llm-cli-gateway 1.0.1 → 1.4.0

package/dist/index.js

@@ -11,15 +11,18 @@ import { parseStreamJson } from "./stream-json-parser.js";
 import { createSessionManager } from "./session-manager.js";
 import { ResourceProvider } from "./resources.js";
 import { PerformanceMetrics } from "./metrics.js";
-import { estimateTokens, optimizePrompt as optimizePromptText, optimizeResponse as optimizeResponseText } from "./optimizer.js";
+import { estimateTokens, optimizePrompt as optimizePromptText, optimizeResponse as optimizeResponseText, } from "./optimizer.js";
 import { loadConfig } from "./config.js";
 import { checkHealth } from "./health.js";
 import { getCliInfo, resolveModelAlias } from "./model-registry.js";
 import { AsyncJobManager } from "./async-job-manager.js";
+import { JobStore, resolveJobStoreDbPath } from "./job-store.js";
 import { ApprovalManager } from "./approval-manager.js";
 import { checkReviewIntegrity } from "./review-integrity.js";
-import { buildClaudeMcpConfig, CLAUDE_MCP_SERVER_NAMES } from "./claude-mcp-config.js";
-import { resolveSessionResumeArgs, GATEWAY_SESSION_PREFIX } from "./request-helpers.js";
+import { buildClaudeMcpConfig, CLAUDE_MCP_SERVER_NAMES, } from "./claude-mcp-config.js";
+import { resolveSessionResumeArgs, resolveGrokSessionArgs, resolveCodexSessionArgs, sanitizeCliArgValues, GATEWAY_SESSION_PREFIX, } from "./request-helpers.js";
+import { createFlightRecorder } from "./flight-recorder.js";
+import { getCliVersions, runCliUpgrade } from "./cli-updater.js";
 // Simple logger that writes to stderr (stdout is used for MCP protocol)
 const logger = {
     info: (message, ...args) => {
@@ -32,7 +35,7 @@ const logger = {
         if (process.env.DEBUG) {
             console.error(`[DEBUG] ${new Date().toISOString()} - ${message}`, ...args);
         }
-    }
+    },
 };
 function logOptimizationTokens(kind, correlationId, original, optimized) {
     const originalTokens = estimateTokens(original);
@@ -87,14 +90,14 @@ const loadedSkills = loadSkills();
 // system prompt at connection time. Covers key patterns + pointers to L2 resources.
 const SERVER_INSTRUCTIONS = `llm-cli-gateway: Multi-LLM orchestration via MCP.
 
-Tools: claude_request, codex_request, gemini_request (sync) | *_request_async (async)
+Tools: claude_request, codex_request, gemini_request, grok_request (sync) | *_request_async (async)
 Jobs: llm_job_status, llm_job_result, llm_job_cancel
 Sessions: session_create, session_list, session_set_active, session_get, session_delete, session_clear_all
-Other: list_models, approval_list, llm_process_health
+Other: list_models, cli_versions, cli_upgrade, approval_list, llm_process_health
 
 Key behaviors:
 - Sync auto-defers at ${SYNC_DEADLINE_MS}ms. Poll deferred jobs via llm_job_status/llm_job_result.
-- Sessions: Claude --continue, Gemini --resume (real CLI continuity). Codex bookkeeping only.
+- Sessions: Claude --continue, Gemini --resume, Grok --resume/--continue, Codex \`exec resume <ID>\` / \`exec resume --last\` (all real CLI continuity). For Codex, sessionId must be a real Codex UUID (from ~/.codex/sessions/); gateway-generated gw-* IDs are rejected.
 - Approval gates: opt-in via approvalStrategy:"mcp_managed".
 - Idle timeout kills stuck processes (default 10min, configurable via idleTimeoutMs).
 
@@ -106,9 +109,27 @@ let sessionManager;
 let db = null;
 const performanceMetrics = new PerformanceMetrics();
 let resourceProvider;
+const flightRecorder = createFlightRecorder(logger);
+// Durable job store: persists every async job to ~/.llm-cli-gateway/logs.db so callers
+// can collect results across long polling gaps and gateway restarts, and so repeated
+// identical requests dedup onto the running/completed job instead of starting over.
+const jobStore = (() => {
+    const dbPath = resolveJobStoreDbPath();
+    if (!dbPath) {
+        logger.info("Durable job store disabled (LLM_GATEWAY_LOGS_DB=none)");
+        return null;
+    }
+    try {
+        return new JobStore(dbPath, logger);
+    }
+    catch (err) {
+        logger.error("Failed to open durable job store; continuing in-memory only", err);
+        return null;
+    }
+})();
 const asyncJobManager = new AsyncJobManager(logger, (cli, durationMs, success) => {
     performanceMetrics.recordRequest(cli, durationMs, success);
-});
+}, jobStore);
 const approvalManager = new ApprovalManager(undefined, logger);
 const MCP_SERVER_ENUM = z.enum(CLAUDE_MCP_SERVER_NAMES);
 // Per-CLI idle timeouts: kill process if no stdout/stderr activity for this duration.
@@ -118,6 +139,7 @@ const CLI_IDLE_TIMEOUTS = {
     claude: 600_000, // 10 minutes — only used when outputFormat=stream-json
     codex: 600_000, // 10 minutes — Codex streams stderr progress
     gemini: 600_000, // 10 minutes — Gemini streams stdout in real-time
+    grok: 600_000, // 10 minutes — Grok streams stderr/stdout activity in headless mode
 };
 function resolveIdleTimeout(cli, override) {
     if (override !== undefined)
@@ -129,12 +151,21 @@ const SYNC_POLL_INTERVAL_MS = 1_000;
  * Start an async job and poll until completion or deadline.
  * Returns the job result if it finishes in time, or a deferral marker.
  */
-async function awaitJobOrDefer(cli, args, corrId, idleTimeoutMs, outputFormat) {
+async function awaitJobOrDefer(cli, args, corrId, idleTimeoutMs, outputFormat, forceRefresh) {
     if (SYNC_DEADLINE_MS === 0) {
-        // Disabled — fall through to direct execution
+        // Disabled — fall through to direct execution.
+        // Note: direct execution bypasses dedup. forceRefresh is implied.
         return executeCli(cli, args, { idleTimeout: idleTimeoutMs, logger });
     }
-    const job = asyncJobManager.startJob(cli, args, corrId, undefined, idleTimeoutMs, outputFormat);
+    const outcome = asyncJobManager.startJobWithDedup(cli, args, corrId, {
+        idleTimeoutMs,
+        outputFormat,
+        forceRefresh,
+    });
+    const job = outcome.snapshot;
+    if (outcome.deduped) {
+        logger.info(`[${corrId}] sync request deduped onto running job ${job.id} (original corrId=${outcome.originalCorrelationId})`);
+    }
     const deadline = Date.now() + SYNC_DEADLINE_MS;
     while (Date.now() < deadline) {
         const snapshot = asyncJobManager.getJobSnapshot(job.id);
@@ -147,7 +178,7 @@ async function awaitJobOrDefer(cli, args, corrId, idleTimeoutMs, outputFormat) {
             return {
                 stdout: result.stdout,
                 stderr: result.stderr,
-                code: result.exitCode ?? 1
+                code: result.exitCode ?? 1,
             };
         }
         await new Promise(resolve => setTimeout(resolve, SYNC_POLL_INTERVAL_MS));
@@ -159,7 +190,7 @@ async function awaitJobOrDefer(cli, args, corrId, idleTimeoutMs, outputFormat) {
         jobId: job.id,
         cli,
         correlationId: corrId,
-        message: `Execution exceeded sync deadline (${SYNC_DEADLINE_MS}ms). Poll with llm_job_status, fetch with llm_job_result.`
+        message: `Execution exceeded sync deadline (${SYNC_DEADLINE_MS}ms). Poll with llm_job_status, fetch with llm_job_result.`,
     };
 }
 function isDeferredResponse(result) {
@@ -167,7 +198,8 @@ function isDeferredResponse(result) {
 }
 function buildDeferredToolResponse(deferred, sessionId) {
     return {
-        content: [{
+        content: [
+            {
                 type: "text",
                 text: JSON.stringify({
                     status: "deferred",
@@ -178,9 +210,10 @@ function buildDeferredToolResponse(deferred, sessionId) {
                     sessionId: sessionId || null,
                     pollWith: "llm_job_status",
                     fetchWith: "llm_job_result",
-                    cancelWith: "llm_job_cancel"
-                }, null, 2)
-            }]
+                    cancelWith: "llm_job_cancel",
+                }, null, 2),
+            },
+        ],
     };
 }
 // Helper function for standardized error responses
@@ -211,20 +244,61 @@ function createErrorResponse(cli, code, stderr, correlationId, error) {
     }
     return {
         content: [{ type: "text", text: errorMessage }],
-        isError: true
+        isError: true,
+        structuredContent: {
+            correlationId: correlationId || null,
+            cli,
+            exitCode: code,
+            errorCategory: code === 124
+                ? "timeout"
+                : code === 125
+                    ? "idle_timeout"
+                    : error
+                        ? "spawn_error"
+                        : "cli_error",
+        },
     };
 }
+function extractUsageAndCost(cli, output, outputFormat) {
+    if (cli === "claude" && outputFormat === "stream-json") {
+        const parsed = parseStreamJson(output);
+        return {
+            inputTokens: parsed.usage?.inputTokens,
+            outputTokens: parsed.usage?.outputTokens,
+            costUsd: parsed.costUsd ?? undefined,
+        };
+    }
+    return {};
+}
+function safeFlightStart(entry) {
+    try {
+        flightRecorder.logStart(entry);
+    }
+    catch (error) {
+        logger.error("Flight recorder logStart failed", error);
+    }
+}
+function safeFlightComplete(correlationId, result) {
+    try {
+        flightRecorder.logComplete(correlationId, result);
+    }
+    catch (error) {
+        logger.error("Flight recorder logComplete failed", error);
+    }
+}
 function createApprovalDeniedResponse(operation, decision) {
     return {
-        content: [{
+        content: [
+            {
                 type: "text",
                 text: JSON.stringify({
                     success: false,
                     error: `${operation} denied by MCP-managed approval policy`,
-                    approval: decision
-                }, null, 2)
-            }],
-        isError: true
+                    approval: decision,
+                }, null, 2),
+            },
+        ],
+        isError: true,
     };
 }
 function normalizeMcpServers(mcpServers) {
@@ -235,7 +309,8 @@ function normalizeMcpServers(mcpServers) {
 }
 function createMcpConfigErrorResponse(operation, correlationId, requested, message, missing = []) {
     return {
-        content: [{
+        content: [
+            {
                 type: "text",
                 text: JSON.stringify({
                     success: false,
@@ -244,11 +319,12 @@ function createMcpConfigErrorResponse(operation, correlationId, requested, messa
                     correlationId,
                     mcpServers: {
                         requested,
-                        missing
-                    }
-                }, null, 2)
-            }],
-        isError: true
+                        missing,
+                    },
+                }, null, 2),
+            },
+        ],
+        isError: true,
     };
 }
 function resolveClaudeMcpConfig(operation, correlationId, requestedMcpServers, strictMcpConfig) {
@@ -260,13 +336,13 @@ function resolveClaudeMcpConfig(operation, correlationId, requestedMcpServers, s
         const message = error instanceof Error ? error.message : String(error);
         logger.error(`[${correlationId}] ${operation} failed to build Claude MCP config: ${message}`);
         return {
-            errorResponse: createMcpConfigErrorResponse(operation, correlationId, requestedMcpServers, message)
+            errorResponse: createMcpConfigErrorResponse(operation, correlationId, requestedMcpServers, message),
         };
     }
     if (strictMcpConfig && mcpConfig.missing.length > 0) {
         const missing = mcpConfig.missing.join(", ");
         return {
-            errorResponse: createMcpConfigErrorResponse(operation, correlationId, requestedMcpServers, `strictMcpConfig=true but requested servers are unavailable: ${missing}`, mcpConfig.missing)
+            errorResponse: createMcpConfigErrorResponse(operation, correlationId, requestedMcpServers, `strictMcpConfig=true but requested servers are unavailable: ${missing}`, mcpConfig.missing),
         };
     }
     return { config: mcpConfig };
@@ -279,13 +355,15 @@ for (const skill of loadedSkills) {
     server.registerResource(`skill-${skill.name}`, `skills://${skill.name}`, {
         title: skill.name,
         description: skill.description,
-        mimeType: "text/markdown"
+        mimeType: "text/markdown",
     }, async () => ({
-        contents: [{
+        contents: [
+            {
                 uri: `skills://${skill.name}`,
                 mimeType: "text/markdown",
-                text: skill.content
-            }]
+                text: skill.content,
+            },
+        ],
     }));
 }
 logger.info(`Registered ${loadedSkills.length} skill resources`);
@@ -293,7 +371,7 @@ logger.info(`Registered ${loadedSkills.length} skill resources`);
 server.registerResource("all-sessions", "sessions://all", {
     title: "📋 All Sessions",
     description: "All conversation sessions across CLIs",
-    mimeType: "application/json"
+    mimeType: "application/json",
 }, async (uri) => {
     logger.debug("Reading all sessions resource");
     const contents = await resourceProvider.readResource(uri.href);
@@ -303,7 +381,7 @@ server.registerResource("all-sessions", "sessions://all", {
