-            }
-          );
-          if (stderr && !stdout) {
-            throw new Error(`Codex CLI error: ${stderr}`);
-          }
-          return stdout.trim();
-        } catch (error) {
-          logger.error("Codex CLI execution failed", { error });
-          throw this.handleError(error);
-        }
+      getCLICommand() {
+        return "codex";
       }
-      /**
-       * Check if codex CLI is available
-       */
-      async checkCLIAvailable() {
-        try {
-          const path6 = await findOnPath("codex");
-          return path6 !== null;
-        } catch {
-          return false;
-        }
+      getMockResponse() {
+        return `[Mock OpenAI/Codex Response]
+
+This is a mock response for testing purposes.`;
       }
     };
   }
@@ -2498,6 +2590,25 @@ var DEFAULT_CONFIG = {
       limitTracking: GLOBAL_PROVIDER_DEFAULTS.limitTracking
       // OpenAI: daily limits
       // v5.0.5: Removed defaults - let provider CLI use optimal defaults
+    },
+    "grok": {
+      enabled: true,
+      priority: 4,
+      timeout: 27e5,
+      // 45 minutes
+      command: "grok",
+      healthCheck: {
+        enabled: true,
+        interval: 3e5,
+        // 5 minutes
+        timeout: 5e3
+      },
+      // v8.3.2: Grok provider defaults
+      circuitBreaker: GLOBAL_PROVIDER_DEFAULTS.circuitBreaker,
+      processManagement: GLOBAL_PROVIDER_DEFAULTS.processManagement,
+      versionDetection: GLOBAL_PROVIDER_DEFAULTS.versionDetection,
+      limitTracking: GLOBAL_PROVIDER_DEFAULTS.limitTracking
+      // Grok: daily limits
     }
   },
   execution: {
@@ -3332,6 +3443,36 @@ var PRECOMPILED_CONFIG = {
         "window": "daily",
         "resetHourUtc": 0
       }
+    },
+    "grok": {
+      "enabled": true,
+      "priority": 4,
+      "timeout": 27e5,
+      "command": "grok",
+      "healthCheck": {
+        "enabled": true,
+        "interval": 3e5,
+        "timeout": 5e3
+      },
+      "circuitBreaker": {
+        "enabled": true,
+        "failureThreshold": 3,
+        "recoveryTimeout": 6e4
+      },
+      "processManagement": {
+        "gracefulShutdownTimeout": 5e3,
+        "forceKillDelay": 1e3
+      },
+      "versionDetection": {
+        "timeout": 5e3,
+        "forceKillDelay": 1e3,
+        "cacheEnabled": true
+      },
+      "limitTracking": {
+        "enabled": true,
+        "window": "daily",
+        "resetHourUtc": 0
+      }
     }
   },
   "execution": {
@@ -3538,11 +3679,311 @@ var PRECOMPILED_CONFIG = {
   },
   "router": {
     "healthCheckInterval": 6e4,
-    "providerCooldownMs": 3e4
+    "providerCooldownMs": 3e4,
+    "enableFreeTierPrioritization": true,
+    "enableWorkloadAwareRouting": true
   },
-  "version": "8.3.0"
+  "version": "8.3.1"
 };
 
+// src/core/config-schemas.ts
+init_esm_shims();
+z.enum([
+  "claude",
+  "claude-code",
+  "gemini",
+  "gemini-cli",
+  "openai",
+  "codex",
+  "grok",
+  "test-provider"
+]).describe("Provider name (whitelisted for security)");
+var commandSchema = z.string().min(1, "command is required").max(VALIDATION_LIMITS.MAX_COMMAND_LENGTH).regex(
+  /^[a-zA-Z0-9_-]+$/,
+  "Command must be alphanumeric with dash/underscore only (prevents command injection)"
+).describe("CLI command name");
+var safeNameSchema = z.string().min(1).max(VALIDATION_LIMITS.MAX_NAME_LENGTH).regex(
+  /^[a-zA-Z0-9_-]+$/,
+  "Name must be alphanumeric with dash/underscore only"
+).describe("Safe identifier name");
+var relativePathSchema = z.string().min(1).refine(
+  (path6) => !path6.includes("..") && !path6.startsWith("/"),
+  "Path must be relative (no ../, no absolute paths)"
+).describe("Relative path within project");
+var fileExtensionSchema = z.string().regex(
+  /^\.[a-zA-Z0-9]{1,10}$/,
+  "Extension must start with dot and be alphanumeric (max 10 chars)"
+).describe("File extension");
+var positiveIntSchema = z.number().int().positive("must be a positive integer").describe("Positive integer");
+var nonNegativeIntSchema = z.number().int().nonnegative().describe("Non-negative integer");
+var timeoutSchema = z.number().int().min(VALIDATION_LIMITS.MIN_TIMEOUT, `Timeout must be >= ${VALIDATION_LIMITS.MIN_TIMEOUT}ms`).max(VALIDATION_LIMITS.MAX_TIMEOUT, `Timeout must be <= ${VALIDATION_LIMITS.MAX_TIMEOUT}ms`).describe("Timeout in milliseconds");
+var intervalSchema = z.number().int().min(VALIDATION_LIMITS.MIN_INTERVAL, `Interval must be >= ${VALIDATION_LIMITS.MIN_INTERVAL}ms`).max(VALIDATION_LIMITS.MAX_TIMEOUT, `Interval must be <= ${VALIDATION_LIMITS.MAX_TIMEOUT}ms`).describe("Interval in milliseconds");
+var healthCheckConfigSchema = z.object({
+  enabled: z.boolean().default(true),
+  interval: intervalSchema,
+  timeout: timeoutSchema.min(100, "Health check timeout must be >= 100ms")
+}).describe("Health check configuration");
+var circuitBreakerConfigSchema = z.object({
+  enabled: z.boolean().default(true),
+  failureThreshold: z.number().int().min(1).max(10).default(3),
+  recoveryTimeout: timeoutSchema
+}).describe("Circuit breaker configuration");
+var processManagementConfigSchema = z.object({
+  gracefulShutdownTimeout: timeoutSchema,
+  forceKillDelay: positiveIntSchema
+}).describe("Process management configuration");
+var versionDetectionConfigSchema = z.object({
+  timeout: timeoutSchema,
+  forceKillDelay: positiveIntSchema,
+  cacheEnabled: z.boolean().default(true)
+}).describe("Version detection configuration");
+var limitTrackingConfigSchema = z.object({
+  enabled: z.boolean().default(true),
+  window: z.enum(["daily", "weekly", "custom"]).default("daily"),
+  resetHourUtc: z.number().int().min(0).max(23).default(0),
+  customResetMs: positiveIntSchema.optional()
+}).describe("Provider limit tracking configuration");
+var providerConfigSchema = z.object({
+  enabled: z.boolean().default(true),
+  priority: positiveIntSchema,
+  timeout: timeoutSchema,
+  command: commandSchema,
+  healthCheck: healthCheckConfigSchema.optional(),
+  circuitBreaker: circuitBreakerConfigSchema.optional(),
+  processManagement: processManagementConfigSchema.optional(),
+  versionDetection: versionDetectionConfigSchema.optional(),
+  limitTracking: limitTrackingConfigSchema.optional()
+}).describe("Provider configuration");
+var providersConfigSchema = z.record(
+  safeNameSchema,
+  providerConfigSchema
+).describe("Providers configuration map");
+var retryConfigSchema = z.object({
+  maxAttempts: z.number().int().min(1).max(10).default(3),
+  initialDelay: nonNegativeIntSchema.max(VALIDATION_LIMITS.MAX_TIMEOUT),
+  maxDelay: timeoutSchema,
+  backoffFactor: z.number().min(VALIDATION_LIMITS.MIN_BACKOFF_FACTOR).max(VALIDATION_LIMITS.MAX_BACKOFF_FACTOR).default(2),
