@vtxmacro/cli 2026.9.34 → 2026.9.35

package/bin/vtx-service-bootstrap.js

@@ -16,7 +16,7 @@ import { fileURLToPath } from "node:url";
 // agent-cli-release.json
 var agent_cli_release_default = {
   package_name: "@vtxmacro/cli",
-  package_version: "2026.9.34",
+  package_version: "2026.9.35",
   codex_package_name: "@openai/codex",
   codex_version: "0.153.3",
   copilot_sdk_package_name: "@github/copilot-sdk",

package/bin/vtx.js

@@ -59,7 +59,7 @@ var init_define_VTX_EXO_POLICY = __esm({
 var define_VTX_GROK_POLICY_default;
 var init_define_VTX_GROK_POLICY = __esm({
   "<define:__VTX_GROK_POLICY__>"() {
-    define_VTX_GROK_POLICY_default = { subscription_proxy_base_url: "https://cli-chat-proxy.grok.com/v1", maximum_transport_request_bytes: 8388608, maximum_transport_response_bytes: 8388608 };
+    define_VTX_GROK_POLICY_default = { subscription_proxy_base_url: "https://cli-chat-proxy.grok.com/v1", maximum_transport_request_bytes: 8388608, maximum_transport_response_bytes: 8388608, effective_model_aliases: { "grok-4.5": ["grok-4.5-build"] } };
   }
 });
 