 server.registerResource("claude-sessions", "sessions://claude", {
     title: "🤖 Claude Sessions",
     description: "Claude conversation sessions",
-    mimeType: "application/json"
+    mimeType: "application/json",
 }, async (uri) => {
     logger.debug("Reading Claude sessions resource");
     const contents = await resourceProvider.readResource(uri.href);
@@ -313,7 +391,7 @@ server.registerResource("claude-sessions", "sessions://claude", {
 server.registerResource("codex-sessions", "sessions://codex", {
     title: "💻 Codex Sessions",
     description: "Codex conversation sessions",
-    mimeType: "application/json"
+    mimeType: "application/json",
 }, async (uri) => {
     logger.debug("Reading Codex sessions resource");
     const contents = await resourceProvider.readResource(uri.href);
@@ -323,17 +401,27 @@ server.registerResource("codex-sessions", "sessions://codex", {
 server.registerResource("gemini-sessions", "sessions://gemini", {
     title: "✨ Gemini Sessions",
     description: "Gemini conversation sessions",
-    mimeType: "application/json"
+    mimeType: "application/json",
 }, async (uri) => {
     logger.debug("Reading Gemini sessions resource");
     const contents = await resourceProvider.readResource(uri.href);
     return { contents: contents ? [contents] : [] };
 });
+// Register Grok sessions resource
+server.registerResource("grok-sessions", "sessions://grok", {
+    title: "⚡ Grok Sessions",
+    description: "Grok conversation sessions",
+    mimeType: "application/json",
+}, async (uri) => {
+    logger.debug("Reading Grok sessions resource");
+    const contents = await resourceProvider.readResource(uri.href);
+    return { contents: contents ? [contents] : [] };
+});
 // Register Claude models resource
 server.registerResource("claude-models", "models://claude", {
     title: "🧠 Claude Models",
     description: "Claude models and capabilities",
-    mimeType: "application/json"
+    mimeType: "application/json",
 }, async (uri) => {
     logger.debug("Reading Claude models resource");
     const contents = await resourceProvider.readResource(uri.href);
@@ -343,7 +431,7 @@ server.registerResource("claude-models", "models://claude", {
 server.registerResource("codex-models", "models://codex", {
     title: "🔧 Codex Models",
     description: "Codex models and capabilities",
-    mimeType: "application/json"
+    mimeType: "application/json",
 }, async (uri) => {
     logger.debug("Reading Codex models resource");
     const contents = await resourceProvider.readResource(uri.href);
@@ -353,17 +441,27 @@ server.registerResource("codex-models", "models://codex", {
 server.registerResource("gemini-models", "models://gemini", {
     title: "🌟 Gemini Models",
     description: "Gemini models and capabilities",
-    mimeType: "application/json"
+    mimeType: "application/json",
 }, async (uri) => {
     logger.debug("Reading Gemini models resource");
     const contents = await resourceProvider.readResource(uri.href);
     return { contents: contents ? [contents] : [] };
 });
+// Register Grok models resource
+server.registerResource("grok-models", "models://grok", {
+    title: "⚡ Grok Models",
+    description: "Grok models and capabilities",
+    mimeType: "application/json",
+}, async (uri) => {
+    logger.debug("Reading Grok models resource");
+    const contents = await resourceProvider.readResource(uri.href);
+    return { contents: contents ? [contents] : [] };
+});
 // Register performance metrics resource
 server.registerResource("performance-metrics", "metrics://performance", {
     title: "📈 Performance Metrics",
     description: "Request counts, latency, success/failure rates",
-    mimeType: "application/json"
+    mimeType: "application/json",
 }, async (uri) => {
     logger.debug("Reading performance metrics resource");
     const contents = await resourceProvider.readResource(uri.href);
@@ -374,10 +472,16 @@ function prepareClaudeRequest(params) {
     const cliInfo = getCliInfo();
     const resolvedModel = resolveModelAlias("claude", params.model, cliInfo);
     // Review integrity check on raw prompt (before optimization)
-    const reviewIntegrity = checkReviewIntegrity({ prompt: params.prompt, allowedTools: params.allowedTools, disallowedTools: params.disallowedTools });
+    const reviewIntegrity = checkReviewIntegrity({
+        prompt: params.prompt,
+        allowedTools: params.allowedTools,
+        disallowedTools: params.disallowedTools,
+    });
     if (reviewIntegrity.violations.length > 0) {
         logger.info(`[${corrId}] Review integrity violations detected: ${reviewIntegrity.violations.map(v => v.type).join(", ")}`, {
-            cli: "claude", operation: params.operation, score: reviewIntegrity.totalScore
+            cli: "claude",
+            operation: params.operation,
+            score: reviewIntegrity.totalScore,
         });
     }
     let effectivePrompt = params.prompt;
@@ -405,7 +509,7 @@ function prepareClaudeRequest(params) {
             disallowedTools: params.disallowedTools,
             policy: params.approvalPolicy,
             metadata: { model: resolvedModel || "default", strictMcpConfig: params.strictMcpConfig },
-            reviewIntegrity
+            reviewIntegrity,
         });
         if (approvalDecision.status !== "approved") {
             return createApprovalDeniedResponse(params.operation, approvalDecision);
@@ -421,9 +525,11 @@ function prepareClaudeRequest(params) {
         args.push("--output-format", "stream-json", "--include-partial-messages");
     }
     if (params.allowedTools && params.allowedTools.length > 0) {
+        sanitizeCliArgValues(params.allowedTools, "allowedTools");
         args.push("--allowed-tools", ...params.allowedTools);
     }
     if (params.disallowedTools && params.disallowedTools.length > 0) {
+        sanitizeCliArgValues(params.disallowedTools, "disallowedTools");
         args.push("--disallowed-tools", ...params.disallowedTools);
     }
     if (params.approvalStrategy === "mcp_managed") {
@@ -438,7 +544,16 @@ function prepareClaudeRequest(params) {
             args.push("--strict-mcp-config");
         }
     }
-    return { corrId, effectivePrompt, resolvedModel, requestedMcpServers, mcpConfig, approvalDecision, reviewIntegrity, args };
+    return {
+        corrId,
+        effectivePrompt,
+        resolvedModel,
+        requestedMcpServers,
+        mcpConfig,
+        approvalDecision,
+        reviewIntegrity,
+        args,
+    };
 }
 function prepareCodexRequest(params) {
     const corrId = params.correlationId || randomUUID();
@@ -448,7 +563,9 @@ function prepareCodexRequest(params) {
     const reviewIntegrity = checkReviewIntegrity({ prompt: params.prompt });
     if (reviewIntegrity.violations.length > 0) {
         logger.info(`[${corrId}] Review integrity violations detected: ${reviewIntegrity.violations.map(v => v.type).join(", ")}`, {
-            cli: "codex", operation: params.operation, score: reviewIntegrity.totalScore
+            cli: "codex",
+            operation: params.operation,
+            score: reviewIntegrity.totalScore,
         });
     }
     let effectivePrompt = params.prompt;
@@ -469,32 +586,70 @@ function prepareCodexRequest(params) {
             requestedMcpServers,
             policy: params.approvalPolicy,
             metadata: { model: resolvedModel || "default" },
-            reviewIntegrity
+            reviewIntegrity,
         });
         if (approvalDecision.status !== "approved") {
             return createApprovalDeniedResponse(params.operation, approvalDecision);
         }
     }
+    // Resume mode: codex exec resume <SESSION_ID|--last> [flags] PROMPT
+    // Note: `codex exec resume` does NOT accept `--full-auto`; the original
+    // session's approval policy is inherited. We silently drop fullAuto on resume.
+    let sessionPlan;
+    try {
+        sessionPlan = resolveCodexSessionArgs({
+            sessionId: params.sessionId,
+            resumeLatest: params.resumeLatest,
+            createNewSession: params.createNewSession,
+        });
+    }
+    catch (err) {
+        return createErrorResponse(params.operation, 1, "", corrId, err);
+    }
     const args = ["exec"];
+    if (sessionPlan.mode !== "new") {
+        args.push("resume");
+        if (sessionPlan.mode === "resume-latest") {
+            args.push("--last");
+        }
+    }
     if (resolvedModel)
         args.push("--model", resolvedModel);
-    if (params.fullAuto)
+    if (sessionPlan.mode === "new" && params.fullAuto) {
         args.push("--full-auto");
+    }
     if (params.dangerouslyBypassApprovalsAndSandbox) {
         args.push("--dangerously-bypass-approvals-and-sandbox");
     }
-    args.push("--skip-git-repo-check", effectivePrompt);
-    return { corrId, effectivePrompt, resolvedModel, requestedMcpServers, approvalDecision, reviewIntegrity, args };
+    args.push("--skip-git-repo-check");
+    if (sessionPlan.mode === "resume-by-id" && sessionPlan.sessionId) {
+        args.push(sessionPlan.sessionId);
+    }
+    args.push(effectivePrompt);
+    return {
+        corrId,
+        effectivePrompt,
+        resolvedModel,
+        requestedMcpServers,
+        approvalDecision,
+        reviewIntegrity,
+        args,
+    };
 }
 function prepareGeminiRequest(params) {
     const corrId = params.correlationId || randomUUID();
     const cliInfo = getCliInfo();
     const resolvedModel = resolveModelAlias("gemini", params.model, cliInfo);
     // Review integrity check on raw prompt (before optimization)
-    const reviewIntegrity = checkReviewIntegrity({ prompt: params.prompt, allowedTools: params.allowedTools });
+    const reviewIntegrity = checkReviewIntegrity({
+        prompt: params.prompt,
+        allowedTools: params.allowedTools,
+    });
     if (reviewIntegrity.violations.length > 0) {
         logger.info(`[${corrId}] Review integrity violations detected: ${reviewIntegrity.violations.map(v => v.type).join(", ")}`, {
-            cli: "gemini", operation: params.operation, score: reviewIntegrity.totalScore
+            cli: "gemini",
+            operation: params.operation,
+            score: reviewIntegrity.totalScore,
         });
     }
     let effectivePrompt = params.prompt;
@@ -516,7 +671,7 @@ function prepareGeminiRequest(params) {
             allowedTools: params.allowedTools,
             policy: params.approvalPolicy,
             metadata: { model: resolvedModel || "default" },
-            reviewIntegrity
+            reviewIntegrity,
         });
         if (approvalDecision.status !== "approved") {
             return createApprovalDeniedResponse(params.operation, approvalDecision);
@@ -529,17 +684,103 @@ function prepareGeminiRequest(params) {
     if (effectiveApprovalMode)
         args.push("--approval-mode", effectiveApprovalMode);
     if (params.allowedTools && params.allowedTools.length > 0) {
+        sanitizeCliArgValues(params.allowedTools, "allowedTools");
         params.allowedTools.forEach(tool => args.push("--allowed-tools", tool));
     }
     if (requestedMcpServers.length > 0) {
+        sanitizeCliArgValues(requestedMcpServers, "mcpServers");
         requestedMcpServers.forEach(serverName => args.push("--allowed-mcp-server-names", serverName));
     }
     if (params.includeDirs && params.includeDirs.length > 0) {
+        sanitizeCliArgValues(params.includeDirs, "includeDirs");
         params.includeDirs.forEach(dir => args.push("--include-directories", dir));
     }
-    return { corrId, effectivePrompt, resolvedModel, requestedMcpServers, approvalDecision, reviewIntegrity, args };
+    return {
+        corrId,
+        effectivePrompt,
+        resolvedModel,
+        requestedMcpServers,
+        approvalDecision,
+        reviewIntegrity,
+        args,
+    };
+}
+function prepareGrokRequest(params) {
+    const corrId = params.correlationId || randomUUID();
+    const cliInfo = getCliInfo();
+    const resolvedModel = resolveModelAlias("grok", params.model, cliInfo);
+    // Review integrity check on raw prompt (before optimization)
+    const reviewIntegrity = checkReviewIntegrity({
+        prompt: params.prompt,
+        allowedTools: params.allowedTools,
+        disallowedTools: params.disallowedTools,
+    });
+    if (reviewIntegrity.violations.length > 0) {
+        logger.info(`[${corrId}] Review integrity violations detected: ${reviewIntegrity.violations.map(v => v.type).join(", ")}`, {
+            cli: "grok",
+            operation: params.operation,
+            score: reviewIntegrity.totalScore,
+        });
+    }
+    let effectivePrompt = params.prompt;
+    if (params.optimizePrompt) {
+        const optimized = optimizePromptText(effectivePrompt);
+        logOptimizationTokens("prompt", corrId, effectivePrompt, optimized);
+        effectivePrompt = optimized;
+    }
+    const requestedMcpServers = normalizeMcpServers(params.mcpServers);
+    let approvalDecision = null;
+    if (params.approvalStrategy === "mcp_managed") {
+        approvalDecision = approvalManager.decide({
+            cli: "grok",
+            operation: params.operation,
+            prompt: params.prompt, // Use raw prompt for review-context detection, not optimized