+  retryableErrors: z.array(z.string()).max(VALIDATION_LIMITS.MAX_ARRAY_LENGTH).optional()
+}).refine(
+  (data) => data.maxDelay >= data.initialDelay,
+  "maxDelay must be >= initialDelay"
+).describe("Retry configuration");
+var providerExecutionConfigSchema = z.object({
+  maxWaitMs: timeoutSchema
+}).describe("Provider execution configuration");
+var concurrencyConfigSchema = z.object({
+  maxConcurrentAgents: z.number().int().min(1).max(VALIDATION_LIMITS.MAX_CONCURRENT_AGENTS).optional(),
+  autoDetect: z.boolean().default(false),
+  cpuMultiplier: z.number().min(0.1).max(10).default(1),
+  minConcurrency: positiveIntSchema.default(2),
+  maxConcurrency: positiveIntSchema.max(VALIDATION_LIMITS.MAX_CONCURRENT_AGENTS).default(16)
+}).describe("Concurrency configuration");
+var stagesConfigSchema = z.object({
+  enabled: z.boolean().default(true),
+  defaultTimeout: timeoutSchema.default(18e5),
+  checkpointPath: relativePathSchema.default(".automatosx/checkpoints"),
+  autoSaveCheckpoint: z.boolean().default(true),
+  cleanupAfterDays: positiveIntSchema.max(365).default(7),
+  retry: z.object({
+    defaultMaxRetries: nonNegativeIntSchema.default(1),
+    defaultRetryDelay: positiveIntSchema.default(2e3)
+  }).optional(),
+  prompts: z.object({
+    timeout: timeoutSchema.default(6e5),
+    autoConfirm: z.boolean().default(false),
+    locale: z.string().default("en")
+  }).optional(),
+  progress: z.object({
+    updateInterval: positiveIntSchema.default(2e3),
+    syntheticProgress: z.boolean().default(true)
+  }).optional()
+}).describe("Stages configuration");
+var executionConfigSchema = z.object({
+  defaultTimeout: timeoutSchema,
+  concurrency: concurrencyConfigSchema.optional(),
+  retry: retryConfigSchema,
+  provider: providerExecutionConfigSchema,
+  stages: stagesConfigSchema.optional()
+}).describe("Execution configuration");
+var sessionConfigSchema = z.object({
+  maxSessions: positiveIntSchema.max(VALIDATION_LIMITS.MAX_SESSIONS),
+  maxMetadataSize: positiveIntSchema.min(VALIDATION_LIMITS.MIN_BYTES).max(VALIDATION_LIMITS.MAX_FILE_SIZE),
+  saveDebounce: nonNegativeIntSchema.max(VALIDATION_LIMITS.MAX_TIMEOUT),
+  cleanupAfterDays: positiveIntSchema.max(365),
+  maxUuidAttempts: positiveIntSchema.max(1e3),
+  persistPath: relativePathSchema
+}).describe("Session configuration");
+var delegationConfigSchema = z.object({
+  maxDepth: positiveIntSchema.max(5, "Delegation depth limited to 5 to prevent deep chains"),
+  timeout: timeoutSchema,
+  enableCycleDetection: z.boolean().default(true)
+}).describe("Delegation configuration");
+var orchestrationConfigSchema = z.object({
+  session: sessionConfigSchema,
+  delegation: delegationConfigSchema
+}).describe("Orchestration configuration");
+var memorySearchConfigSchema = z.object({
+  defaultLimit: positiveIntSchema.max(1e3),
+  maxLimit: positiveIntSchema.max(1e4),
+  timeout: timeoutSchema.min(100)
+}).refine(
+  (data) => data.maxLimit >= data.defaultLimit,
+  "maxLimit must be >= defaultLimit"
+).describe("Memory search configuration");
+var memoryConfigSchema = z.object({
+  maxEntries: positiveIntSchema.max(VALIDATION_LIMITS.MAX_ENTRIES),
+  persistPath: relativePathSchema.default(".automatosx/memory"),
+  autoCleanup: z.boolean().default(true),
+  cleanupDays: positiveIntSchema.max(365).default(30),
+  busyTimeout: positiveIntSchema.default(5e3),
+  search: memorySearchConfigSchema.optional()
+}).describe("Memory configuration");
+var abilitiesCacheConfigSchema = z.object({
+  enabled: z.boolean().default(true),
+  maxEntries: positiveIntSchema.max(1e3),
+  ttl: intervalSchema.max(VALIDATION_LIMITS.MAX_TTL),
+  maxSize: positiveIntSchema.min(VALIDATION_LIMITS.MIN_BYTES).max(VALIDATION_LIMITS.MAX_CACHE_SIZE),
+  cleanupInterval: intervalSchema
+}).describe("Abilities cache configuration");
+var abilitiesLimitsConfigSchema = z.object({
+  maxFileSize: positiveIntSchema.min(VALIDATION_LIMITS.MIN_FILE_SIZE).max(VALIDATION_LIMITS.MAX_FILE_SIZE)
+}).describe("Abilities limits configuration");
+var abilitiesConfigSchema = z.object({
+  basePath: relativePathSchema,
+  fallbackPath: relativePathSchema,
+  cache: abilitiesCacheConfigSchema,
+  limits: abilitiesLimitsConfigSchema
+}).describe("Abilities configuration");
+var workspaceConfigSchema = z.object({
+  prdPath: z.string().min(1),
+  tmpPath: z.string().min(1),
+  autoCleanupTmp: z.boolean().default(true),
+  tmpCleanupDays: positiveIntSchema.max(365)
+}).describe("Workspace configuration");
+var loggingRetentionConfigSchema = z.object({
+  maxSizeBytes: positiveIntSchema.min(VALIDATION_LIMITS.MIN_BYTES).max(VALIDATION_LIMITS.MAX_FILE_SIZE * 10),
+  maxAgeDays: positiveIntSchema.max(365),
+  compress: z.boolean().default(true)
+}).describe("Logging retention configuration");
+var loggingConfigSchema = z.object({
+  level: z.enum(["debug", "info", "warn", "error"]).default("info"),
+  path: relativePathSchema,
+  console: z.boolean().default(true),
+  retention: loggingRetentionConfigSchema.optional()
+}).describe("Logging configuration");
+var cacheConfigSchema = z.object({
+  enabled: z.boolean().default(true),
+  maxEntries: positiveIntSchema.max(1e4),
+  ttl: intervalSchema.max(VALIDATION_LIMITS.MAX_TTL),
+  cleanupInterval: intervalSchema
+}).describe("Cache configuration");
+var adaptiveCacheConfigSchema = z.object({
+  maxEntries: positiveIntSchema.max(1e4),
+  baseTTL: intervalSchema,
+  minTTL: intervalSchema,
+  maxTTL: intervalSchema.max(VALIDATION_LIMITS.MAX_TTL),
+  adaptiveMultiplier: z.number().min(1).max(10),
+  lowFreqDivisor: z.number().min(1).max(10),
+  frequencyThreshold: positiveIntSchema,
+  cleanupInterval: intervalSchema
+}).refine(
+  (data) => data.maxTTL >= data.baseTTL && data.baseTTL >= data.minTTL,
+  "TTL order must be: minTTL <= baseTTL <= maxTTL"
+).describe("Adaptive cache configuration");
+var responseCacheConfigSchema = z.object({
+  enabled: z.boolean().default(false),
+  ttl: positiveIntSchema,
+  maxSize: positiveIntSchema,
+  maxMemorySize: positiveIntSchema,
+  dbPath: relativePathSchema
+}).describe("Response cache configuration");
+var rateLimitConfigSchema = z.object({
+  enabled: z.boolean().default(false),
+  requestsPerMinute: positiveIntSchema.max(1e3),
+  burstSize: positiveIntSchema.max(100)
+}).describe("Rate limit configuration");
+var performanceConfigSchema = z.object({
+  profileCache: cacheConfigSchema,
+  teamCache: cacheConfigSchema,
+  providerCache: cacheConfigSchema,
+  adaptiveCache: adaptiveCacheConfigSchema,
+  responseCache: responseCacheConfigSchema.optional(),
+  rateLimit: rateLimitConfigSchema.optional()
+}).describe("Performance configuration");
+var embeddingConfigSchema = z.object({
+  timeout: timeoutSchema,
