@vtxmacro/cli 2026.9.30 → 2026.9.31

package/bin/vtx-service-bootstrap.js

@@ -16,7 +16,7 @@ import { fileURLToPath } from "node:url";
 // agent-cli-release.json
 var agent_cli_release_default = {
   package_name: "@vtxmacro/cli",
-  package_version: "2026.9.30",
+  package_version: "2026.9.31",
   codex_package_name: "@openai/codex",
   codex_version: "0.153.3",
   copilot_sdk_package_name: "@github/copilot-sdk",

package/bin/vtx.js

@@ -77,7 +77,7 @@ var init_agent_cli_release = __esm({
   "agent-cli-release.json"() {
     agent_cli_release_default = {
       package_name: "@vtxmacro/cli",
-      package_version: "2026.9.30",
+      package_version: "2026.9.31",
       codex_package_name: "@openai/codex",
       codex_version: "0.153.3",
       copilot_sdk_package_name: "@github/copilot-sdk",
@@ -34407,13 +34407,30 @@ var init_grok_policy = __esm({
 import { createServer as createServer3 } from "node:http";
 import { createHash as createHash6, randomBytes as randomBytes5 } from "node:crypto";
 import { once } from "node:events";
-var record3, count2, effort, safeCode2, GrokTransportProxy, createGrokTransportProxy;
+var diagnosticNames, diagnosticTypes, diagnosticIdentifier, record3, count2, effort, safeCode2, GrokTransportProxy, createGrokTransportProxy;
 var init_grok_transport_proxy = __esm({
   "lib/inference-host/grok-transport-proxy.ts"() {
     "use strict";
     init_define_VTX_EXO_POLICY();
     init_define_VTX_GROK_POLICY();
     init_define_VTX_PI_MODEL_POLICY();
+    diagnosticNames = /* @__PURE__ */ new Set([
+      "search_tool",
+      "use_tool",
+      "bash",
+      "read_file",
+      "write_file",
+      "edit_file",
+      "web_search",
+      "vtx_get_data",
+      "vtx_submit_decision",
+      "vtx_decision_status"
+    ]);
+    diagnosticTypes = /* @__PURE__ */ new Set(["function", "web_search", "web_search_preview", "file_search", "computer_use"]);
+    diagnosticIdentifier = (value, known) => {
+      if (typeof value !== "string") return { label: value == null ? "missing" : "invalid", sha256: null };
+      return known.has(value) ? { label: value, sha256: null } : { label: "redacted", sha256: createHash6("sha256").update(value).digest("hex") };
+    };
     record3 = (value) => value !== null && typeof value === "object" && !Array.isArray(value) ? value : {};
     count2 = (value) => Number.isSafeInteger(value) && Number(value) >= 0 ? Number(value) : null;
     effort = (value) => value == null ? "none" : String(value).toLowerCase();
@@ -34434,6 +34451,7 @@ var init_grok_transport_proxy = __esm({
         this.failureCode = null;
         this.rejectionStatus = null;
         this.terminalFailure = null;
+        this.toolValidationFailure = null;
         const upstream = new URL(options.upstreamBaseUrl);
         if (upstream.protocol !== "https:" || upstream.username || upstream.password || upstream.search || upstream.hash || !options.requestedModel || typeof options.expectedSystemPrompt !== "string" || !Number.isSafeInteger(options.deadlineAtMs) || options.providerDispatchNotAfterMs !== void 0 && !Number.isSafeInteger(options.providerDispatchNotAfterMs) || !Number.isSafeInteger(options.maxRequestBytes) || options.maxRequestBytes < 1 || !Number.isSafeInteger(options.maxResponseBytes) || options.maxResponseBytes < 1 || new Set(options.allowedToolNames).size !== options.allowedToolNames.length || options.allowedToolNames.some((name) => !name)) throw new Error("grok_proxy_invalid_configuration");
       }
@@ -34471,6 +34489,31 @@ var init_grok_transport_proxy = __esm({
           throw new Error("server_account_context_expired_before_provider_dispatch");
         }
       }
+      rejectTools(reason, payload, route) {
+        const tools = Array.isArray(payload.tools) ? payload.tools : null;