@@ -77,7 +77,7 @@ var init_agent_cli_release = __esm({
   "agent-cli-release.json"() {
     agent_cli_release_default = {
       package_name: "@vtxmacro/cli",
-      package_version: "2026.9.34",
+      package_version: "2026.9.35",
       codex_package_name: "@openai/codex",
       codex_version: "0.153.3",
       copilot_sdk_package_name: "@github/copilot-sdk",
@@ -34484,7 +34484,7 @@ var init_grok_binary = __esm({
 import { readFile as readFile6 } from "node:fs/promises";
 import { dirname as dirname7, resolve as resolve5 } from "node:path";
 import { fileURLToPath } from "node:url";
-var validateGrokPolicy, loadGrokPolicy;
+var validateGrokPolicy, grokAllowedEffectiveModels, loadGrokPolicy;
 var init_grok_policy = __esm({
   "lib/inference-host/grok-policy.ts"() {
     "use strict";
@@ -34502,12 +34502,26 @@ var init_grok_policy = __esm({
           throw new Error("Grok transport bounds are missing or invalid.");
         }
       }
+      const aliases = policy.effective_model_aliases;
+      if (!aliases || typeof aliases !== "object" || Array.isArray(aliases) || ![Object.prototype, null].includes(Object.getPrototypeOf(aliases)) || Object.keys(aliases).length > 64) throw new Error("Grok effective model aliases are missing or invalid.");
+      const validModel = (model) => typeof model === "string" && model.length > 0 && model.length <= 256 && model.trim() === model && !/[\u0000-\u001f\u007f]/u.test(model);
+      const entries = Object.entries(aliases);
+      for (const [requested, effective] of entries) {
+        if (!validModel(requested) || !Array.isArray(effective) || effective.length < 1 || effective.length > 15 || !effective.every(validModel) || new Set(effective).size !== effective.length || effective.includes(requested)) {
+          throw new Error("Grok effective model aliases are missing or invalid.");
+        }
+      }
+      const effectiveModelAliases = Object.freeze(Object.fromEntries(
+        entries.map(([requested, effective]) => [requested, Object.freeze([...effective])])
+      ));
       return Object.freeze({
         subscription_proxy_base_url: url2.href,
         maximum_transport_request_bytes: Number(policy.maximum_transport_request_bytes),
-        maximum_transport_response_bytes: Number(policy.maximum_transport_response_bytes)
+        maximum_transport_response_bytes: Number(policy.maximum_transport_response_bytes),
+        effective_model_aliases: effectiveModelAliases
       });
     };
+    grokAllowedEffectiveModels = (policy, requested) => Object.freeze([requested, ...Object.hasOwn(policy.effective_model_aliases, requested) ? policy.effective_model_aliases[requested] : []]);
     loadGrokPolicy = async () => {
       if (typeof define_VTX_GROK_POLICY_default !== "undefined") return validateGrokPolicy(define_VTX_GROK_POLICY_default);
       const config2 = parse3(await readFile6(resolve5(dirname7(fileURLToPath(import.meta.url)), "../../../config.toml"), "utf8"));
@@ -34560,6 +34574,7 @@ var init_grok_transport_proxy = __esm({
         this.requestFingerprints = /* @__PURE__ */ new Set();
         this.pending = false;
         this.closed = false;
+        this.observedModel = null;
         this.dispatched = false;
         this.responded = false;
         this.failureCode = null;
@@ -34568,6 +34583,10 @@ var init_grok_transport_proxy = __esm({
         this.toolValidationFailure = null;
         this.responseIdentityFailure = null;
         const upstream = new URL(options.upstreamBaseUrl);
+        const models = options.allowedEffectiveModels ?? [options.requestedModel];
+        if (!models.includes(options.requestedModel) || models.length > 16 || new Set(models).size !== models.length || models.some((model) => typeof model !== "string" || !model.trim())) {
+          throw new Error("grok_proxy_invalid_configuration");
+        }
         if (upstream.protocol !== "https:" || upstream.username || upstream.password || upstream.search || upstream.hash || !options.requestedModel || typeof options.expectedSystemPrompt !== "string" || !Number.isSafeInteger(options.deadlineAtMs) || options.providerDispatchNotAfterMs !== void 0 && !Number.isSafeInteger(options.providerDispatchNotAfterMs) || !Number.isSafeInteger(options.maxRequestBytes) || options.maxRequestBytes < 1 || !Number.isSafeInteger(options.maxResponseBytes) || options.maxResponseBytes < 1 || new Set(options.allowedToolNames).size !== options.allowedToolNames.length || options.allowedToolNames.some((name) => !name)) throw new Error("grok_proxy_invalid_configuration");
       }
       get baseUrl() {
@@ -34741,6 +34760,7 @@ var init_grok_transport_proxy = __esm({
             this.checkDispatch();
             this.options.onProviderDispatch?.();
             this.checkDispatch();
+            this.observedModel = null;
             this.dispatched = true;
           }
           const upstream = await (this.options.fetchImpl ?? fetch)(
@@ -34838,10 +34858,13 @@ var init_grok_transport_proxy = __esm({
           const event = record3(JSON.parse(data4));
           const native = route === "/responses" ? record3(event.response) : event;
           if (native.id !== void 0 || native.model !== void 0) {
-            if (typeof native.id !== "string" || !native.id || native.model !== this.options.requestedModel || id2 && native.id !== id2) {
+            if (typeof native.id !== "string" || !native.id || !(this.options.allowedEffectiveModels ?? [this.options.requestedModel]).includes(native.model) || id2 && native.id !== id2) {
               const idPresent = typeof native.id === "string" && native.id.length > 0;
               const modelPresent = typeof native.model === "string" && native.model.length > 0;
               const modelMatches = native.model === this.options.requestedModel;
+              if (idPresent && !modelMatches && id2 && native.id !== id2 && (this.options.allowedEffectiveModels ?? [this.options.requestedModel]).includes(native.model)) {
+                throw new Error("grok_provider_response_id_changed");
+              }
               const eventType = route === "/responses" ? event.type : event.object;
               this.responseIdentityFailure = grokResponseIdentityDiagnosticSchema.parse({
                 schema_version: "external_inference_grok_response_identity_v1",
@@ -34860,8 +34883,10 @@ var init_grok_transport_proxy = __esm({
               }
               throw new Error("grok_provider_identity_mismatch");
             }
+            if (model && native.model !== model) throw new Error("grok_provider_model_changed");
             id2 = native.id;
             model = String(native.model);
+            this.observedModel = model;
           }
           const responseEffort = native.reasoning_effort ?? record3(native.reasoning).effort;
           if (responseEffort != null && effort(responseEffort) !== effort(this.options.requestedReasoningEffort)) {