+  retryDelay: positiveIntSchema,
+  dimensions: positiveIntSchema.max(1e4),
+  maxRetries: nonNegativeIntSchema.max(10)
+}).describe("Embedding configuration");
+var securityConfigSchema = z.object({
+  enablePathValidation: z.boolean().default(true),
+  allowedExtensions: z.array(fileExtensionSchema).max(VALIDATION_LIMITS.MAX_ARRAY_LENGTH).optional()
+}).describe("Security configuration");
+var developmentConfigSchema = z.object({
+  mockProviders: z.boolean().default(false),
+  profileMode: z.boolean().default(false)
+}).describe("Development configuration");
+var advancedConfigSchema = z.object({
+  embedding: embeddingConfigSchema.optional(),
+  security: securityConfigSchema.optional(),
+  development: developmentConfigSchema.optional()
+}).describe("Advanced configuration");
+var vscodeConfigSchema = z.object({
+  enabled: z.boolean().default(false),
+  apiPort: z.number().int().min(VALIDATION_LIMITS.MIN_PORT).max(VALIDATION_LIMITS.MAX_PORT),
+  autoStart: z.boolean().default(true),
+  outputPanel: z.boolean().default(true),
+  notifications: z.boolean().default(true)
+}).describe("VSCode integration configuration");
+var integrationConfigSchema = z.object({
+  vscode: vscodeConfigSchema.optional()
+}).describe("Integration configuration");
+var cliRunConfigSchema = z.object({
+  defaultMemory: z.boolean().default(true),
+  defaultSaveMemory: z.boolean().default(true),
+  defaultFormat: z.enum(["text", "json"]).default("text"),
+  defaultVerbose: z.boolean().default(false)
+}).describe("CLI run configuration");
+var cliSessionConfigSchema = z.object({
+  defaultShowAgents: z.boolean().default(true)
+}).describe("CLI session configuration");
+var cliMemoryConfigSchema = z.object({
+  defaultLimit: positiveIntSchema.default(10)
+}).describe("CLI memory configuration");
+var cliConfigSchema = z.object({
+  run: cliRunConfigSchema.optional(),
+  session: cliSessionConfigSchema.optional(),
+  memory: cliMemoryConfigSchema.optional()
+}).describe("CLI configuration");
+var routerConfigSchema = z.object({
+  healthCheckInterval: intervalSchema,
+  providerCooldownMs: positiveIntSchema,
+  circuitBreakerThreshold: positiveIntSchema.max(10).optional(),
+  // v8.3.2: Make optional to match interface
+  enableFreeTierPrioritization: z.boolean().default(true),
+  enableWorkloadAwareRouting: z.boolean().default(true)
+}).describe("Router configuration");
+var automatosXConfigSchema = z.object({
+  providers: providersConfigSchema.optional(),
+  execution: executionConfigSchema.optional(),
+  orchestration: orchestrationConfigSchema.optional(),
+  memory: memoryConfigSchema.optional(),
+  abilities: abilitiesConfigSchema.optional(),
+  workspace: workspaceConfigSchema.optional(),
+  logging: loggingConfigSchema.optional(),
+  performance: performanceConfigSchema.optional(),
+  advanced: advancedConfigSchema.optional(),
+  integration: integrationConfigSchema.optional(),
+  cli: cliConfigSchema.optional(),
+  router: routerConfigSchema.optional(),
+  version: z.string().regex(/^\d+\.\d+\.\d+$/, "Version must be semver format (x.y.z)").optional()
+}).describe("AutomatosX configuration");
+function safeValidateConfig(config) {
+  return automatosXConfigSchema.safeParse(config);
+}
+automatosXConfigSchema.partial().passthrough();
+
 // src/core/config.ts
 var configCache = new TTLCache({
   ttl: 6e4,
@@ -3667,7 +4108,21 @@ async function loadConfigFile(path6) {
 function mergeConfig(defaults2, user) {
   return deepMerge(defaults2, user);
 }
+function validateConfigWithZod(config) {
+  const result = safeValidateConfig(config);
+  if (result.success) {
+    return [];
+  }
+  return result.error.issues.map((err) => {
+    const path6 = err.path.join(".");
+    return `${path6}: ${err.message}`;
+  });
+}
 function validateConfig(config) {
+  const zodErrors = validateConfigWithZod(config);
+  if (zodErrors.length > 0) {
+    return zodErrors;
+  }
   const errors = [];
   for (const [name, provider] of Object.entries(config.providers)) {
     if (!isValidName(name)) {
@@ -5211,6 +5666,17 @@ var setupCommand = {
       console.log(chalk5.cyan("\u{1F4D6} Setting up GEMINI.md with AutomatosX integration..."));
       await setupProjectGeminiMd(projectDir, packageRoot, argv.force ?? false);
       console.log(chalk5.green("   \u2713 GEMINI.md configured"));
+      console.log(chalk5.cyan("\u{1F50C} Setting up Grok CLI integration..."));
+      const grokDir = join(projectDir, ".grok");
+      const grokDirExistedBefore = await checkExists2(grokDir);
+      await setupGrokIntegration(projectDir, packageRoot);
+      if (!grokDirExistedBefore) {
+        createdResources.push(grokDir);
+      }
+      console.log(chalk5.green("   \u2713 Grok CLI integration configured"));
+      console.log(chalk5.cyan("\u{1F4D6} Setting up GROK.md with AutomatosX integration..."));
+      await setupProjectGrokMd(projectDir, packageRoot, argv.force ?? false);
+      console.log(chalk5.green("   \u2713 GROK.md configured"));
       console.log(chalk5.cyan("\u{1F4D6} Setting up AGENTS.md with AutomatosX integration..."));
       await setupProjectAgentsMd(projectDir, packageRoot, argv.force ?? false);
       console.log(chalk5.green("   \u2713 AGENTS.md configured"));
@@ -5273,6 +5739,11 @@ var setupCommand = {
       console.log(chalk5.gray("  \u2022 Use natural language to work with ax agents"));
       console.log(chalk5.gray('  \u2022 Example: "Use ax agent backend to create a REST API"'));
       console.log(chalk5.gray("  \u2022 No special commands needed - just ask naturally!\n"));
+      console.log(chalk5.cyan("Grok CLI Integration:"));
+      console.log(chalk5.gray("  \u2022 Configure .grok/settings.json with your API key"));
+      console.log(chalk5.gray("  \u2022 Supports X.AI (grok-3-fast) and Z.AI (glm-4.6)"));
+      console.log(chalk5.gray('  \u2022 Enable in automatosx.config.json: "grok": { "enabled": true }'));
+      console.log(chalk5.gray("  \u2022 See GROK.md for setup instructions\n"));
       console.log(chalk5.cyan("OpenAI Codex Provider:"));
       console.log(chalk5.gray("  \u2022 Use natural language to work with ax agents"));
       console.log(chalk5.gray('  \u2022 Or use terminal: ax run <agent> "task"'));
@@ -5829,6 +6300,104 @@ async function setupProjectGeminiMd(projectDir, packageRoot, force) {
     });
   }
 }
+async function setupGrokIntegration(projectDir, packageRoot) {
+  const examplesBaseDir = join(packageRoot, "examples/grok");
+  const templatesDir = join(packageRoot, "templates/providers");
+  const grokDir = join(projectDir, ".grok");
+  await mkdir(grokDir, { recursive: true });
+  try {
+    const settingsSource = join(examplesBaseDir, "settings.json");