+        const diagnostic = {
+          reason,
+          route,
+          tools_shape: tools ? "array" : payload.tools === null ? "null" : typeof payload.tools,
+          tool_count: tools?.length ?? null,
+          expected_tool_count: this.options.allowedToolNames.length,
+          tools: (tools ?? []).slice(0, 8).map((value) => {
+            const tool = record3(value);
+            const type = diagnosticIdentifier(tool.type, diagnosticTypes);
+            const name = diagnosticIdentifier(route === "/responses" ? tool.name : record3(tool.function).name, diagnosticNames);
+            return { type: type.label, name: name.label, type_sha256: type.sha256, name_sha256: name.sha256 };
+          }),
+          tools_truncated: (tools?.length ?? 0) > 8,
+          prior_dispatch: this.dispatched,
+          completed_response_count: this.receiptValues.length
+        };
+        this.toolValidationFailure ??= diagnostic;
+        try {
+          this.options.onToolValidationFailure?.(diagnostic);
+        } catch {
+        }
+        throw new Error(`grok_tool_isolation_${reason}`);
+      }
       validatePayload(payload, route) {
         const requestedEffort = route === "/responses" ? record3(payload.reasoning).effort : payload.reasoning_effort;
         if (payload.model !== this.options.requestedModel || effort(requestedEffort) !== effort(this.options.requestedReasoningEffort)) {
@@ -34482,17 +34525,17 @@ var init_grok_transport_proxy = __esm({
         if (instructions.length !== 1 || instructions[0].role !== "system" || instructions[0].content !== this.options.expectedSystemPrompt || route === "/responses" && payload.instructions != null) {
           throw new Error("grok_system_prompt_mismatch");
         }
-        if (payload.tools != null && !Array.isArray(payload.tools)) throw new Error("grok_tool_isolation_failed");
+        if (payload.tools != null && !Array.isArray(payload.tools)) this.rejectTools("invalid_tools", payload, route);
         const tools = payload.tools ?? [];
         const names2 = tools.map((value) => {
           const tool = record3(value);
-          if (tool.type !== "function") throw new Error("grok_tool_isolation_failed");
+          if (tool.type !== "function") this.rejectTools("invalid_type", payload, route);
           const name = route === "/responses" ? tool.name : record3(tool.function).name;
-          if (typeof name !== "string") throw new Error("grok_tool_isolation_failed");
+          if (typeof name !== "string") this.rejectTools("missing_name", payload, route);
           return name;
         });
         if (names2.sort().join("\0") !== [...this.options.allowedToolNames].sort().join("\0")) {
-          throw new Error("grok_tool_isolation_failed");
+          this.rejectTools("unexpected_tools", payload, route);
         }
       }
       async handle(request, response) {
@@ -34622,8 +34665,15 @@ var init_grok_transport_proxy = __esm({
             if (!this.dispatched) this.pending = false;
           }
           controller.abort();
-          if (!response.headersSent) response.writeHead(502, { "x-should-retry": "false", "content-type": "application/json" });
-          response.end();
+          if (!response.headersSent) {
+            const localValidation = inference && this.toolValidationFailure !== null;
+            response.writeHead(localValidation ? 400 : 502, { "x-should-retry": "false", "content-type": "application/json" });
+            response.end(localValidation ? JSON.stringify({ error: {
+              type: "vtx_host_validation_error",
+              code: this.failureCode,
+              message: "VTX blocked this Grok Build request locally because its tools did not match the allowed tool contract."