+            bypassRequested: Boolean(params.alwaysApprove) || params.permissionMode === "bypassPermissions",
+            fullAuto: false,
+            requestedMcpServers,
+            allowedTools: params.allowedTools,
+            disallowedTools: params.disallowedTools,
+            policy: params.approvalPolicy,
+            metadata: { model: resolvedModel || "default" },
+            reviewIntegrity,
+        });
+        if (approvalDecision.status !== "approved") {
+            return createApprovalDeniedResponse(params.operation, approvalDecision);
+        }
+    }
+    const effectiveAlwaysApprove = params.approvalStrategy === "mcp_managed" ? true : Boolean(params.alwaysApprove);
+    const args = ["-p", effectivePrompt];
+    if (resolvedModel)
+        args.push("--model", resolvedModel);
+    if (params.outputFormat)
+        args.push("--output-format", params.outputFormat);
+    if (effectiveAlwaysApprove) {
+        args.push("--always-approve");
+    }
+    else if (params.permissionMode) {
+        args.push("--permission-mode", params.permissionMode);
+    }
+    if (params.effort)
+        args.push("--effort", params.effort);
+    if (params.reasoningEffort)
+        args.push("--reasoning-effort", params.reasoningEffort);
+    if (params.allowedTools && params.allowedTools.length > 0) {
+        args.push("--tools", params.allowedTools.join(","));
+    }
+    if (params.disallowedTools && params.disallowedTools.length > 0) {
+        args.push("--disallowed-tools", params.disallowedTools.join(","));
+    }
+    return {
+        corrId,
+        effectivePrompt,
+        resolvedModel,
+        requestedMcpServers,
+        approvalDecision,
+        reviewIntegrity,
+        args,
+    };
 }
-function buildCliResponse(stdout, optimizeResponse, corrId, sessionId, prep, resumable, outputFormat) {
+function buildCliResponse(cli, stdout, optimizeResponse, corrId, sessionId, prep, durationMs, resumable, outputFormat) {
     let finalStdout = stdout;
     // Skip response optimization for JSON output to prevent corrupting structured data
     if (optimizeResponse && outputFormat !== "json") {
@@ -548,7 +789,9 @@ function buildCliResponse(stdout, optimizeResponse, corrId, sessionId, prep, res
         finalStdout = optimized;
     }
     // Append review integrity warnings to response text (skip for JSON output to avoid corruption)
-    if (prep.reviewIntegrity && prep.reviewIntegrity.violations.length > 0 && outputFormat !== "json") {
+    if (prep.reviewIntegrity &&
+        prep.reviewIntegrity.violations.length > 0 &&
+        outputFormat !== "json") {
         const warnings = prep.reviewIntegrity.violations
             .map(v => `- [${v.type}] ${v.detail}`)
             .join("\n");
@@ -556,9 +799,23 @@ function buildCliResponse(stdout, optimizeResponse, corrId, sessionId, prep, res
     }
     const response = {
         content: [{ type: "text", text: finalStdout }],
+        structuredContent: {
+            model: prep.resolvedModel || "default",
+            cli,
+            correlationId: corrId,
+            sessionId: sessionId || null,
+            durationMs,
+            ...extractUsageAndCost(cli, stdout, outputFormat),
+            exitCode: 0,
+            retryCount: 0,
+        },
         mcpServers: prep.mcpConfig
-            ? { requested: prep.requestedMcpServers, enabled: prep.mcpConfig.enabled, missing: prep.mcpConfig.missing }
-            : { requested: prep.requestedMcpServers }
+            ? {
+                requested: prep.requestedMcpServers,
+                enabled: prep.mcpConfig.enabled,
+                missing: prep.mcpConfig.missing,
+            }
+            : { requested: prep.requestedMcpServers },
     };
     if (sessionId) {
         response.sessionId = sessionId;
@@ -577,25 +834,40 @@ function buildCliResponse(stdout, optimizeResponse, corrId, sessionId, prep, res
 export async function handleGeminiRequest(deps, params) {
     const startTime = Date.now();
     const prep = prepareGeminiRequest({
-        prompt: params.prompt, model: params.model, approvalMode: params.approvalMode,
-        approvalStrategy: params.approvalStrategy, approvalPolicy: params.approvalPolicy,
-        allowedTools: params.allowedTools, includeDirs: params.includeDirs,
-        mcpServers: params.mcpServers, correlationId: params.correlationId,
-        optimizePrompt: params.optimizePrompt, operation: "gemini_request"
+        prompt: params.prompt,
+        model: params.model,
+        approvalMode: params.approvalMode,
+        approvalStrategy: params.approvalStrategy,
+        approvalPolicy: params.approvalPolicy,
+        allowedTools: params.allowedTools,
+        includeDirs: params.includeDirs,
+        mcpServers: params.mcpServers,
+        correlationId: params.correlationId,
+        optimizePrompt: params.optimizePrompt,
+        operation: "gemini_request",
     });
     if (!("args" in prep))
         return prep;
     const { corrId, args } = prep;
     let durationMs = 0;
     let wasSuccessful = false;
+    safeFlightStart({
+        correlationId: corrId,
+        cli: "gemini",
+        model: prep.resolvedModel || "default",
+        prompt: params.prompt,
+        sessionId: params.sessionId,
+    });
     deps.logger.info(`[${corrId}] gemini_request invoked with model=${prep.resolvedModel || "default"}, approvalMode=${params.approvalMode}, prompt length=${params.prompt.length}`);
     try {
         // Session arg planning (pure, no I/O)
         const sessionResult = resolveSessionResumeArgs({
-            sessionId: params.sessionId, resumeLatest: params.resumeLatest, createNewSession: params.createNewSession
+            sessionId: params.sessionId,
+            resumeLatest: params.resumeLatest,
+            createNewSession: params.createNewSession,
         });
         args.push(...sessionResult.resumeArgs);
-        const result = await awaitJobOrDefer("gemini", args, corrId, resolveIdleTimeout("gemini", params.idleTimeoutMs));
+        const result = await awaitJobOrDefer("gemini", args, corrId, resolveIdleTimeout("gemini", params.idleTimeoutMs), undefined, params.forceRefresh);
         // Deferred — job still running, return async reference
         if (isDeferredResponse(result)) {
             return buildDeferredToolResponse(result, sessionResult.effectiveSessionId);
@@ -604,6 +876,16 @@ export async function handleGeminiRequest(deps, params) {
         durationMs = Math.max(0, Date.now() - startTime);
         if (code !== 0) {
             deps.logger.info(`[${corrId}] gemini_request failed in ${durationMs}ms`);
+            safeFlightComplete(corrId, {
+                response: stderr || "",
+                durationMs,
+                retryCount: 0,
+                circuitBreakerState: "closed",
+                optimizationApplied: false,
+                exitCode: code,
+                errorMessage: stderr || `Exit code ${code}`,
+                status: "failed",
+            });
             return createErrorResponse("gemini", code, stderr, corrId);
         }
         wasSuccessful = true;
@@ -628,11 +910,32 @@ export async function handleGeminiRequest(deps, params) {
             effectiveSessionId = newSession.id;
         }
         deps.logger.info(`[${corrId}] gemini_request completed successfully in ${durationMs}ms`);
-        return buildCliResponse(stdout, params.optimizeResponse ?? false, corrId, effectiveSessionId, prep, sessionResult.userProvidedSession);
+        const response = buildCliResponse("gemini", stdout, params.optimizeResponse ?? false, corrId, effectiveSessionId, prep, durationMs, sessionResult.userProvidedSession);
+        safeFlightComplete(corrId, {
+            response: stdout,
+            durationMs,
+            retryCount: 0,
+            circuitBreakerState: "closed",
+            approvalDecision: prep.approvalDecision?.status,
+            optimizationApplied: params.optimizePrompt || (params.optimizeResponse ?? false),
+            exitCode: 0,
+            status: "completed",
+        });
+        return response;
     }
     catch (error) {
         const elapsedMs = Math.max(0, Date.now() - startTime);
         deps.logger.info(`[${corrId}] gemini_request threw exception after ${elapsedMs}ms`);
+        safeFlightComplete(corrId, {
+            response: "",
+            durationMs: elapsedMs,
+            retryCount: 0,
+            circuitBreakerState: "closed",
+            optimizationApplied: false,
+            exitCode: 1,
+            errorMessage: error.message,
+            status: "failed",
+        });
         return createErrorResponse("gemini", 1, "", corrId, error);
     }
     finally {
@@ -642,11 +945,17 @@ export async function handleGeminiRequest(deps, params) {
 }
 export async function handleGeminiRequestAsync(deps, params) {
     const prep = prepareGeminiRequest({
-        prompt: params.prompt, model: params.model, approvalMode: params.approvalMode,
-        approvalStrategy: params.approvalStrategy, approvalPolicy: params.approvalPolicy,
-        allowedTools: params.allowedTools, includeDirs: params.includeDirs,
-        mcpServers: params.mcpServers, correlationId: params.correlationId,
-        optimizePrompt: params.optimizePrompt, operation: "gemini_request_async"
+        prompt: params.prompt,
+        model: params.model,
+        approvalMode: params.approvalMode,
+        approvalStrategy: params.approvalStrategy,
+        approvalPolicy: params.approvalPolicy,
+        allowedTools: params.allowedTools,
+        includeDirs: params.includeDirs,
+        mcpServers: params.mcpServers,
+        correlationId: params.correlationId,
+        optimizePrompt: params.optimizePrompt,
+        operation: "gemini_request_async",
     });
     if (!("args" in prep))
         return prep;
@@ -654,7 +963,9 @@ export async function handleGeminiRequestAsync(deps, params) {
     try {
         // Session arg planning (pure, no I/O)
         const sessionResult = resolveSessionResumeArgs({
-            sessionId: params.sessionId, resumeLatest: params.resumeLatest, createNewSession: params.createNewSession
+            sessionId: params.sessionId,
+            resumeLatest: params.resumeLatest,
+            createNewSession: params.createNewSession,
         });
         args.push(...sessionResult.resumeArgs);
         // Pre-start session I/O (async handlers: prevent orphaned jobs)
@@ -678,7 +989,7 @@ export async function handleGeminiRequestAsync(deps, params) {
             effectiveSessionId = newSession.id;
         }
         // Start job only after all session I/O succeeds
-        const job = deps.asyncJobManager.startJob("gemini", args, corrId, undefined, resolveIdleTimeout("gemini", params.idleTimeoutMs));
+        const job = deps.asyncJobManager.startJob("gemini", args, corrId, undefined, resolveIdleTimeout("gemini", params.idleTimeoutMs), undefined, params.forceRefresh);
         deps.logger.info(`[${corrId}] gemini_request_async started job ${job.id}`);
         const asyncResponse = {
             success: true,
@@ -686,30 +997,231 @@ export async function handleGeminiRequestAsync(deps, params) {
             sessionId: effectiveSessionId || null,
             resumable: sessionResult.userProvidedSession,
             approval: approvalDecision,
-            mcpServers: { requested: requestedMcpServers }
+            mcpServers: { requested: requestedMcpServers },
         };
         if (prep.reviewIntegrity && prep.reviewIntegrity.violations.length > 0) {
             asyncResponse.reviewIntegrity = prep.reviewIntegrity;
         }
         return {
-            content: [{
+            content: [
+                {
                     type: "text",
-                    text: JSON.stringify(asyncResponse, null, 2)
-                }]
+                    text: JSON.stringify(asyncResponse, null, 2),
+                },
+            ],
         };
     }
     catch (error) {
         return createErrorResponse("gemini_request_async", 1, "", corrId, error);
     }
 }
+export async function handleGrokRequest(deps, params) {
+    const startTime = Date.now();
+    const prep = prepareGrokRequest({
+        prompt: params.prompt,
+        model: params.model,
+        outputFormat: params.outputFormat,
+        alwaysApprove: params.alwaysApprove,
+        permissionMode: params.permissionMode,
+        effort: params.effort,
+        reasoningEffort: params.reasoningEffort,
+        allowedTools: params.allowedTools,
+        disallowedTools: params.disallowedTools,
+        approvalStrategy: params.approvalStrategy,
+        approvalPolicy: params.approvalPolicy,
+        mcpServers: params.mcpServers,
+        correlationId: params.correlationId,
+        optimizePrompt: params.optimizePrompt,
+        operation: "grok_request",
+    });
+    if (!("args" in prep))
+        return prep;
+    const { corrId, args } = prep;
+    let durationMs = 0;
+    let wasSuccessful = false;
+    safeFlightStart({
+        correlationId: corrId,
+        cli: "grok",
+        model: prep.resolvedModel || "default",
+        prompt: params.prompt,
+        sessionId: params.sessionId,
+    });
+    deps.logger.info(`[${corrId}] grok_request invoked with model=${prep.resolvedModel || "default"}, permissionMode=${params.permissionMode}, prompt length=${params.prompt.length}`);