+    const settingsTarget = join(grokDir, "settings.json");
+    const exists = await checkExists2(settingsTarget);
+    if (!exists) {
+      await copyFile(settingsSource, settingsTarget);
+      logger.info("Created .grok/settings.json template", { path: settingsTarget });
+    } else {
+      logger.info(".grok/settings.json already exists, skipping", { path: settingsTarget });
+    }
+  } catch (error) {
+    logger.warn("Failed to copy Grok settings template", {
+      error: error.message
+    });
+  }
+  try {
+    const providersDir = join(projectDir, ".automatosx/providers");
+    await mkdir(providersDir, { recursive: true });
+    const xaiTemplateSource = join(templatesDir, "grok.yaml.template");
+    const xaiTemplateTarget = join(providersDir, "grok.yaml.template");
+    const xaiExists = await checkExists2(xaiTemplateTarget);
+    if (!xaiExists) {
+      await copyFile(xaiTemplateSource, xaiTemplateTarget);
+      logger.info("Created .automatosx/providers/grok.yaml.template (X.AI Grok)", { path: xaiTemplateTarget });
+    }
+    const zaiTemplateSource = join(templatesDir, "grok-zai.yaml.template");
+    const zaiTemplateTarget = join(providersDir, "grok-zai.yaml.template");
+    const zaiExists = await checkExists2(zaiTemplateTarget);
+    if (!zaiExists) {
+      await copyFile(zaiTemplateSource, zaiTemplateTarget);
+      logger.info("Created .automatosx/providers/grok-zai.yaml.template (Z.AI GLM 4.6)", { path: zaiTemplateTarget });
+    }
+    const readmeSource = join(templatesDir, "README.md");
+    const readmeTarget = join(providersDir, "README.md");
+    const readmeExists = await checkExists2(readmeTarget);
+    if (!readmeExists) {
+      await copyFile(readmeSource, readmeTarget);
+      logger.info("Created .automatosx/providers/README.md", { path: readmeTarget });
+    }
+  } catch (error) {
+    logger.warn("Failed to copy Grok provider YAML templates", {
+      error: error.message
+    });
+  }
+}
+async function setupProjectGrokMd(projectDir, packageRoot, force) {
+  const grokMdPath = join(projectDir, "GROK.md");
+  const templatePath = join(packageRoot, "examples/grok/GROK_INTEGRATION.md");
+  try {
+    const { readFile: readFile14 } = await import('fs/promises');
+    const template = await readFile14(templatePath, "utf-8");
+    const exists = await checkExists2(grokMdPath);
+    if (!exists) {
+      const content = [
+        "# GROK.md",
+        "",
+        "This file provides guidance for Grok CLI integration with AutomatosX.",
+        "",
+        "---",
+        "",
+        template
+      ].join("\n");
+      await writeFile(grokMdPath, content, "utf-8");
+      logger.info("Created GROK.md with AutomatosX integration", { path: grokMdPath });
+    } else {
+      const existingContent = await readFile14(grokMdPath, "utf-8");
+      if (existingContent.includes("# Grok CLI Integration")) {
+        if (!force) {
+          logger.info("GROK.md already contains AutomatosX integration", { path: grokMdPath });
+          return;
+        }
+        const updatedContent = replaceAutomatosXSection(existingContent, template);
+        await writeFile(grokMdPath, updatedContent, "utf-8");
+        logger.info("Updated AutomatosX integration in GROK.md", { path: grokMdPath });
+      } else {
+        const updatedContent = [
+          existingContent.trimEnd(),
+          "",
+          "---",
+          "",
+          template
+        ].join("\n");
+        await writeFile(grokMdPath, updatedContent, "utf-8");
+        logger.info("Added AutomatosX integration to existing GROK.md", { path: grokMdPath });
+      }
+    }
+  } catch (error) {
+    logger.warn("Failed to setup GROK.md", {
+      error: error.message,
+      path: grokMdPath
+    });
+  }
+}
 async function setupProjectAgentsMd(projectDir, packageRoot, force) {
   const agentsMdPath = join(projectDir, "AGENTS.md");
   const templatePath = join(packageRoot, "examples/agents/AGENTS_INTEGRATION.md");
@@ -6263,8 +6832,8 @@ var initCommand = {
         console.log(chalk5.white("   Using backend agent to analyze your project..."));
         console.log(chalk5.dim("   This will take 1-2 minutes\n"));
         const { spawn: spawn5 } = await import('child_process');
-        const { promisify: promisify7 } = await import('util');
-        const execFile = promisify7((await import('child_process')).execFile);
+        const { promisify: promisify5 } = await import('util');
+        const execFile = promisify5((await import('child_process')).execFile);
         try {
           const analysisTask = `Analyze this project and create a comprehensive ax.md file:
 
@@ -8480,8 +9049,6 @@ var Router = class {
   providers;
   fallbackEnabled;
   healthCheckInterval;
-  penalizedProviders;
-  // provider name -> penalty expiry timestamp
   providerCooldownMs;
   cache;
   routerConfig;
@@ -8500,14 +9067,15 @@ var Router = class {
   tracer;
   // v8.3.0: Circuit breaker for simple failover
   circuitState = /* @__PURE__ */ new Map();
+  circuitBreakerThreshold;
   constructor(config) {
     this.routerConfig = config;
     this.providers = [...config.providers].sort((a, b) => {
       return a.priority - b.priority;
     });
     this.fallbackEnabled = config.fallbackEnabled;
-    this.penalizedProviders = /* @__PURE__ */ new Map();
     this.providerCooldownMs = config.providerCooldownMs ?? 3e4;
+    this.circuitBreakerThreshold = config.circuitBreakerThreshold ?? 3;
     this.cache = config.cache;
     const limitManager = getProviderLimitManager();
     void limitManager.initialize().catch((err) => {
@@ -8643,8 +9211,8 @@ var Router = class {
       const providerNames = providersToTry.map((p) => p.name);
       const healthMultipliers = /* @__PURE__ */ new Map();
       for (const provider of providersToTry) {
-        const isPenalized = this.penalizedProviders.has(provider.name);
-        healthMultipliers.set(provider.name, isPenalized ? 0.5 : 1);
+        const isCircuitOpen = this.isCircuitOpen(provider.name);
+        healthMultipliers.set(provider.name, isCircuitOpen ? 0.5 : 1);
       }
       const scores = await getProviderMetricsTracker().getAllScores(
         providerNames,
@@ -8736,21 +9304,20 @@ var Router = class {
             modelParams
           );
         }
-        this.penalizedProviders.delete(provider.name);
+        this.recordSuccess(provider.name);
         if (this.tracer) {
-          const estimatedCost = this.estimateCost(provider.name, response.tokensUsed);
           this.tracer.logExecution(
             provider.name,
             true,
             // success
             response.latencyMs,
-            estimatedCost,
+            0,