+            } }) : void 0);
+          } else response.end();
         } finally {
           clearTimeout(timer);
           this.options.signal?.removeEventListener("abort", abort);
@@ -35534,7 +35584,13 @@ var init_grok_adapter = __esm({
             providerDispatchNotAfterMs: provider?.providerDispatchNotAfterMs,
             onProviderDispatch: provider?.onProviderDispatch,
             signal: input.signal,
-            fetchImpl: this.options.fetchImpl
+            fetchImpl: this.options.fetchImpl,
+            onToolValidationFailure: (diagnostic) => this.options.emitDiagnosticEvent?.({
+              event: "grok_tool_validation_failed",
+              attempt_id: provider?.attemptId ?? null,
+              control_mode: provider ? "provider" : "agent",
+              ...diagnostic
+            })
           });
           input.signal.throwIfAborted();
           session = new GrokAcpSession({
@@ -35647,7 +35703,7 @@ var init_grok_adapter = __esm({
           provider?.onTerminalDispatchOutcome?.(outcome);
           if (error48 instanceof CodexAppServerError) throw error48;
           throw new CodexAppServerError({
-            message: "Grok Build could not complete the inference contract.",
+            message: proxy?.toolValidationFailure ? "VTX blocked an outgoing Grok Build request locally because its tools did not match the allowed tool contract." : "Grok Build could not complete the inference contract.",
             category: input.signal?.aborted ? "cancelled" : Date.now() >= input.deadlineAtMs ? "timeout" : proxy?.rejectionStatus === 401 || proxy?.rejectionStatus === 403 ? "auth" : "adapter",
             code: proxy?.failureCode ?? proxy?.terminalFailure?.code ?? (error48 instanceof Error && /^grok_[a-z0-9_]+$/u.test(error48.message) ? error48.message : "grok_adapter_failure"),
             httpStatusCode: proxy?.rejectionStatus,
@@ -43609,8 +43665,8 @@ Durable service:
         quiesceSignal: options.quiesceSignal
       }).run();
     };
-    preparePortableDurableAdapter = async (adapterId, config2, signal) => {
-      const adapter = adapterId === "copilot" ? new CopilotSubscriptionAdapter() : adapterId === "grok-build" ? new GrokBuildAdapter({ stateRoot: `${config2.statePath}.grok`, grokHome: `${config2.statePath}.grok-home` }) : adapterId === "pi" ? new PiAdapter({
+    preparePortableDurableAdapter = async (adapterId, config2, signal, emitDiagnosticEvent) => {
+      const adapter = adapterId === "copilot" ? new CopilotSubscriptionAdapter() : adapterId === "grok-build" ? new GrokBuildAdapter({ stateRoot: `${config2.statePath}.grok`, grokHome: `${config2.statePath}.grok-home`, emitDiagnosticEvent }) : adapterId === "pi" ? new PiAdapter({
         credentialStore: createPiCredentialStore(config2),
         stateRoot: `${config2.statePath}.pi`,
         qualifiedModels: await loadPiModelPolicy()
@@ -44456,8 +44512,8 @@ Waiting for approval...
         const emitDiagnosticEvent = parsed.json ? (event) => (dependencies.emitStdout ?? ((text) => {
           process.stdout.write(text);
         }))(`${JSON.stringify(event)}
-`) : adapterId === "codex" ? (event) => {
-          if (!["codex_app_server_closed", "codex_app_server_session_started"].includes(
+`) : adapterId === "codex" || adapterId === "grok-build" ? (event) => {
+          if (!["codex_app_server_closed", "codex_app_server_session_started", "grok_tool_validation_failed"].includes(
             String(event.event ?? "")
           )) return;
           (dependencies.emitStderr ?? ((text) => {
@@ -44466,7 +44522,16 @@ Waiting for approval...
 `);
         } : void 0;
         if (adapterId !== "codex") {
-          const prepared = adapterId === "exo" ? await (dependencies.prepareExoAdapter ?? prepareExoAdapter)(config2, parsed.exoRoot, cancellation.signal) : await (dependencies.prepareDurableAdapter ?? preparePortableDurableAdapter)(adapterId, config2, cancellation.signal);
+          const diagnosticState = await readInferenceHostLocalState(config2.statePath);
+          const emitPortableDiagnostic = (event) => emitDiagnosticEvent?.({
+            ...event,
+            schema_version: "vtx_inference_host_diagnostic_v1",
+            at: (/* @__PURE__ */ new Date()).toISOString(),
+            instance_name: config2.instanceName,
+            host_id: diagnosticState?.host_id ?? null,
+            host_runtime_version: INFERENCE_HOST_CLI_VERSION
+          });
+          const prepared = adapterId === "exo" ? await (dependencies.prepareExoAdapter ?? prepareExoAdapter)(config2, parsed.exoRoot, cancellation.signal) : await (dependencies.prepareDurableAdapter ?? preparePortableDurableAdapter)(adapterId, config2, cancellation.signal, emitPortableDiagnostic);
           const summary = await (dependencies.runPortableDurableAdapter ?? defaultRunPortableDurableAdapter)({
             config: config2,
             credentialStore: store,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vtxmacro/cli",
-  "version": "2026.9.30",
+  "version": "2026.9.31",
   "description": "VTX Macro CLI, MCP server, and durable external inference host.",
   "type": "module",
   "license": "UNLICENSED",