+    try {
+        // Session arg planning (pure, no I/O)
+        const sessionResult = resolveGrokSessionArgs({
+            sessionId: params.sessionId,
+            resumeLatest: params.resumeLatest,
+            createNewSession: params.createNewSession,
+        });
+        args.push(...sessionResult.resumeArgs);
+        const result = await awaitJobOrDefer("grok", args, corrId, resolveIdleTimeout("grok", params.idleTimeoutMs), params.outputFormat, params.forceRefresh);
+        // Deferred — job still running, return async reference
+        if (isDeferredResponse(result)) {
+            return buildDeferredToolResponse(result, sessionResult.effectiveSessionId);
+        }
+        const { stdout, stderr, code } = result;
+        durationMs = Math.max(0, Date.now() - startTime);
+        if (code !== 0) {
+            deps.logger.info(`[${corrId}] grok_request failed in ${durationMs}ms`);
+            safeFlightComplete(corrId, {
+                response: stderr || "",
+                durationMs,
+                retryCount: 0,
+                circuitBreakerState: "closed",
+                optimizationApplied: false,
+                exitCode: code,
+                errorMessage: stderr || `Exit code ${code}`,
+                status: "failed",
+            });
+            return createErrorResponse("grok", code, stderr, corrId);
+        }
+        wasSuccessful = true;
+        // Post-success session I/O (sync handlers: no phantom sessions on CLI failure)
+        let effectiveSessionId = sessionResult.effectiveSessionId;
+        if (sessionResult.userProvidedSession && effectiveSessionId) {
+            const existing = await deps.sessionManager.getSession(effectiveSessionId);
+            if (!existing) {
+                try {
+                    await deps.sessionManager.createSession("grok", "Grok Session", effectiveSessionId);
+                }
+                catch {
+                    const rechecked = await deps.sessionManager.getSession(effectiveSessionId);
+                    if (!rechecked)
+                        throw new Error(`Failed to create or find session ${effectiveSessionId}`);
+                }
+            }
+            await deps.sessionManager.updateSessionUsage(effectiveSessionId);
+        }
+        else if (!params.createNewSession && !effectiveSessionId) {
+            const newSession = await deps.sessionManager.createSession("grok", "Grok Session", `${GATEWAY_SESSION_PREFIX}${randomUUID()}`);
+            effectiveSessionId = newSession.id;
+        }
+        deps.logger.info(`[${corrId}] grok_request completed successfully in ${durationMs}ms`);
+        const response = buildCliResponse("grok", stdout, params.optimizeResponse ?? false, corrId, effectiveSessionId, prep, durationMs, sessionResult.userProvidedSession, params.outputFormat);
+        safeFlightComplete(corrId, {
+            response: stdout,
+            durationMs,
+            retryCount: 0,
+            circuitBreakerState: "closed",
+            approvalDecision: prep.approvalDecision?.status,
+            optimizationApplied: params.optimizePrompt || (params.optimizeResponse ?? false),
+            exitCode: 0,
+            status: "completed",
+        });
+        return response;
+    }
+    catch (error) {
+        const elapsedMs = Math.max(0, Date.now() - startTime);
+        deps.logger.info(`[${corrId}] grok_request threw exception after ${elapsedMs}ms`);
+        safeFlightComplete(corrId, {
+            response: "",
+            durationMs: elapsedMs,
+            retryCount: 0,
+            circuitBreakerState: "closed",
+            optimizationApplied: false,
+            exitCode: 1,
+            errorMessage: error.message,
+            status: "failed",
+        });
+        return createErrorResponse("grok", 1, "", corrId, error);
+    }
+    finally {
+        const finalizedDurationMs = Math.max(0, durationMs || Date.now() - startTime);
+        performanceMetrics.recordRequest("grok", finalizedDurationMs, wasSuccessful);
+    }
+}
+export async function handleGrokRequestAsync(deps, params) {
+    const prep = prepareGrokRequest({
+        prompt: params.prompt,
+        model: params.model,
+        outputFormat: params.outputFormat,
+        alwaysApprove: params.alwaysApprove,
+        permissionMode: params.permissionMode,
+        effort: params.effort,
+        reasoningEffort: params.reasoningEffort,
+        allowedTools: params.allowedTools,
+        disallowedTools: params.disallowedTools,
+        approvalStrategy: params.approvalStrategy,
+        approvalPolicy: params.approvalPolicy,
+        mcpServers: params.mcpServers,
+        correlationId: params.correlationId,
+        optimizePrompt: params.optimizePrompt,
+        operation: "grok_request_async",
+    });
+    if (!("args" in prep))
+        return prep;
+    const { corrId, args, requestedMcpServers, approvalDecision } = prep;
+    try {
+        // Session arg planning (pure, no I/O)
+        const sessionResult = resolveGrokSessionArgs({
+            sessionId: params.sessionId,
+            resumeLatest: params.resumeLatest,
+            createNewSession: params.createNewSession,
+        });
+        args.push(...sessionResult.resumeArgs);
+        // Pre-start session I/O (async handlers: prevent orphaned jobs)
+        let effectiveSessionId = sessionResult.effectiveSessionId;
+        if (sessionResult.userProvidedSession && effectiveSessionId) {
+            const existing = await deps.sessionManager.getSession(effectiveSessionId);
+            if (!existing) {
+                try {
+                    await deps.sessionManager.createSession("grok", "Grok Session", effectiveSessionId);
+                }
+                catch {
+                    const rechecked = await deps.sessionManager.getSession(effectiveSessionId);
+                    if (!rechecked)
+                        throw new Error(`Failed to create or find session ${effectiveSessionId}`);
+                }
+            }
+            await deps.sessionManager.updateSessionUsage(effectiveSessionId);
+        }
+        else if (!params.createNewSession && !effectiveSessionId) {
+            const newSession = await deps.sessionManager.createSession("grok", "Grok Session", `${GATEWAY_SESSION_PREFIX}${randomUUID()}`);
+            effectiveSessionId = newSession.id;
+        }
+        // Start job only after all session I/O succeeds
+        const job = deps.asyncJobManager.startJob("grok", args, corrId, undefined, resolveIdleTimeout("grok", params.idleTimeoutMs), params.outputFormat, params.forceRefresh);
+        deps.logger.info(`[${corrId}] grok_request_async started job ${job.id}`);
+        const asyncResponse = {
+            success: true,
+            job,
+            sessionId: effectiveSessionId || null,
+            resumable: sessionResult.userProvidedSession,
+            approval: approvalDecision,
+            mcpServers: { requested: requestedMcpServers },
+        };
+        if (prep.reviewIntegrity && prep.reviewIntegrity.violations.length > 0) {
+            asyncResponse.reviewIntegrity = prep.reviewIntegrity;
+        }
+        return {
+            content: [
+                {
+                    type: "text",
+                    text: JSON.stringify(asyncResponse, null, 2),
+                },
+            ],
+        };
+    }
+    catch (error) {
+        return createErrorResponse("grok_request_async", 1, "", corrId, error);
+    }
+}
 export async function handleCodexRequestAsync(deps, params) {
     const prep = prepareCodexRequest({
-        prompt: params.prompt, model: params.model, fullAuto: params.fullAuto,
+        prompt: params.prompt,
+        model: params.model,
+        fullAuto: params.fullAuto,
         dangerouslyBypassApprovalsAndSandbox: params.dangerouslyBypassApprovalsAndSandbox,
-        approvalStrategy: params.approvalStrategy, approvalPolicy: params.approvalPolicy,
+        approvalStrategy: params.approvalStrategy,
+        approvalPolicy: params.approvalPolicy,
         mcpServers: params.mcpServers,
-        correlationId: params.correlationId, optimizePrompt: params.optimizePrompt,
-        operation: "codex_request_async"
+        sessionId: params.sessionId,
+        resumeLatest: params.resumeLatest,
+        createNewSession: params.createNewSession,
+        correlationId: params.correlationId,
+        optimizePrompt: params.optimizePrompt,
+        operation: "codex_request_async",
     });
     if (!("args" in prep))
         return prep;
@@ -735,23 +1247,25 @@ export async function handleCodexRequestAsync(deps, params) {
             effectiveSessionId = newSession.id;
         }
         // Start job only after all session I/O succeeds
-        const job = deps.asyncJobManager.startJob("codex", args, corrId, undefined, resolveIdleTimeout("codex", params.idleTimeoutMs));
+        const job = deps.asyncJobManager.startJob("codex", args, corrId, undefined, resolveIdleTimeout("codex", params.idleTimeoutMs), undefined, params.forceRefresh);
         deps.logger.info(`[${corrId}] codex_request_async started job ${job.id}`);
         const asyncResponse = {
             success: true,
             job,
             sessionId: effectiveSessionId || null,
             approval: approvalDecision,
-            mcpServers: { requested: requestedMcpServers }
+            mcpServers: { requested: requestedMcpServers },
         };
         if (prep.reviewIntegrity && prep.reviewIntegrity.violations.length > 0) {
             asyncResponse.reviewIntegrity = prep.reviewIntegrity;
         }
         return {
-            content: [{
+            content: [
+                {
                     type: "text",
-                    text: JSON.stringify(asyncResponse, null, 2)
-                }]
+                    text: JSON.stringify(asyncResponse, null, 2),
+                },
+            ],
         };
     }
     catch (error) {
@@ -762,35 +1276,90 @@ export async function handleCodexRequestAsync(deps, params) {
 // Claude Code Tool
 //──────────────────────────────────────────────────────────────────────────────
 server.tool("claude_request", {
-    prompt: z.string().min(1, "Prompt cannot be empty").max(100000, "Prompt too long (max 100k chars)").describe("Prompt text for Claude"),
-    model: z.string().optional().describe("Model name or alias (e.g. sonnet, claude-sonnet-4-5-20250929, latest)"),
-    outputFormat: z.enum(["text", "json", "stream-json"]).default("text").describe("Output format (text|json|stream-json). stream-json: NDJSON with idle timeout."),
+    prompt: z
+        .string()
+        .min(1, "Prompt cannot be empty")
+        .max(100000, "Prompt too long (max 100k chars)")
+        .describe("Prompt text for Claude"),
+    model: z
+        .string()
+        .optional()
+        .describe("Model name or alias (e.g. sonnet, claude-sonnet-4-5-20250929, latest)"),
+    outputFormat: z
+        .enum(["text", "json", "stream-json"])
+        .default("text")
+        .describe("Output format (text|json|stream-json). stream-json: NDJSON with idle timeout."),
     sessionId: z.string().optional().describe("Session ID (uses active if omitted)"),
     continueSession: z.boolean().default(false).describe("Continue active session"),
     createNewSession: z.boolean().default(false).describe("Force new session"),
-    allowedTools: z.array(z.string()).optional().describe("Allowed tools (['Bash(git:*)','Edit','Write'])"),
+    allowedTools: z
+        .array(z.string())
+        .optional()
+        .describe("Allowed tools (['Bash(git:*)','Edit','Write'])"),
     disallowedTools: z.array(z.string()).optional().describe("Disallowed tools"),
-    dangerouslySkipPermissions: z.boolean().default(false).describe("Bypass permissions (sandbox only)"),
-    approvalStrategy: z.enum(["legacy", "mcp_managed"]).default("legacy").describe("Approval strategy"),
-    approvalPolicy: z.enum(["strict", "balanced", "permissive"]).optional().describe("Approval policy override"),
-    mcpServers: z.array(MCP_SERVER_ENUM).default(["sqry"]).describe("MCP servers exposed to Claude"),
-    strictMcpConfig: z.boolean().default(false).describe("Restrict Claude to provided MCP config only"),
+    dangerouslySkipPermissions: z
+        .boolean()
+        .default(false)
+        .describe("Bypass permissions (sandbox only)"),
+    approvalStrategy: z
+        .enum(["legacy", "mcp_managed"])
+        .default("legacy")
+        .describe("Approval strategy"),
+    approvalPolicy: z
+        .enum(["strict", "balanced", "permissive"])
+        .optional()
+        .describe("Approval policy override"),
+    mcpServers: z
+        .array(MCP_SERVER_ENUM)
+        .default(["sqry"])
+        .describe("MCP servers exposed to Claude"),
+    strictMcpConfig: z
+        .boolean()
+        .default(false)
+        .describe("Restrict Claude to provided MCP config only"),
     correlationId: z.string().optional().describe("Request trace ID (auto if omitted)"),
     optimizePrompt: z.boolean().default(false).describe("Optimize prompt before execution"),
     optimizeResponse: z.boolean().default(false).describe("Optimize response output"),