+            // v8.3.0: No cost tracking in CLI-only mode
             response.tokensUsed
           );
         }
         if (this.useMultiFactorRouting) {
           const metricsTracker = getProviderMetricsTracker();
-          const estimatedCost = this.estimateCost(provider.name, response.tokensUsed);
           void metricsTracker.recordRequest(
             provider.name,
             response.latencyMs,
@@ -8762,7 +9329,8 @@ var Router = class {
               completion: response.tokensUsed.completion,
               total: response.tokensUsed.total
             },
-            estimatedCost,
+            0,
+            // v8.3.0: No cost tracking in CLI-only mode
             response.model
           ).catch((error) => {
             logger.warn("Metrics recording failed (non-critical)", {
@@ -8820,9 +9388,7 @@ var Router = class {
             error: lastError.message,
             willFallback: this.fallbackEnabled && attemptNumber < availableProviders.length
           });
-          const penaltyExpiry = Date.now() + this.providerCooldownMs;
-          this.penalizedProviders.set(provider.name, penaltyExpiry);
-          logger.debug(`Provider ${provider.name} penalized until ${new Date(penaltyExpiry).toISOString()}`);
+          this.recordFailure(provider.name);
           if (this.tracer) {
             const nextProvider = providersToTry[attemptNumber]?.name;
             this.tracer.logDegradation(
@@ -8910,17 +9476,12 @@ var Router = class {
   /**
    * Get available providers sorted by priority
    * v5.7.0: Enhanced with provider limit detection
-   * Filters out penalized providers (those in cooldown period) and limited providers (quota exceeded)
+   * v8.3.0: Uses circuit breaker state instead of separate penalty tracking
+   * Filters out providers with open circuit breakers and limited providers (quota exceeded)
    */
   async getAvailableProviders() {
     const now = Date.now();
     const limitManager = getProviderLimitManager();
-    for (const [providerName, expiryTime] of this.penalizedProviders.entries()) {
-      if (now >= expiryTime) {
-        this.penalizedProviders.delete(providerName);
-        logger.debug(`Provider ${providerName} penalty expired`);
-      }
-    }
     const checks = this.providers.map(async (provider) => {
       try {
         const limitCheck = limitManager.isProviderLimited(provider.name, now);
@@ -8930,10 +9491,8 @@ var Router = class {
           logger.debug(`Skipping limited provider ${provider.name} (resets in ${remainingHours}h)`);
           return null;
         }
-        if (this.penalizedProviders.has(provider.name)) {
-          const expiryTime = this.penalizedProviders.get(provider.name);
-          const remainingMs = expiryTime - now;
-          logger.debug(`Skipping penalized provider ${provider.name} (${Math.ceil(remainingMs / 1e3)}s remaining)`);
+        if (this.isCircuitOpen(provider.name)) {
+          logger.debug(`Skipping provider ${provider.name} (circuit breaker open)`);
           return null;
         }
         const isAvailable = await provider.isAvailable();
@@ -9080,7 +9639,7 @@ var Router = class {
       clearInterval(this.healthCheckInterval);
       this.healthCheckInterval = void 0;
     }
-    this.penalizedProviders.clear();
+    this.circuitState.clear();
     if (this.tracer) {
       this.tracer.close();
       logger.debug("Router trace logger closed");
@@ -9114,10 +9673,49 @@ var Router = class {
     };
   }
   /**
-   * v8.3.0: Cost estimation removed - returns 0
+   * v8.3.0: Check if circuit breaker is open for a provider
    */
-  estimateCost(providerName, tokensUsed) {
-    return 0;
+  isCircuitOpen(providerName) {
+    const state = this.circuitState.get(providerName);
+    if (!state || !state.isOpen) return false;
+    const cooldownMs = this.providerCooldownMs || 6e4;
+    if (Date.now() - state.lastFailure > cooldownMs) {
+      state.isOpen = false;
+      state.failures = 0;
+      this.circuitState.set(providerName, state);
+      logger.info(`Circuit breaker closed for ${providerName} after cooldown`);
+      return false;
+    }
+    return true;
+  }
+  /**
+   * v8.3.0: Record provider success - resets circuit breaker
+   */
+  recordSuccess(providerName) {
+    const state = this.circuitState.get(providerName);
+    if (state) {
+      state.failures = 0;
+      state.isOpen = false;
+      this.circuitState.set(providerName, state);
+      logger.debug(`Circuit breaker reset for ${providerName} after success`);
+    }
+  }
+  /**
+   * v8.3.0: Record provider failure - opens circuit after threshold
+   */
+  recordFailure(providerName) {
+    const state = this.circuitState.get(providerName) || {
+      failures: 0,
+      lastFailure: 0,
+      isOpen: false
+    };
+    state.failures++;
+    state.lastFailure = Date.now();
+    if (state.failures >= this.circuitBreakerThreshold) {
+      state.isOpen = true;
+      logger.warn(`Circuit breaker opened for ${providerName} after ${state.failures} failures (threshold: ${this.circuitBreakerThreshold})`);
+    }
+    this.circuitState.set(providerName, state);
   }
 };
 
@@ -12474,6 +13072,155 @@ var AgentNotFoundError = class extends Error {
 
 // src/agents/profile-loader.ts
 init_logger();
+
+// src/agents/agent-schemas.ts
+init_esm_shims();
+var stageSchema = z.object({
+  name: z.string().min(1),
+  description: z.string().min(1),
+  key_questions: z.array(z.string()).optional(),
+  outputs: z.array(z.string()).optional(),
+  // Deprecated but still accepted for backward compatibility
+  model: z.string().optional(),
+  temperature: z.number().min(0).max(2).optional(),
+  // Advanced stage features
+  dependencies: z.array(z.string()).optional(),
+  condition: z.string().optional(),
+  parallel: z.boolean().optional(),
+  streaming: z.boolean().optional(),
+  saveToMemory: z.boolean().optional(),
+  // Checkpoint and retry
+  checkpoint: z.boolean().optional(),
+  timeout: z.number().int().positive().optional(),
+  maxRetries: z.number().int().nonnegative().max(10).optional(),
+  retryDelay: z.number().int().nonnegative().optional()
+}).describe("Agent workflow stage");
+var personalitySchema = z.object({
+  traits: z.array(z.string()).optional(),
+  catchphrase: z.string().optional(),
+  communication_style: z.string().optional(),
+  decision_making: z.string().optional()
+}).describe("Agent personality");
+var abilitySelectionSchema = z.object({
+  core: z.array(z.string()).optional(),
+  taskBased: z.record(z.string(), z.array(z.string())).optional(),
+  loadAll: z.boolean().optional()
+}).describe("Ability selection strategy");
+var redirectRuleSchema = z.object({