@@ -35518,11 +35543,11 @@ var init_grok_adapter = __esm({
         isDefault: state.currentModelId === model.modelId
       }];
     });
-    grokPromptUsage = (value, expectedModel) => {
+    grokPromptUsage = (value, expectedModel, allowedEffectiveModels = [expectedModel]) => {
       const usage = grokObject(value);
       if (usage.usageIsIncomplete === true) throw new Error("grok_usage_incomplete");
       const models = Object.keys(grokObject(usage.modelUsage));
-      if (models.length !== 1 || models[0] !== expectedModel) throw new Error("grok_effective_model_mismatch");
+      if (models.length !== 1 || !allowedEffectiveModels.includes(models[0])) throw new Error("grok_effective_model_mismatch");
       const inputTokens = integer2(usage.inputTokens, "input_tokens");
       const outputTokens = integer2(usage.outputTokens, "output_tokens");
       const cachedInputTokens = integer2(usage.cachedReadTokens, "cached_input_tokens");
@@ -35627,7 +35652,11 @@ var init_grok_adapter = __esm({
             throw new Error("grok_subscription_auth_unavailable");
           }
           const state = unwrap(await session.request("_x.ai/models/list", {}, deadline, signal));
-          const capabilities = grokModelCapabilities(state);
+          const policy = this.options.policy ?? await loadGrokPolicy();
+          const capabilities = grokModelCapabilities(state).map((capability) => ({
+            ...capability,
+            allowedEffectiveModels: grokAllowedEffectiveModels(policy, capability.model)
+          }));
           if (!capabilities.length) throw new Error("grok_model_catalog_empty");
           const identity = typeof auth.principalId === "string" && auth.principalId ? auth.principalId : typeof auth.email === "string" && auth.email ? auth.email.toLowerCase() : null;
           if (!identity) throw new Error("grok_account_identity_required");
@@ -35672,6 +35701,7 @@ var init_grok_adapter = __esm({
         const startedAt = Date.now();
         const binary = await this.binary();
         const policy = this.options.policy ?? await loadGrokPolicy();
+        const allowedEffectiveModels = grokAllowedEffectiveModels(policy, input.requestedModel);
         input.signal.throwIfAborted();
         const workspace = agent?.durableThread ? await validateGrokOwnedThread(this.stateOptions, agent.durableThread) : await createGrokOwnedWorkspace(this.stateOptions, agent ? "agent" : "attempt");
         let mcp = null;
@@ -35681,6 +35711,7 @@ var init_grok_adapter = __esm({
         let retained = Boolean(agent?.durableThread);
         let thought = "";
         let firstToken = null;
+        let activeThread = null;
         try {
           input.signal.throwIfAborted();
           const evidence = [];
@@ -35707,6 +35738,12 @@ var init_grok_adapter = __esm({
             } }
           ] : [];
           mcp = agent ? await createGrokToolServer({ tools, signal: input.signal, execute: async (name, args) => {
+            const observedModel = proxy?.observedModel;
+            if (!activeThread || !observedModel) throw new Error("grok_tool_provenance_missing");
+            if (activeThread.effectiveModel !== observedModel) {
+              activeThread = { ...activeThread, effectiveModel: observedModel };
+              await agent.onThreadReady?.(activeThread);
+            }
             const callId = randomUUID5();
             const tool = name;
             const result3 = await agent.executeTool({ callId, tool, arguments: args });
@@ -35720,6 +35757,7 @@ var init_grok_adapter = __esm({
             expectedSystemPrompt: input.systemPrompt,
             requestedModel: input.requestedModel,
             requestedReasoningEffort: input.requestedReasoningEffort,
+            allowedEffectiveModels,
             allowedToolNames: agent ? ["search_tool", "use_tool"] : [],
             deadlineAtMs: input.deadlineAtMs,
             providerDispatchNotAfterMs: provider?.providerDispatchNotAfterMs,
@@ -35790,6 +35828,7 @@ var init_grok_adapter = __esm({
             effectiveModel: input.requestedModel,
             effectiveReasoningEffort: input.requestedReasoningEffort
           };
+          activeThread = thread;
           if (agent) {
             await agent.onThreadReady?.(thread);
             retained = true;
@@ -35814,15 +35853,17 @@ var init_grok_adapter = __esm({
           if (meta3.structuredOutputError || meta3.structuredOutput === void 0) throw new Error("grok_structured_output_missing");
           const text = JSON.stringify(meta3.structuredOutput);
           if (Buffer.byteLength(text) > 3e5) throw new Error("grok_result_too_large");
-          const usage = grokPromptUsage(meta3.usage, input.requestedModel);
+          const usage = grokPromptUsage(meta3.usage, input.requestedModel, allowedEffectiveModels);
           const actualModel = Object.keys(grokObject(grokObject(meta3.usage).modelUsage))[0];
           if (!proxy.dispatched || !proxy.responded || proxy.terminalFailure) throw new Error(proxy.failureCode ?? "grok_transport_receipt_missing");
           const receipts = proxy.receipts;
           if (!receipts.length || proxy.pendingRequest || receipts.some((receipt) => receipt.model !== actualModel || receipt.requestedReasoningEffort !== input.requestedReasoningEffort || receipt.input === null || receipt.output === null || receipt.cachedInput === null) || receipts.reduce((sum, receipt) => sum + receipt.input, 0) !== usage.inputTokens || receipts.reduce((sum, receipt) => sum + receipt.output, 0) !== usage.outputTokens || receipts.reduce((sum, receipt) => sum + receipt.cachedInput, 0) !== usage.cachedInputTokens || integer2(grokObject(meta3.usage).modelCalls, "model_calls") !== receipts.length) {
             throw new Error("grok_transport_usage_mismatch");
           }
+          const effectiveThread = { ...thread, effectiveModel: actualModel };
+          if (agent && activeThread.effectiveModel !== actualModel) await agent.onThreadReady?.(effectiveThread);
           provider?.onTerminalDispatchOutcome?.("confirmed_dispatched");
-          return { thread, turn: {
+          return { thread: effectiveThread, turn: {
             text,
             reasoningContent: thought || null,
             reasoningSummary: null,
@@ -37400,7 +37441,7 @@ var init_runner = __esm({
         supported_control_modes: [...supportedControlModes],
         allowed_model_identities: [{
           requested_model: capability.model,
-          effective_models: [capability.model]
+          effective_models: [...capability.allowedEffectiveModels ?? [capability.model]]
         }],
         structured_output: structuredOutput,
         same_attempt_recovery: sameAttemptRecovery,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vtxmacro/cli",
-  "version": "2026.9.34",
+  "version": "2026.9.35",
   "description": "VTX Macro CLI, MCP server, and durable external inference host.",
   "type": "module",
   "license": "UNLICENSED",