-    idleTimeoutMs: z.number().int().min(30_000).max(3_600_000).optional().describe("Idle timeout in ms (min 30s, max 1h, omit=CLI default)")
-}, async ({ prompt, model, outputFormat, sessionId, continueSession, createNewSession, allowedTools, disallowedTools, dangerouslySkipPermissions, approvalStrategy, approvalPolicy, mcpServers, strictMcpConfig, correlationId, optimizePrompt, optimizeResponse, idleTimeoutMs }) => {
+    idleTimeoutMs: z
+        .number()
+        .int()
+        .min(30_000)
+        .max(3_600_000)
+        .optional()
+        .describe("Idle timeout in ms (min 30s, max 1h, omit=CLI default)"),
+    forceRefresh: z
+        .boolean()
+        .default(false)
+        .describe("Bypass dedup and force a fresh CLI run even if a recent identical request exists"),
+}, async ({ prompt, model, outputFormat, sessionId, continueSession, createNewSession, allowedTools, disallowedTools, dangerouslySkipPermissions, approvalStrategy, approvalPolicy, mcpServers, strictMcpConfig, correlationId, optimizePrompt, optimizeResponse, idleTimeoutMs, forceRefresh, }) => {
     const startTime = Date.now();
     const prep = prepareClaudeRequest({
-        prompt, model, outputFormat, allowedTools, disallowedTools, dangerouslySkipPermissions,
-        approvalStrategy, approvalPolicy, mcpServers,
-        strictMcpConfig, correlationId, optimizePrompt, operation: "claude_request"
+        prompt,
+        model,
+        outputFormat,
+        allowedTools,
+        disallowedTools,
+        dangerouslySkipPermissions,
+        approvalStrategy,
+        approvalPolicy,
+        mcpServers,
+        strictMcpConfig,
+        correlationId,
+        optimizePrompt,
+        operation: "claude_request",
     });
     if (!("args" in prep))
         return prep;
     const { corrId, args } = prep;
     let durationMs = 0;
     let wasSuccessful = false;
+    safeFlightStart({
+        correlationId: corrId,
+        cli: "claude",
+        model: prep.resolvedModel || "default",
+        prompt,
+        sessionId,
+    });
     logger.info(`[${corrId}] claude_request invoked with model=${prep.resolvedModel || "default"}, outputFormat=${outputFormat}, prompt length=${prompt.length}, sessionId=${sessionId}`);
     try {
         // Session management
@@ -812,10 +1381,8 @@ server.tool("claude_request", {
             await sessionManager.updateSessionUsage(effectiveSessionId);
         }
         // Idle timeout only for stream-json (text/json produce no output until done)
-        const effectiveIdleTimeout = outputFormat === "stream-json"
-            ? resolveIdleTimeout("claude", idleTimeoutMs)
-            : undefined;
-        const result = await awaitJobOrDefer("claude", args, corrId, effectiveIdleTimeout, outputFormat);
+        const effectiveIdleTimeout = outputFormat === "stream-json" ? resolveIdleTimeout("claude", idleTimeoutMs) : undefined;
+        const result = await awaitJobOrDefer("claude", args, corrId, effectiveIdleTimeout, outputFormat, forceRefresh);
         // Deferred — job still running, return async reference
         if (isDeferredResponse(result)) {
             return buildDeferredToolResponse(result, effectiveSessionId);
@@ -824,6 +1391,16 @@ server.tool("claude_request", {
         durationMs = Math.max(0, Date.now() - startTime);
         if (code !== 0) {
             logger.info(`[${corrId}] claude_request failed in ${durationMs}ms`);
+            safeFlightComplete(corrId, {
+                response: stderr || "",
+                durationMs,
+                retryCount: 0,
+                circuitBreakerState: "closed",
+                optimizationApplied: optimizePrompt || optimizeResponse,
+                exitCode: code,
+                errorMessage: stderr || `Exit code ${code}`,
+                status: "failed",
+            });
             return createErrorResponse("claude", code, stderr, corrId);
         }
         wasSuccessful = true;
@@ -841,13 +1418,44 @@ server.tool("claude_request", {
             if (parsed.costUsd !== null) {
                 logger.debug(`[${corrId}] stream-json cost=$${parsed.costUsd}, model=${parsed.model}, turns=${parsed.numTurns}`);
             }
-            return buildCliResponse(parsed.text, optimizeResponse, corrId, effectiveSessionId, prep, undefined, outputFormat);
+            safeFlightComplete(corrId, {
+                response: parsed.text,
+                inputTokens: parsed.usage?.inputTokens,
+                outputTokens: parsed.usage?.outputTokens,
+                durationMs,
+                retryCount: 0,
+                circuitBreakerState: "closed",
+                costUsd: parsed.costUsd ?? undefined,
+                optimizationApplied: optimizePrompt || optimizeResponse,
+                exitCode: 0,
+                status: "completed",
+            });
+            return buildCliResponse("claude", parsed.text, optimizeResponse, corrId, effectiveSessionId, prep, durationMs, undefined, outputFormat);
         }
-        return buildCliResponse(stdout, optimizeResponse, corrId, effectiveSessionId, prep, undefined, outputFormat);
+        safeFlightComplete(corrId, {
+            response: stdout,
+            durationMs,
+            retryCount: 0,
+            circuitBreakerState: "closed",
+            optimizationApplied: optimizePrompt || optimizeResponse,
+            exitCode: 0,
+            status: "completed",
+        });
+        return buildCliResponse("claude", stdout, optimizeResponse, corrId, effectiveSessionId, prep, durationMs, undefined, outputFormat);
     }
     catch (error) {
         const elapsedMs = Math.max(0, Date.now() - startTime);
         logger.info(`[${corrId}] claude_request threw exception after ${elapsedMs}ms`);
+        safeFlightComplete(corrId, {
+            response: "",
+            durationMs: elapsedMs,
+            retryCount: 0,
+            circuitBreakerState: "closed",
+            optimizationApplied: optimizePrompt || optimizeResponse,
+            exitCode: 1,
+            errorMessage: error.message,
+            status: "failed",
+        });
         return createErrorResponse("claude", 1, "", corrId, error);
     }
     finally {
@@ -859,34 +1467,84 @@ server.tool("claude_request", {
 // Codex Tool
 //──────────────────────────────────────────────────────────────────────────────
 server.tool("codex_request", {
-    prompt: z.string().min(1, "Prompt cannot be empty").max(100000, "Prompt too long (max 100k chars)").describe("Prompt text for Codex"),
+    prompt: z
+        .string()
+        .min(1, "Prompt cannot be empty")
+        .max(100000, "Prompt too long (max 100k chars)")
+        .describe("Prompt text for Codex"),
     model: z.string().optional().describe("Model name or alias (e.g. gpt-5.4, latest)"),
     fullAuto: z.boolean().default(false).describe("Full-auto mode (sandboxed execution)"),
-    dangerouslyBypassApprovalsAndSandbox: z.boolean().default(false).describe("Run Codex without approvals/sandbox"),
-    approvalStrategy: z.enum(["legacy", "mcp_managed"]).default("legacy").describe("Approval strategy"),
-    approvalPolicy: z.enum(["strict", "balanced", "permissive"]).optional().describe("Approval policy override"),
-    mcpServers: z.array(MCP_SERVER_ENUM).default(["sqry"]).describe("MCP server names for approval tracking (Codex manages its own MCP config)"),
-    sessionId: z.string().optional().describe("Session ID (Codex manages internally)"),
-    createNewSession: z.boolean().default(false).describe("Force new session"),
+    dangerouslyBypassApprovalsAndSandbox: z
+        .boolean()
+        .default(false)
+        .describe("Run Codex without approvals/sandbox"),
+    approvalStrategy: z
+        .enum(["legacy", "mcp_managed"])
+        .default("legacy")
+        .describe("Approval strategy"),
+    approvalPolicy: z
+        .enum(["strict", "balanced", "permissive"])
+        .optional()
+        .describe("Approval policy override"),
+    mcpServers: z
+        .array(MCP_SERVER_ENUM)
+        .default(["sqry"])
+        .describe("MCP server names for approval tracking (Codex manages its own MCP config)"),
+    sessionId: z
+        .string()
+        .optional()
+        .describe("Codex session UUID to resume via `codex exec resume <ID>`. Must be a real Codex session ID (from `~/.codex/sessions/` or the `codex resume` picker). Gateway-generated `gw-*` IDs are rejected."),
+    resumeLatest: z
+        .boolean()
+        .default(false)
+        .describe("Resume the most recent Codex session in the current cwd via `codex exec resume --last`. Ignored if sessionId is set."),
+    createNewSession: z.boolean().default(false).describe("Force a fresh session (no resume)"),
     correlationId: z.string().optional().describe("Request trace ID (auto if omitted)"),
     optimizePrompt: z.boolean().default(false).describe("Optimize prompt before execution"),
     optimizeResponse: z.boolean().default(false).describe("Optimize response output"),
-    idleTimeoutMs: z.number().int().min(30_000).max(3_600_000).optional().describe("Idle timeout in ms (min 30s, max 1h, omit=CLI default)")
-}, async ({ prompt, model, fullAuto, dangerouslyBypassApprovalsAndSandbox, approvalStrategy, approvalPolicy, mcpServers, sessionId, createNewSession, correlationId, optimizePrompt, optimizeResponse, idleTimeoutMs }) => {
+    idleTimeoutMs: z
+        .number()
+        .int()
+        .min(30_000)
+        .max(3_600_000)
+        .optional()
+        .describe("Idle timeout in ms (min 30s, max 1h, omit=CLI default)"),
+    forceRefresh: z
+        .boolean()
+        .default(false)
+        .describe("Bypass dedup and force a fresh CLI run even if a recent identical request exists"),
+}, async ({ prompt, model, fullAuto, dangerouslyBypassApprovalsAndSandbox, approvalStrategy, approvalPolicy, mcpServers, sessionId, resumeLatest, createNewSession, correlationId, optimizePrompt, optimizeResponse, idleTimeoutMs, forceRefresh, }) => {
     const startTime = Date.now();
     const prep = prepareCodexRequest({
-        prompt, model, fullAuto, dangerouslyBypassApprovalsAndSandbox,
-        approvalStrategy, approvalPolicy, mcpServers,
-        correlationId, optimizePrompt, operation: "codex_request"
+        prompt,
+        model,
+        fullAuto,
+        dangerouslyBypassApprovalsAndSandbox,
+        approvalStrategy,
+        approvalPolicy,
+        mcpServers,
+        sessionId,
+        resumeLatest,
+        createNewSession,
+        correlationId,
+        optimizePrompt,
+        operation: "codex_request",
     });
     if (!("args" in prep))
         return prep;
     const { corrId, args } = prep;
     let durationMs = 0;
     let wasSuccessful = false;
+    safeFlightStart({
+        correlationId: corrId,
+        cli: "codex",
+        model: prep.resolvedModel || "default",
+        prompt,
+        sessionId,
+    });
     logger.info(`[${corrId}] codex_request invoked with model=${prep.resolvedModel || "default"}, fullAuto=${fullAuto}, prompt length=${prompt.length}`);
     try {
-        const result = await awaitJobOrDefer("codex", args, corrId, resolveIdleTimeout("codex", idleTimeoutMs));
+        const result = await awaitJobOrDefer("codex", args, corrId, resolveIdleTimeout("codex", idleTimeoutMs), undefined, forceRefresh);
         // Deferred — job still running, return async reference
         if (isDeferredResponse(result)) {
             return buildDeferredToolResponse(result, sessionId);
@@ -895,6 +1553,16 @@ server.tool("codex_request", {
         durationMs = Math.max(0, Date.now() - startTime);
         if (code !== 0) {
             logger.info(`[${corrId}] codex_request failed in ${durationMs}ms`);
+            safeFlightComplete(corrId, {
+                response: stderr || "",
+                durationMs,
+                retryCount: 0,
+                circuitBreakerState: "closed",
+                optimizationApplied: optimizePrompt || optimizeResponse,
+                exitCode: code,
+                errorMessage: stderr || `Exit code ${code}`,
+                status: "failed",
+            });
             return createErrorResponse("codex", code, stderr, corrId);
         }
         wasSuccessful = true;
@@ -918,11 +1586,30 @@ server.tool("codex_request", {
             effectiveSessionId = newSession.id;
         }
         logger.info(`[${corrId}] codex_request completed successfully in ${durationMs}ms`);
-        return buildCliResponse(stdout, optimizeResponse, corrId, effectiveSessionId, prep);
+        safeFlightComplete(corrId, {
+            response: stdout,
+            durationMs,
+            retryCount: 0,
+            circuitBreakerState: "closed",
+            optimizationApplied: optimizePrompt || optimizeResponse,
+            exitCode: 0,
+            status: "completed",
+        });
+        return buildCliResponse("codex", stdout, optimizeResponse, corrId, effectiveSessionId, prep, durationMs);
     }
     catch (error) {
         const elapsedMs = Math.max(0, Date.now() - startTime);
         logger.info(`[${corrId}] codex_request threw exception after ${elapsedMs}ms`);
+        safeFlightComplete(corrId, {
+            response: "",