+  phrase: z.string().regex(/.+/, "Redirect phrase must be a valid regex pattern"),
+  suggest: z.string().min(1)
+}).describe("Agent redirect rule");
+var selectionMetadataSchema = z.object({
+  primaryIntents: z.array(z.string()).optional(),
+  secondarySignals: z.array(z.string()).optional(),
+  negativeIntents: z.array(z.string()).optional(),
+  redirectWhen: z.array(redirectRuleSchema).optional(),
+  keywords: z.array(z.string()).optional(),
+  antiKeywords: z.array(z.string()).optional()
+}).describe("Agent selection metadata");
+var agentProfileSchema = z.object({
+  // Basic information
+  name: z.string().min(1).max(50).regex(/^[a-zA-Z0-9_-]+$/, "Agent name must be alphanumeric with dash/underscore only").optional(),
+  // Optional - uses filename if not provided
+  displayName: z.string().max(100).optional().or(z.literal("")).transform((val) => val === "" ? void 0 : val),
+  version: z.string().regex(/^\d+\.\d+\.\d+$/, "Version must be semver format").optional(),
+  description: z.string().min(1),
+  // Role and expertise
+  role: z.string().min(1).optional(),
+  expertise: z.array(z.string()).min(1).optional(),
+  capabilities: z.array(z.string()).optional(),
+  // System prompt (required by profile-loader validateProfile, but optional here for flexibility)
+  systemPrompt: z.string().min(1).optional(),
+  // Workflow
+  workflow: z.array(stageSchema).min(1).optional(),
+  // Personality
+  personality: personalitySchema.optional(),
+  // Abilities - accepts both array (legacy) and object (new) formats
+  abilities: z.union([
+    z.array(z.string()),
+    // Legacy format: ['ability1', 'ability2']
+    abilitySelectionSchema
+    // New format: { core: [...], taskBased: {...}, loadAll: true }
+  ]).optional(),
+  // Ability selection strategy (v4.5.8+)
+  abilitySelection: abilitySelectionSchema.optional(),
+  // Thinking patterns
+  thinking_patterns: z.array(z.string()).optional(),
+  // Dependencies
+  dependencies: z.array(z.string()).optional(),
+  // Parallel execution
+  parallel: z.boolean().optional(),
+  // Model parameters (deprecated but still accepted)
+  temperature: z.number().min(0).max(2).optional(),
+  maxTokens: z.number().int().positive().optional(),
+  // Orchestration (v4.7.0+)
+  orchestration: z.object({
+    maxDelegationDepth: z.number().int().nonnegative().optional(),
+    canReadWorkspaces: z.array(z.string()).optional(),
+    canWriteToShared: z.boolean().optional()
+  }).optional(),
+  // Selection metadata (v5.7.0+)
+  selectionMetadata: selectionMetadataSchema.optional(),
+  // Team and collaboration
+  team: z.string().optional(),
+  collaboratesWith: z.array(z.string()).optional(),
+  // Deprecated fields (accepted but ignored)
+  model: z.string().optional(),
+  provider: z.string().optional(),
+  fallbackProvider: z.string().optional(),
+  // Additional metadata
+  tags: z.array(z.string()).optional(),
+  priority: z.number().int().min(1).max(100).optional(),
+  enabled: z.boolean().default(true),
+  // Custom metadata
+  metadata: z.record(z.string(), z.any()).optional()
+}).describe("Agent profile");
+z.object({
+  memory: z.boolean().optional(),
+  saveMemory: z.boolean().optional(),
+  session: z.string().optional(),
+  sessionCreate: z.boolean().optional(),
+  provider: z.string().optional(),
+  format: z.enum(["text", "json"]).optional(),
+  verbose: z.boolean().optional(),
+  debug: z.boolean().optional(),
+  quiet: z.boolean().optional(),
+  config: z.string().optional(),
+  parallel: z.boolean().optional(),
+  streaming: z.boolean().optional(),
+  resumable: z.boolean().optional(),
+  checkpoint: z.boolean().optional()
+}).describe("Agent run command options");
+z.object({
+  template: z.string().optional(),
+  interactive: z.boolean().optional(),
+  force: z.boolean().optional(),
+  description: z.string().optional(),
+  role: z.string().optional(),
+  expertise: z.array(z.string()).optional(),
+  displayName: z.string().optional()
+}).describe("Agent create command options");
+z.object({
+  limit: z.number().int().positive().max(1e4).optional(),
+  agent: z.string().optional(),
+  session: z.string().optional(),
+  format: z.enum(["text", "json"]).optional(),
+  before: z.string().optional(),
+  // ISO date string
+  after: z.string().optional()
+  // ISO date string
+}).describe("Memory search options");
+z.object({
+  agents: z.array(z.string()).min(1),
+  description: z.string().optional(),
+  metadata: z.record(z.string(), z.any()).optional()
+}).describe("Session create options");
+function safeValidateAgentProfile(profile) {
+  return agentProfileSchema.safeParse(profile);
+}
+agentProfileSchema.partial();
+
+// src/agents/profile-loader.ts
 var __filename3 = fileURLToPath(import.meta.url);
 var __dirname4 = dirname(__filename3);
 function getPackageRoot2() {
@@ -13004,6 +13751,25 @@ var ProfileLoader = class {
     if (!data || typeof data !== "object" || Array.isArray(data)) {
       throw new AgentValidationError(`Invalid profile data for ${name}: expected object, got ${typeof data}`);
     }
+    if (data.name && typeof data.name === "string") {
+      if (!/^[a-zA-Z0-9_-]+$/.test(data.name)) {
+        if (!data.displayName) {
+          data.displayName = data.name;
+        }
+        data.name = name;
+      }
+    } else if (!data.name) {
+      data.name = name;
+    }
+    const validationResult = safeValidateAgentProfile(data);
+    if (!validationResult.success) {
+      const validationErrors = validationResult.error.issues.map(
+        (e) => `${e.path.join(".")}: ${e.message}`
+      ).join("; ");
+      throw new AgentValidationError(
+        `Invalid profile for ${name}: ${validationErrors}`
+      );
+    }
     let teamConfig;
     if (data.team && this.teamManager) {
       try {
@@ -21340,6 +22106,55 @@ init_esm_shims();
 init_path_resolver();
 init_claude_provider();
 init_gemini_provider();
+
+// src/providers/grok-provider.ts
+init_esm_shims();
+init_base_provider();
+init_logger();
+var GrokProvider = class extends BaseProvider {
+  constructor(config) {
+    super(config);
+    logger.debug("GrokProvider initialized", {
+      name: config.name,
+      enabled: config.enabled,
+      priority: config.priority,
+      command: config.command || "grok"
+    });
+  }
+  /**
+   * Get the CLI command name for Grok
+   * Returns 'grok' which can point to either:
+   * - Z.AI GLM 4.6 CLI
+   * - X.AI Official Grok CLI
+   */
+  getCLICommand() {
+    return this.config.command || "grok";
+  }
+  /**
+   * Get mock response for testing
+   * Returns a realistic Grok-style response
+   */
+  getMockResponse() {
+    return `[Mock Grok Response]
+
+This is a mock response from Grok for testing purposes.
+
+Grok is designed to provide helpful, accurate, and witty responses to your queries. This mock response simulates the typical output you would receive from the Grok CLI.
+
+Key features:
+- Direct and informative answers
+- Occasional humor and personality
+- Factual accuracy
+- Clear formatting
+
+For actual Grok responses, ensure:
+1. Grok CLI is installed (grok --version)
+2. API credentials are configured (if using X.AI)
+3. AUTOMATOSX_MOCK_PROVIDERS is not set to 'true'`;
+  }
+};
+
+// src/cli/commands/status.ts
 init_openai_provider_factory();
 init_logger();
 var VERSION = getVersion();
@@ -21426,6 +22241,15 @@ var statusCommand3 = {
         );
         providers.push(provider);
       }
+      if (providerConfigs["grok"]?.enabled) {
+        providers.push(new GrokProvider({
+          name: "grok",
+          enabled: true,
+          priority: providerConfigs["grok"].priority,
+          timeout: providerConfigs["grok"].timeout,
+          command: providerConfigs["grok"].command
+        }));
+      }
       const providerHealth = await Promise.all(
         providers.map(async (p) => ({
           name: p.name,
@@ -21776,7 +22600,7 @@ function formatUptime(seconds) {
 // src/cli/commands/update.ts
 init_esm_shims();
 init_logger();
-var execAsync4 = promisify(exec);
+var execAsync2 = promisify(exec);
 var updateCommand = {
   command: "update",
   describe: "Check for updates and upgrade AutomatosX to the latest version",
@@ -21855,7 +22679,7 @@ var updateCommand = {
 };
 async function getCurrentVersion() {
   try {
-    const { stdout } = await execAsync4("npm list -g @defai.digital/automatosx --depth=0 --json");
+    const { stdout } = await execAsync2("npm list -g @defai.digital/automatosx --depth=0 --json");
     const result = JSON.parse(stdout);
     return result.dependencies["@defai.digital/automatosx"]?.version || "unknown";
   } catch (error) {
@@ -21871,7 +22695,7 @@ async function getCurrentVersion() {
   }
 }
 async function getLatestVersion() {
-  const { stdout } = await execAsync4("npm view @defai.digital/automatosx version");
+  const { stdout } = await execAsync2("npm view @defai.digital/automatosx version");
   return stdout.trim();
 }
 function isNewer(a, b) {
@@ -21886,7 +22710,7 @@ function isNewer(a, b) {
 async function showChangelog(from, to) {
   try {
     console.log(chalk5.cyan("What's new:\n"));
-    const { stdout } = await execAsync4(
+    const { stdout } = await execAsync2(
       `curl -s https://api.github.com/repos/defai-digital/automatosx/releases/tags/v${to}`
     );
     const release = JSON.parse(stdout);
@@ -21908,7 +22732,7 @@ async function showChangelog(from, to) {
 }
 async function installUpdate(version) {
   try {
-    const { stdout, stderr } = await execAsync4(
+    const { stdout, stderr } = await execAsync2(
       `npm install -g @defai.digital/automatosx@${version}`,
       { maxBuffer: 10 * 1024 * 1024 }
     );
@@ -23900,11 +24724,11 @@ function expand_(str, isTop) {
           if (pad) {
             const need = width - c.length;
             if (need > 0) {
-              const z = new Array(need + 1).join("0");
+              const z4 = new Array(need + 1).join("0");
               if (i < 0) {
-                c = "-" + z + c.slice(1);
+                c = "-" + z4 + c.slice(1);
               } else {
-                c = z + c;
+                c = z4 + c;
               }
             }
           }
@@ -40600,9 +41424,9 @@ var doctorCommand2 = {
   describe: "Run diagnostic checks and validate system setup",
   builder: (yargs2) => {
     return yargs2.positional("provider", {
-      describe: "Check specific provider (openai, gemini, claude) or all if omitted",
+      describe: "Check specific provider (openai, gemini, claude, grok) or all if omitted",
       type: "string",
-      choices: ["openai", "gemini", "claude"]
+      choices: ["openai", "gemini", "claude", "grok"]
     }).option("verbose", {
       describe: "Show detailed diagnostic information",
       type: "boolean",
@@ -40638,7 +41462,7 @@ var doctorCommand2 = {
           details: error.message
         });
       }
-      const providersToCheck = argv.provider ? [argv.provider] : ["openai", "gemini", "claude"];
+      const providersToCheck = argv.provider ? [argv.provider] : ["openai", "gemini", "claude", "grok"];
       const verbose = argv.verbose ?? false;
       for (const provider of providersToCheck) {
         if (config && !config.providers[provider]?.enabled) {
@@ -40655,6 +41479,8 @@ ${getProviderEmoji(provider)} ${capitalize(provider)} Provider`));
           results.push(...await checkGeminiProvider(verbose));
         } else if (provider === "claude") {
           results.push(...await checkClaudeProvider(verbose));
+        } else if (provider === "grok") {
+          results.push(...await checkGrokProvider(verbose));
         }
       }
       console.log(chalk5.bold("\n\u{1F4C1} File System"));
@@ -40702,17 +41528,6 @@ async function checkOpenAIProvider(verbose) {
       details: verbose ? authCheck.details : void 0
     });
   }
-  if (cliCheck.success) {
-    const connCheck = await checkAPIConnectivity2("https://api.openai.com/v1/models");
-    results.push({
-      name: "API Connectivity",
-      category: "OpenAI",
-      passed: connCheck.success,
-      message: connCheck.message,
-      fix: connCheck.success ? void 0 : "Check firewall/proxy settings\n   OR: export AUTOMATOSX_CLI_ONLY=true (for CLI-only mode)",
-      details: verbose ? connCheck.details : void 0
-    });
-  }
   results.forEach((r) => displayCheck(r));
   return results;
 }
@@ -40728,14 +41543,14 @@ async function checkGeminiProvider(verbose) {
     details: verbose ? cliCheck.error : void 0
   });
   if (cliCheck.success) {
-    const authCheck = await checkCommand("gemini", "models list");
+    const helpCheck = await checkCommand("gemini", "--help");
     results.push({
-      name: "Authentication",
+      name: "CLI Ready",
       category: "Gemini",
-      passed: authCheck.success,
-      message: authCheck.success ? "Authenticated" : "Authentication failed",
-      fix: authCheck.success ? void 0 : "Run: gemini auth login",
-      details: verbose ? authCheck.error : void 0
+      passed: helpCheck.success,