+            durationMs: elapsedMs,
+            retryCount: 0,
+            circuitBreakerState: "closed",
+            optimizationApplied: optimizePrompt || optimizeResponse,
+            exitCode: 1,
+            errorMessage: error.message,
+            status: "failed",
+        });
         return createErrorResponse("codex", 1, "", corrId, error);
     }
     finally {
@@ -934,49 +1621,237 @@ server.tool("codex_request", {
 // Gemini Tool
 //──────────────────────────────────────────────────────────────────────────────
 server.tool("gemini_request", {
-    prompt: z.string().min(1, "Prompt cannot be empty").max(100000, "Prompt too long (max 100k chars)").describe("Prompt text for Gemini"),
-    model: z.string().optional().describe("Model name or alias (e.g. gemini-3-pro-preview, gemini-2.5-flash, pro, flash, latest)"),
+    prompt: z
+        .string()
+        .min(1, "Prompt cannot be empty")
+        .max(100000, "Prompt too long (max 100k chars)")
+        .describe("Prompt text for Gemini"),
+    model: z
+        .string()
+        .optional()
+        .describe("Model name or alias (e.g. gemini-3-pro-preview, gemini-2.5-flash, pro, flash, latest)"),
     sessionId: z.string().optional().describe("Session ID or 'latest'"),
     resumeLatest: z.boolean().default(false).describe("Resume latest session"),
     createNewSession: z.boolean().default(false).describe("Force new session"),
-    approvalMode: z.enum(["default", "auto_edit", "yolo"]).optional().describe("Approval: default|auto_edit|yolo"),
-    approvalStrategy: z.enum(["legacy", "mcp_managed"]).default("legacy").describe("Approval strategy"),
-    approvalPolicy: z.enum(["strict", "balanced", "permissive"]).optional().describe("Approval policy override"),
-    mcpServers: z.array(MCP_SERVER_ENUM).default(["sqry"]).describe("MCP server names passed to Gemini as --allowed-mcp-server-names"),
-    allowedTools: z.array(z.string()).optional().describe("Allowed tools (['Write','Edit','Bash'])"),
+    approvalMode: z
+        .enum(["default", "auto_edit", "yolo"])
+        .optional()
+        .describe("Approval: default|auto_edit|yolo"),
+    approvalStrategy: z
+        .enum(["legacy", "mcp_managed"])
+        .default("legacy")
+        .describe("Approval strategy"),
+    approvalPolicy: z
+        .enum(["strict", "balanced", "permissive"])
+        .optional()
+        .describe("Approval policy override"),
+    mcpServers: z
+        .array(MCP_SERVER_ENUM)
+        .default(["sqry"])
+        .describe("MCP server names passed to Gemini as --allowed-mcp-server-names"),
+    allowedTools: z
+        .array(z.string())
+        .optional()
+        .describe("Allowed tools (['Write','Edit','Bash'])"),
     includeDirs: z.array(z.string()).optional().describe("Additional workspace directories"),
     correlationId: z.string().optional().describe("Request trace ID (auto if omitted)"),
     optimizePrompt: z.boolean().default(false).describe("Optimize prompt before execution"),
     optimizeResponse: z.boolean().default(false).describe("Optimize response output"),
-    idleTimeoutMs: z.number().int().min(30_000).max(3_600_000).optional().describe("Idle timeout in ms (min 30s, max 1h, omit=CLI default)")
-}, async ({ prompt, model, sessionId, resumeLatest, createNewSession, approvalMode, approvalStrategy, approvalPolicy, mcpServers, allowedTools, includeDirs, correlationId, optimizePrompt, optimizeResponse, idleTimeoutMs }) => {
-    return handleGeminiRequest({ sessionManager, logger }, { prompt, model, sessionId, resumeLatest, createNewSession, approvalMode, approvalStrategy, approvalPolicy, mcpServers, allowedTools, includeDirs, correlationId, optimizePrompt, optimizeResponse, idleTimeoutMs });
+    idleTimeoutMs: z
+        .number()
+        .int()
+        .min(30_000)
+        .max(3_600_000)
+        .optional()
+        .describe("Idle timeout in ms (min 30s, max 1h, omit=CLI default)"),
+    forceRefresh: z
+        .boolean()
+        .default(false)
+        .describe("Bypass dedup and force a fresh CLI run even if a recent identical request exists"),
+}, async ({ prompt, model, sessionId, resumeLatest, createNewSession, approvalMode, approvalStrategy, approvalPolicy, mcpServers, allowedTools, includeDirs, correlationId, optimizePrompt, optimizeResponse, idleTimeoutMs, forceRefresh, }) => {
+    return handleGeminiRequest({ sessionManager, logger }, {
+        prompt,
+        model,
+        sessionId,
+        resumeLatest,
+        createNewSession,
+        approvalMode,
+        approvalStrategy,
+        approvalPolicy,
+        mcpServers,
+        allowedTools,
+        includeDirs,
+        correlationId,
+        optimizePrompt,
+        optimizeResponse,
+        idleTimeoutMs,
+        forceRefresh,
+    });
+});
+//──────────────────────────────────────────────────────────────────────────────
+// Grok Tool
+//──────────────────────────────────────────────────────────────────────────────
+server.tool("grok_request", {
+    prompt: z
+        .string()
+        .min(1, "Prompt cannot be empty")
+        .max(100000, "Prompt too long (max 100k chars)")
+        .describe("Prompt text for Grok"),
+    model: z.string().optional().describe("Model name or alias (e.g. grok-build, latest)"),
+    outputFormat: z
+        .enum(["plain", "json", "streaming-json"])
+        .optional()
+        .describe("Output format (plain|json|streaming-json). Grok default is plain."),
+    sessionId: z.string().optional().describe("Session ID (user-provided CLI handle for --resume)"),
+    resumeLatest: z
+        .boolean()
+        .default(false)
+        .describe("Resume most recent Grok session in cwd (--continue)"),
+    createNewSession: z.boolean().default(false).describe("Force new session"),
+    alwaysApprove: z
+        .boolean()
+        .default(false)
+        .describe("Auto-approve all tool executions (--always-approve)"),
+    permissionMode: z
+        .enum(["default", "acceptEdits", "auto", "dontAsk", "bypassPermissions", "plan"])
+        .optional()
+        .describe("Grok permission mode"),
+    effort: z
+        .enum(["low", "medium", "high", "xhigh", "max"])
+        .optional()
+        .describe("Grok effort level"),
+    reasoningEffort: z.string().optional().describe("Reasoning effort for reasoning models"),
+    approvalStrategy: z
+        .enum(["legacy", "mcp_managed"])
+        .default("legacy")
+        .describe("Approval strategy"),
+    approvalPolicy: z
+        .enum(["strict", "balanced", "permissive"])
+        .optional()
+        .describe("Approval policy override"),
+    mcpServers: z
+        .array(MCP_SERVER_ENUM)
+        .default(["sqry"])
+        .describe("MCP server names for approval tracking (Grok manages its own MCP config via `grok mcp`)"),
+    allowedTools: z
+        .array(z.string())
+        .optional()
+        .describe("Allowed built-in tools (passed as --tools comma list)"),
+    disallowedTools: z
+        .array(z.string())
+        .optional()
+        .describe("Disallowed built-in tools (passed as --disallowed-tools comma list)"),
+    correlationId: z.string().optional().describe("Request trace ID (auto if omitted)"),
+    optimizePrompt: z.boolean().default(false).describe("Optimize prompt before execution"),
+    optimizeResponse: z.boolean().default(false).describe("Optimize response output"),
+    idleTimeoutMs: z
+        .number()
+        .int()
+        .min(30_000)
+        .max(3_600_000)
+        .optional()
+        .describe("Idle timeout in ms (min 30s, max 1h, omit=CLI default)"),
+    forceRefresh: z
+        .boolean()
+        .default(false)
+        .describe("Bypass dedup and force a fresh CLI run even if a recent identical request exists"),
+}, async ({ prompt, model, outputFormat, sessionId, resumeLatest, createNewSession, alwaysApprove, permissionMode, effort, reasoningEffort, approvalStrategy, approvalPolicy, mcpServers, allowedTools, disallowedTools, correlationId, optimizePrompt, optimizeResponse, idleTimeoutMs, forceRefresh, }) => {
+    return handleGrokRequest({ sessionManager, logger }, {
+        prompt,
+        model,
+        outputFormat,
+        sessionId,
+        resumeLatest,
+        createNewSession,
+        alwaysApprove,
+        permissionMode,
+        effort,
+        reasoningEffort,
+        approvalStrategy,
+        approvalPolicy,
+        mcpServers,
+        allowedTools,
+        disallowedTools,
+        correlationId,
+        optimizePrompt,
+        optimizeResponse,
+        idleTimeoutMs,
+        forceRefresh,
+    });
 });
 //──────────────────────────────────────────────────────────────────────────────
 // Async Long-Running Job Tools (No Time-Bound LLM Execution)
 //──────────────────────────────────────────────────────────────────────────────
 server.tool("claude_request_async", {
-    prompt: z.string().min(1, "Prompt cannot be empty").max(100000, "Prompt too long (max 100k chars)").describe("Prompt text for Claude"),
-    model: z.string().optional().describe("Model name or alias (e.g. sonnet, claude-sonnet-4-5-20250929, latest)"),
-    outputFormat: z.enum(["text", "json", "stream-json"]).default("text").describe("Output format (text|json|stream-json). stream-json: NDJSON with idle timeout."),
+    prompt: z
+        .string()
+        .min(1, "Prompt cannot be empty")
+        .max(100000, "Prompt too long (max 100k chars)")
+        .describe("Prompt text for Claude"),
+    model: z
+        .string()
+        .optional()
+        .describe("Model name or alias (e.g. sonnet, claude-sonnet-4-5-20250929, latest)"),
+    outputFormat: z
+        .enum(["text", "json", "stream-json"])
+        .default("text")
+        .describe("Output format (text|json|stream-json). stream-json: NDJSON with idle timeout."),
     sessionId: z.string().optional().describe("Session ID (uses active if omitted)"),
     continueSession: z.boolean().default(false).describe("Continue active session"),
     createNewSession: z.boolean().default(false).describe("Force new session"),
-    allowedTools: z.array(z.string()).optional().describe("Allowed tools (['Bash(git:*)','Edit','Write'])"),
+    allowedTools: z
+        .array(z.string())
+        .optional()
+        .describe("Allowed tools (['Bash(git:*)','Edit','Write'])"),
     disallowedTools: z.array(z.string()).optional().describe("Disallowed tools"),
-    dangerouslySkipPermissions: z.boolean().default(false).describe("Bypass permissions (sandbox only)"),
-    approvalStrategy: z.enum(["legacy", "mcp_managed"]).default("legacy").describe("Approval strategy"),
-    approvalPolicy: z.enum(["strict", "balanced", "permissive"]).optional().describe("Approval policy override"),
-    mcpServers: z.array(MCP_SERVER_ENUM).default(["sqry"]).describe("MCP servers exposed to Claude"),
-    strictMcpConfig: z.boolean().default(false).describe("Restrict Claude to provided MCP config only"),
+    dangerouslySkipPermissions: z
+        .boolean()
+        .default(false)
+        .describe("Bypass permissions (sandbox only)"),
+    approvalStrategy: z
+        .enum(["legacy", "mcp_managed"])
+        .default("legacy")
+        .describe("Approval strategy"),
+    approvalPolicy: z
+        .enum(["strict", "balanced", "permissive"])
+        .optional()
+        .describe("Approval policy override"),
+    mcpServers: z
+        .array(MCP_SERVER_ENUM)
+        .default(["sqry"])
+        .describe("MCP servers exposed to Claude"),
+    strictMcpConfig: z
+        .boolean()
+        .default(false)
+        .describe("Restrict Claude to provided MCP config only"),
     correlationId: z.string().optional().describe("Request trace ID (auto if omitted)"),
     optimizePrompt: z.boolean().default(false).describe("Optimize prompt before execution"),
-    idleTimeoutMs: z.number().int().min(30_000).max(3_600_000).optional().describe("Idle timeout in ms (min 30s, max 1h, omit=CLI default)")
-}, async ({ prompt, model, outputFormat, sessionId, continueSession, createNewSession, allowedTools, disallowedTools, dangerouslySkipPermissions, approvalStrategy, approvalPolicy, mcpServers, strictMcpConfig, correlationId, optimizePrompt, idleTimeoutMs }) => {
+    idleTimeoutMs: z
+        .number()
+        .int()
+        .min(30_000)
+        .max(3_600_000)
+        .optional()
+        .describe("Idle timeout in ms (min 30s, max 1h, omit=CLI default)"),
+    forceRefresh: z
+        .boolean()
+        .default(false)
+        .describe("Bypass dedup and force a fresh CLI run even if a recent identical request exists"),
+}, async ({ prompt, model, outputFormat, sessionId, continueSession, createNewSession, allowedTools, disallowedTools, dangerouslySkipPermissions, approvalStrategy, approvalPolicy, mcpServers, strictMcpConfig, correlationId, optimizePrompt, idleTimeoutMs, forceRefresh, }) => {
     const prep = prepareClaudeRequest({
-        prompt, model, outputFormat, allowedTools, disallowedTools, dangerouslySkipPermissions,
-        approvalStrategy, approvalPolicy, mcpServers,
-        strictMcpConfig, correlationId, optimizePrompt, operation: "claude_request_async"
+        prompt,
+        model,
+        outputFormat,
+        allowedTools,
+        disallowedTools,
+        dangerouslySkipPermissions,