+      message: helpCheck.success ? "CLI is functional" : "CLI not responding",
+      fix: helpCheck.success ? void 0 : "Check Gemini CLI installation: npm install -g @google/generative-ai-cli",
+      details: verbose ? helpCheck.success ? "Gemini CLI uses API keys from environment or config" : helpCheck.error : void 0
     });
   }
   results.forEach((r) => displayCheck(r));
@@ -40753,14 +41568,39 @@ async function checkClaudeProvider(verbose) {
     details: verbose ? cliCheck.error : void 0
   });
   if (cliCheck.success) {
-    const authCheck = await checkCommand("claude", "auth whoami");
+    const helpCheck = await checkCommand("claude", "--help");
     results.push({
-      name: "Authentication",
+      name: "CLI Ready",
       category: "Claude",
-      passed: authCheck.success,
-      message: authCheck.success ? "Authenticated" : "Not authenticated",
-      fix: authCheck.success ? void 0 : "Run: claude auth login",
-      details: verbose ? authCheck.error : void 0
+      passed: helpCheck.success,
+      message: helpCheck.success ? "CLI is functional" : "CLI not responding",
+      fix: helpCheck.success ? void 0 : "Check Claude Code CLI installation",
+      details: verbose ? helpCheck.success ? "Claude Code CLI authenticated via desktop app" : helpCheck.error : void 0
+    });
+  }
+  results.forEach((r) => displayCheck(r));
+  return results;
+}
+async function checkGrokProvider(verbose) {
+  const results = [];
+  const cliCheck = await checkCommand("grok", "--version");
+  results.push({
+    name: "CLI Installation",
+    category: "Grok",
+    passed: cliCheck.success,
+    message: cliCheck.success ? `Installed: ${cliCheck.output?.trim() || "version unknown"}` : "Grok CLI not found",
+    fix: cliCheck.success ? void 0 : "npm install -g @vibe-kit/grok-cli",
+    details: verbose ? cliCheck.error : void 0
+  });
+  if (cliCheck.success) {
+    const helpCheck = await checkCommand("grok", "--help");
+    results.push({
+      name: "CLI Ready",
+      category: "Grok",
+      passed: helpCheck.success,
+      message: helpCheck.success ? "CLI is functional" : "CLI not responding",
+      fix: helpCheck.success ? void 0 : "Check Grok CLI installation: npm install -g @vibe-kit/grok-cli",
+      details: verbose ? helpCheck.success ? "Grok CLI uses API keys from environment (GROK_API_KEY) or config files" : helpCheck.error : void 0
     });
   }
   results.forEach((r) => displayCheck(r));
@@ -40828,69 +41668,39 @@ async function checkCommand(command, args) {
   }
 }
 async function checkOpenAIAuth() {
-  if (process.env.OPENAI_API_KEY) {
-    return {
-      success: true,
-      message: "API key configured",
-      details: "OPENAI_API_KEY environment variable is set"
-    };
-  }
   try {
-    execSync('codex exec "test" --max-tokens 1', {
+    const output = execSync("codex login status 2>&1", {
       encoding: "utf-8",
-      stdio: ["pipe", "pipe", "pipe"],
       timeout: 1e4
     });
-    return {
-      success: true,
-      message: "Authenticated via CLI",
-      details: "Successfully executed test command"
-    };
-  } catch (error) {
-    const errorMsg = error.message.toLowerCase();
-    if (errorMsg.includes("unauthorized") || errorMsg.includes("401")) {
+    const statusText = output.toLowerCase();
+    if (statusText.includes("logged in") || statusText.includes("authenticated")) {
       return {
-        success: false,
-        message: "Not authenticated",
-        fix: 'Run: codex login\n   OR: export OPENAI_API_KEY="sk-..."',
-        details: "Test command returned unauthorized"
+        success: true,
+        message: "Authenticated via CLI",
+        details: output.trim()
       };
     }
     return {
       success: false,
-      message: "Cannot verify authentication",
-      fix: 'Run: codex login\n   OR: export OPENAI_API_KEY="sk-..."',
-      details: errorMsg
-    };
-  }
-}
-async function checkAPIConnectivity2(url) {
-  try {
-    const controller = new AbortController();
-    const timeout = setTimeout(() => controller.abort(), 5e3);
-    const response = await fetch(url, {
-      method: "HEAD",
-      signal: controller.signal
-    });
-    clearTimeout(timeout);
-    return {
-      success: response.ok || response.status === 401,
-      // 401 means we reached API
-      message: response.ok || response.status === 401 ? "Connected" : `HTTP ${response.status}`,
-      details: `Status: ${response.status} ${response.statusText}`
+      message: "Not authenticated",
+      fix: "Run: codex login",
+      details: output.trim()
     };
   } catch (error) {
-    const errorMsg = error.message;
-    if (errorMsg.includes("aborted")) {
+    const errorMsg = error.message.toLowerCase();
+    if (errorMsg.includes("not logged in") || errorMsg.includes("not authenticated")) {
       return {
         success: false,
-        message: "Connection timeout",
-        details: "Request timed out after 5 seconds"
+        message: "Not authenticated",
+        fix: "Run: codex login",
+        details: "codex login status: not logged in"
       };
     }
     return {
       success: false,
-      message: "Cannot connect",
+      message: "Cannot verify authentication",
+      fix: "Run: codex login",
       details: errorMsg
     };
   }
@@ -40943,6 +41753,8 @@ function getProviderEmoji(provider) {
       return "\u2728";
     case "claude":
       return "\u{1F9E0}";
+    case "grok":
+      return "\u{1F680}";
     default:
       return "\u{1F527}";
   }
@@ -40954,7 +41766,7 @@ function capitalize(str) {
 // src/cli/commands/cleanup.ts
 init_esm_shims();
 init_logger();
-var execAsync5 = promisify(exec);
+var execAsync3 = promisify(exec);
 var cleanupCommand2 = {
   command: "cleanup [provider]",
   describe: "Clean up orphaned provider processes (v6.0.7 Phase 3)",
@@ -41083,7 +41895,7 @@ async function findProcesses(processName, verbose) {
     throw new Error(`Invalid process name: ${processName}. Only alphanumeric characters, dashes, and underscores are allowed.`);
   }
   try {
-    const { stdout } = await execAsync5("ps -eo pid,comm,etime,rss");
+    const { stdout } = await execAsync3("ps -eo pid,comm,etime,rss");
     if (!stdout.trim()) {
       return processes;
     }