+        approvalStrategy,
+        approvalPolicy,
+        mcpServers,
+        strictMcpConfig,
+        correlationId,
+        optimizePrompt,
+        operation: "claude_request_async",
     });
     if (!("args" in prep))
         return prep;
@@ -1007,10 +1882,8 @@ server.tool("claude_request_async", {
             }
         }
         // Idle timeout only for stream-json (text/json produce no output until done)
-        const effectiveIdleTimeout = outputFormat === "stream-json"
-            ? resolveIdleTimeout("claude", idleTimeoutMs)
-            : undefined;
-        const job = asyncJobManager.startJob("claude", args, corrId, undefined, effectiveIdleTimeout, outputFormat);
+        const effectiveIdleTimeout = outputFormat === "stream-json" ? resolveIdleTimeout("claude", idleTimeoutMs) : undefined;
+        const job = asyncJobManager.startJob("claude", args, corrId, undefined, effectiveIdleTimeout, outputFormat, forceRefresh);
         logger.info(`[${corrId}] claude_request_async started job ${job.id}, outputFormat=${outputFormat}`);
         const asyncResponse = {
             success: true,
@@ -1020,17 +1893,19 @@ server.tool("claude_request_async", {
             mcpServers: {
                 requested: requestedMcpServers,
                 enabled: mcpConfig?.enabled,
-                missing: mcpConfig?.missing
-            }
+                missing: mcpConfig?.missing,
+            },
         };
         if (prep.reviewIntegrity && prep.reviewIntegrity.violations.length > 0) {
             asyncResponse.reviewIntegrity = prep.reviewIntegrity;
         }
         return {
-            content: [{
+            content: [
+                {
                     type: "text",
-                    text: JSON.stringify(asyncResponse, null, 2)
-                }]
+                    text: JSON.stringify(asyncResponse, null, 2),
+                },
+            ],
         };
     }
     catch (error) {
@@ -1038,82 +1913,276 @@ server.tool("claude_request_async", {
     }
 });
 server.tool("codex_request_async", {
-    prompt: z.string().min(1, "Prompt cannot be empty").max(100000, "Prompt too long (max 100k chars)").describe("Prompt text for Codex"),
+    prompt: z
+        .string()
+        .min(1, "Prompt cannot be empty")
+        .max(100000, "Prompt too long (max 100k chars)")
+        .describe("Prompt text for Codex"),
     model: z.string().optional().describe("Model name or alias (e.g. gpt-5.4, latest)"),
     fullAuto: z.boolean().default(false).describe("Full-auto mode (sandboxed execution)"),
-    dangerouslyBypassApprovalsAndSandbox: z.boolean().default(false).describe("Run Codex without approvals/sandbox"),
-    approvalStrategy: z.enum(["legacy", "mcp_managed"]).default("legacy").describe("Approval strategy"),
-    approvalPolicy: z.enum(["strict", "balanced", "permissive"]).optional().describe("Approval policy override"),
-    mcpServers: z.array(MCP_SERVER_ENUM).default(["sqry"]).describe("MCP server names for approval tracking (Codex manages its own MCP config)"),
-    sessionId: z.string().optional().describe("Session ID (Codex manages internally)"),
-    createNewSession: z.boolean().default(false).describe("Force new session"),
+    dangerouslyBypassApprovalsAndSandbox: z
+        .boolean()
+        .default(false)
+        .describe("Run Codex without approvals/sandbox"),
+    approvalStrategy: z
+        .enum(["legacy", "mcp_managed"])
+        .default("legacy")
+        .describe("Approval strategy"),
+    approvalPolicy: z
+        .enum(["strict", "balanced", "permissive"])
+        .optional()
+        .describe("Approval policy override"),
+    mcpServers: z
+        .array(MCP_SERVER_ENUM)
+        .default(["sqry"])
+        .describe("MCP server names for approval tracking (Codex manages its own MCP config)"),
+    sessionId: z
+        .string()
+        .optional()
+        .describe("Codex session UUID to resume via `codex exec resume <ID>`. Must be a real Codex session ID (from `~/.codex/sessions/` or the `codex resume` picker). Gateway-generated `gw-*` IDs are rejected."),
+    resumeLatest: z
+        .boolean()
+        .default(false)
+        .describe("Resume the most recent Codex session in the current cwd via `codex exec resume --last`. Ignored if sessionId is set."),
+    createNewSession: z.boolean().default(false).describe("Force a fresh session (no resume)"),
     correlationId: z.string().optional().describe("Request trace ID (auto if omitted)"),
     optimizePrompt: z.boolean().default(false).describe("Optimize prompt before execution"),
-    idleTimeoutMs: z.number().int().min(30_000).max(3_600_000).optional().describe("Idle timeout in ms (min 30s, max 1h, omit=CLI default)")
-}, async ({ prompt, model, fullAuto, dangerouslyBypassApprovalsAndSandbox, approvalStrategy, approvalPolicy, mcpServers, sessionId, createNewSession, correlationId, optimizePrompt, idleTimeoutMs }) => {
-    return handleCodexRequestAsync({ sessionManager, asyncJobManager, logger }, { prompt, model, fullAuto, dangerouslyBypassApprovalsAndSandbox, approvalStrategy, approvalPolicy, mcpServers, sessionId, createNewSession, correlationId, optimizePrompt, idleTimeoutMs });
+    idleTimeoutMs: z
+        .number()
+        .int()
+        .min(30_000)
+        .max(3_600_000)
+        .optional()
+        .describe("Idle timeout in ms (min 30s, max 1h, omit=CLI default)"),
+    forceRefresh: z
+        .boolean()
+        .default(false)
+        .describe("Bypass dedup and force a fresh CLI run even if a recent identical request exists"),
+}, async ({ prompt, model, fullAuto, dangerouslyBypassApprovalsAndSandbox, approvalStrategy, approvalPolicy, mcpServers, sessionId, resumeLatest, createNewSession, correlationId, optimizePrompt, idleTimeoutMs, forceRefresh, }) => {
+    return handleCodexRequestAsync({ sessionManager, asyncJobManager, logger }, {
+        prompt,
+        model,
+        fullAuto,
+        dangerouslyBypassApprovalsAndSandbox,
+        approvalStrategy,
+        approvalPolicy,
+        mcpServers,
+        sessionId,
+        resumeLatest,
+        createNewSession,
+        correlationId,
+        optimizePrompt,
+        idleTimeoutMs,
+        forceRefresh,
+    });
 });
 server.tool("gemini_request_async", {
-    prompt: z.string().min(1, "Prompt cannot be empty").max(100000, "Prompt too long (max 100k chars)").describe("Prompt text for Gemini"),
-    model: z.string().optional().describe("Model name or alias (e.g. gemini-3-pro-preview, gemini-2.5-flash, pro, flash, latest)"),
+    prompt: z
+        .string()
+        .min(1, "Prompt cannot be empty")
+        .max(100000, "Prompt too long (max 100k chars)")
+        .describe("Prompt text for Gemini"),
+    model: z
+        .string()
+        .optional()
+        .describe("Model name or alias (e.g. gemini-3-pro-preview, gemini-2.5-flash, pro, flash, latest)"),
     sessionId: z.string().optional().describe("Session ID (user-provided CLI handle for --resume)"),
     resumeLatest: z.boolean().default(false).describe("Resume latest session"),
     createNewSession: z.boolean().default(false).describe("Force new session"),
-    approvalMode: z.enum(["default", "auto_edit", "yolo"]).optional().describe("Approval: default|auto_edit|yolo"),
-    approvalStrategy: z.enum(["legacy", "mcp_managed"]).default("legacy").describe("Approval strategy"),
-    approvalPolicy: z.enum(["strict", "balanced", "permissive"]).optional().describe("Approval policy override"),
-    mcpServers: z.array(MCP_SERVER_ENUM).default(["sqry"]).describe("MCP server names passed to Gemini as --allowed-mcp-server-names"),
-    allowedTools: z.array(z.string()).optional().describe("Allowed tools (['Write','Edit','Bash'])"),
+    approvalMode: z
+        .enum(["default", "auto_edit", "yolo"])
+        .optional()
+        .describe("Approval: default|auto_edit|yolo"),
+    approvalStrategy: z
+        .enum(["legacy", "mcp_managed"])
+        .default("legacy")
+        .describe("Approval strategy"),
+    approvalPolicy: z
+        .enum(["strict", "balanced", "permissive"])
+        .optional()
+        .describe("Approval policy override"),
+    mcpServers: z
+        .array(MCP_SERVER_ENUM)
+        .default(["sqry"])
+        .describe("MCP server names passed to Gemini as --allowed-mcp-server-names"),
+    allowedTools: z
+        .array(z.string())
+        .optional()
+        .describe("Allowed tools (['Write','Edit','Bash'])"),
     includeDirs: z.array(z.string()).optional().describe("Additional workspace directories"),
     correlationId: z.string().optional().describe("Request trace ID (auto if omitted)"),
     optimizePrompt: z.boolean().default(false).describe("Optimize prompt before execution"),
-    idleTimeoutMs: z.number().int().min(30_000).max(3_600_000).optional().describe("Idle timeout in ms (min 30s, max 1h, omit=CLI default)")
-}, async ({ prompt, model, sessionId, resumeLatest, createNewSession, approvalMode, approvalStrategy, approvalPolicy, mcpServers, allowedTools, includeDirs, correlationId, optimizePrompt, idleTimeoutMs }) => {
-    return handleGeminiRequestAsync({ sessionManager, asyncJobManager, logger }, { prompt, model, sessionId, resumeLatest, createNewSession, approvalMode, approvalStrategy, approvalPolicy, mcpServers, allowedTools, includeDirs, correlationId, optimizePrompt, idleTimeoutMs });
+    idleTimeoutMs: z
+        .number()
+        .int()
+        .min(30_000)
+        .max(3_600_000)
+        .optional()
+        .describe("Idle timeout in ms (min 30s, max 1h, omit=CLI default)"),
+    forceRefresh: z
+        .boolean()
+        .default(false)
+        .describe("Bypass dedup and force a fresh CLI run even if a recent identical request exists"),
+}, async ({ prompt, model, sessionId, resumeLatest, createNewSession, approvalMode, approvalStrategy, approvalPolicy, mcpServers, allowedTools, includeDirs, correlationId, optimizePrompt, idleTimeoutMs, forceRefresh, }) => {
+    return handleGeminiRequestAsync({ sessionManager, asyncJobManager, logger }, {
+        prompt,
+        model,
+        sessionId,
+        resumeLatest,
+        createNewSession,
+        approvalMode,
+        approvalStrategy,
+        approvalPolicy,
+        mcpServers,
+        allowedTools,
+        includeDirs,
+        correlationId,
+        optimizePrompt,
+        idleTimeoutMs,
+        forceRefresh,
+    });
+});
+server.tool("grok_request_async", {
+    prompt: z
+        .string()
+        .min(1, "Prompt cannot be empty")
+        .max(100000, "Prompt too long (max 100k chars)")
+        .describe("Prompt text for Grok"),
+    model: z.string().optional().describe("Model name or alias (e.g. grok-build, latest)"),
+    outputFormat: z
+        .enum(["plain", "json", "streaming-json"])
+        .optional()
+        .describe("Output format (plain|json|streaming-json). Grok default is plain."),
+    sessionId: z.string().optional().describe("Session ID (user-provided CLI handle for --resume)"),
+    resumeLatest: z
+        .boolean()
+        .default(false)
+        .describe("Resume most recent Grok session in cwd (--continue)"),
+    createNewSession: z.boolean().default(false).describe("Force new session"),
+    alwaysApprove: z
+        .boolean()
+        .default(false)
+        .describe("Auto-approve all tool executions (--always-approve)"),
+    permissionMode: z
+        .enum(["default", "acceptEdits", "auto", "dontAsk", "bypassPermissions", "plan"])
+        .optional()
+        .describe("Grok permission mode"),
+    effort: z
+        .enum(["low", "medium", "high", "xhigh", "max"])
+        .optional()
+        .describe("Grok effort level"),
+    reasoningEffort: z.string().optional().describe("Reasoning effort for reasoning models"),
+    approvalStrategy: z
+        .enum(["legacy", "mcp_managed"])
+        .default("legacy")
+        .describe("Approval strategy"),
+    approvalPolicy: z
+        .enum(["strict", "balanced", "permissive"])
+        .optional()
+        .describe("Approval policy override"),
+    mcpServers: z
+        .array(MCP_SERVER_ENUM)
+        .default(["sqry"])
+        .describe("MCP server names for approval tracking (Grok manages its own MCP config via `grok mcp`)"),
+    allowedTools: z
+        .array(z.string())
+        .optional()
+        .describe("Allowed built-in tools (passed as --tools comma list)"),
+    disallowedTools: z
+        .array(z.string())
+        .optional()
+        .describe("Disallowed built-in tools (passed as --disallowed-tools comma list)"),
+    correlationId: z.string().optional().describe("Request trace ID (auto if omitted)"),
+    optimizePrompt: z.boolean().default(false).describe("Optimize prompt before execution"),
+    idleTimeoutMs: z
+        .number()
+        .int()
+        .min(30_000)
+        .max(3_600_000)
+        .optional()
+        .describe("Idle timeout in ms (min 30s, max 1h, omit=CLI default)"),
+    forceRefresh: z
+        .boolean()
+        .default(false)
+        .describe("Bypass dedup and force a fresh CLI run even if a recent identical request exists"),
+}, async ({ prompt, model, outputFormat, sessionId, resumeLatest, createNewSession, alwaysApprove, permissionMode, effort, reasoningEffort, approvalStrategy, approvalPolicy, mcpServers, allowedTools, disallowedTools, correlationId, optimizePrompt, idleTimeoutMs, forceRefresh, }) => {
+    return handleGrokRequestAsync({ sessionManager, asyncJobManager, logger }, {
+        prompt,
+        model,
+        outputFormat,
+        sessionId,
+        resumeLatest,
+        createNewSession,
+        alwaysApprove,
+        permissionMode,
+        effort,
+        reasoningEffort,
+        approvalStrategy,
+        approvalPolicy,
+        mcpServers,
+        allowedTools,
+        disallowedTools,
+        correlationId,
+        optimizePrompt,
+        idleTimeoutMs,
+        forceRefresh,
+    });
 });
 server.tool("llm_job_status", {
-    jobId: z.string().describe("Async job ID from *_request_async")
+    jobId: z.string().describe("Async job ID from *_request_async"),
 }, async ({ jobId }) => {
     const job = asyncJobManager.getJobSnapshot(jobId);
     if (!job) {
         return {
-            content: [{
+            content: [
+                {
                     type: "text",
                     text: JSON.stringify({
                         success: false,
                         error: "Job not found",
-                        jobId
-                    }, null, 2)
-                }],
-            isError: true
+                        jobId,
+                    }, null, 2),
+                },
+            ],
+            isError: true,
         };
     }
     return {
-        content: [{
+        content: [
+            {
                 type: "text",
                 text: JSON.stringify({
                     success: true,
-                    job
-                }, null, 2)
-            }]
+                    job,
+                }, null, 2),
+            },
+        ],
     };
 });
 server.tool("llm_job_result", {
     jobId: z.string().describe("Async job ID from *_request_async"),
-    maxChars: z.number().int().min(1000).max(2000000).default(200000).describe("Max chars returned per stream")
+    maxChars: z
+        .number()
+        .int()
+        .min(1000)
+        .max(2000000)
+        .default(200000)
+        .describe("Max chars returned per stream"),
 }, async ({ jobId, maxChars }) => {
     const result = asyncJobManager.getJobResult(jobId, maxChars);
     if (!result) {
         return {
-            content: [{
+            content: [
+                {
                     type: "text",
                     text: JSON.stringify({
                         success: false,
                         error: "Job not found",
-                        jobId
-                    }, null, 2)
-                }],
-            isError: true
+                        jobId,
+                    }, null, 2),
+                },
+            ],
+            isError: true,
         };
     }
     // Parse stream-json output for Claude async jobs
@@ -1123,50 +2192,68 @@ server.tool("llm_job_result", {
         parsed = parseStreamJson(result.stdout);
     }
     return {
-        content: [{
+        content: [
+            {
                 type: "text",
                 text: JSON.stringify({
                     success: true,
                     result,
-                    ...(parsed ? { parsed: { text: parsed.text, costUsd: parsed.costUsd, usage: parsed.usage, model: parsed.model, numTurns: parsed.numTurns } } : {})
-                }, null, 2)
-            }]
+                    ...(parsed
+                        ? {
+                            parsed: {
+                                text: parsed.text,
+                                costUsd: parsed.costUsd,
+                                usage: parsed.usage,
+                                model: parsed.model,
+                                numTurns: parsed.numTurns,
+                            },
+                        }
+                        : {}),
+                }, null, 2),
+            },
+        ],
     };
 });
 server.tool("llm_job_cancel", {
-    jobId: z.string().describe("Async job ID from *_request_async")
+    jobId: z.string().describe("Async job ID from *_request_async"),
 }, async ({ jobId }) => {
     const cancel = asyncJobManager.cancelJob(jobId);
     if (!cancel.canceled) {
         return {
-            content: [{
+            content: [
+                {
                     type: "text",
                     text: JSON.stringify({
                         success: false,
                         jobId,
-                        reason: cancel.reason || "Unable to cancel"
-                    }, null, 2)
-                }],
-            isError: true
+                        reason: cancel.reason || "Unable to cancel",
+                    }, null, 2),
+                },
+            ],
+            isError: true,
         };
     }
     return {
-        content: [{
+        content: [
+            {
                 type: "text",
                 text: JSON.stringify({
                     success: true,
-                    jobId
-                }, null, 2)
-            }]
+                    jobId,
+                }, null, 2),
+            },
+        ],
     };
 });
 server.tool("llm_process_health", {}, async () => {
     const health = asyncJobManager.getJobHealth();
     return {
-        content: [{
+        content: [
+            {
                 type: "text",
-                text: JSON.stringify({ success: true, ...health }, null, 2)
-            }]
+                text: JSON.stringify({ success: true, ...health }, null, 2),
+            },
+        ],
     };
 });
 //──────────────────────────────────────────────────────────────────────────────
@@ -1174,37 +2261,98 @@ server.tool("llm_process_health", {}, async () => {
 //──────────────────────────────────────────────────────────────────────────────
 server.tool("approval_list", {
     limit: z.number().int().min(1).max(500).default(50).describe("Max number of approval records"),
-    cli: z.enum(["claude", "codex", "gemini"]).optional().describe("Optional CLI filter")
+    cli: z.enum(["claude", "codex", "gemini"]).optional().describe("Optional CLI filter"),
 }, async ({ limit, cli }) => {
     const approvals = approvalManager.list(limit, cli);
     return {
-        content: [{
+        content: [
+            {
                 type: "text",
                 text: JSON.stringify({
                     success: true,
                     count: approvals.length,
-                    approvals
-                }, null, 2)
-            }]
+                    approvals,
+                }, null, 2),
+            },
+        ],
     };
 });
 //──────────────────────────────────────────────────────────────────────────────
 // List Models Tool
 //──────────────────────────────────────────────────────────────────────────────
 server.tool("list_models", {
-    cli: z.preprocess((value) => (value === "" || value === null ? undefined : value), z.enum(["claude", "codex", "gemini"]).optional()).describe("CLI filter (claude|codex|gemini)")
+    cli: z
+        .preprocess(value => (value === "" || value === null ? undefined : value), z.enum(["claude", "codex", "gemini"]).optional())
+        .describe("CLI filter (claude|codex|gemini)"),
 }, async ({ cli }) => {
     const cliInfo = getCliInfo();
     const result = cli ? { [cli]: cliInfo[cli] } : cliInfo;
     return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
 });
+server.tool("cli_versions", {
+    cli: z
+        .preprocess(value => (value === "" || value === null ? undefined : value), z.enum(["claude", "codex", "gemini"]).optional())
+        .describe("CLI filter (claude|codex|gemini)"),
+}, async ({ cli }) => {
+    const versions = await getCliVersions(cli);
+    return { content: [{ type: "text", text: JSON.stringify({ versions }, null, 2) }] };
+});
+server.tool("cli_upgrade", {
+    cli: z.enum(["claude", "codex", "gemini"]).describe("CLI to upgrade"),
+    target: z
+        .string()
+        .min(1)
+        .default("latest")
+        .describe("Package tag/version/target to install (default: latest)"),
+    dryRun: z
+        .boolean()
+        .default(true)
+        .describe("When true, return the upgrade plan without running it"),
+    timeoutMs: z
+        .number()
+        .int()
+        .min(30_000)
+        .max(3_600_000)
+        .optional()
+        .describe("Upgrade timeout in ms when dryRun=false"),
+}, async ({ cli, target, dryRun, timeoutMs }) => {
+    try {
+        const result = await runCliUpgrade({ cli, target, dryRun, timeoutMs, logger });
+        return {
+            content: [
+                {
+                    type: "text",
+                    text: JSON.stringify({
+                        success: true,
+                        ...result,
+                    }, null, 2),
+                },
+            ],
+        };
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        return {
+            content: [
+                {
+                    type: "text",
+                    text: JSON.stringify({
+                        success: false,
+                        error: message,
+                    }, null, 2),
+                },
+            ],
+            isError: true,
+        };
+    }
+});
 //──────────────────────────────────────────────────────────────────────────────
 // Session Management Tools
 //──────────────────────────────────────────────────────────────────────────────
 server.tool("session_create", {
     cli: z.enum(["claude", "codex", "gemini"]).describe("CLI type (claude|codex|gemini)"),
     description: z.string().optional().describe("Session description"),
-    setAsActive: z.boolean().default(true).describe("Set as active session")
+    setAsActive: z.boolean().default(true).describe("Set as active session"),
 }, async ({ cli, description, setAsActive }) => {
     try {
         const session = await sessionManager.createSession(cli, description);
@@ -1213,7 +2361,8 @@ server.tool("session_create", {
         }
         logger.info(`Created new ${cli} session: ${session.id}`);
         return {
-            content: [{
+            content: [
+                {
                     type: "text",
                     text: JSON.stringify({
                         success: true,
@@ -1222,10 +2371,11 @@ server.tool("session_create", {
                             cli: session.cli,
                             description: session.description,
                             createdAt: session.createdAt,
-                            isActive: setAsActive
-                        }
-                    }, null, 2)
-                }]
+                            isActive: setAsActive,
+                        },
+                    }, null, 2),
+                },
+            ],
         };
     }
     catch (error) {
@@ -1233,14 +2383,18 @@ server.tool("session_create", {
     }
 });
 server.tool("session_list", {
-    cli: z.enum(["claude", "codex", "gemini"]).optional().describe("CLI filter (claude|codex|gemini)")
+    cli: z
+        .enum(["claude", "codex", "gemini"])
+        .optional()
+        .describe("CLI filter (claude|codex|gemini)"),
 }, async ({ cli }) => {
     try {
         const sessions = await sessionManager.listSessions(cli);
         const activeSessions = {
             claude: await sessionManager.getActiveSession("claude"),
             codex: await sessionManager.getActiveSession("codex"),
-            gemini: await sessionManager.getActiveSession("gemini")
+            gemini: await sessionManager.getActiveSession("gemini"),
+            grok: await sessionManager.getActiveSession("grok"),
         };
         const sessionList = sessions.map(s => ({
             id: s.id,
@@ -1248,10 +2402,11 @@ server.tool("session_list", {
             description: s.description,
             createdAt: s.createdAt,
             lastUsedAt: s.lastUsedAt,
-            isActive: activeSessions[s.cli]?.id === s.id
+            isActive: activeSessions[s.cli]?.id === s.id,
         }));
         return {
-            content: [{
+            content: [
+                {
                     type: "text",
                     text: JSON.stringify({
                         total: sessionList.length,
@@ -1259,10 +2414,12 @@ server.tool("session_list", {
                         activeSessions: {
                             claude: activeSessions.claude?.id || null,
                             codex: activeSessions.codex?.id || null,
-                            gemini: activeSessions.gemini?.id || null
-                        }
-                    }, null, 2)
-                }]
+                            gemini: activeSessions.gemini?.id || null,
+                            grok: activeSessions.grok?.id || null,
+                        },
+                    }, null, 2),
+                },
+            ],
         };
     }
     catch (error) {
@@ -1271,32 +2428,36 @@ server.tool("session_list", {
 });
 server.tool("session_set_active", {
     cli: z.enum(["claude", "codex", "gemini"]).describe("CLI type (claude|codex|gemini)"),
-    sessionId: z.string().nullable().describe("Session ID (null to clear)")
+    sessionId: z.string().nullable().describe("Session ID (null to clear)"),
 }, async ({ cli, sessionId }) => {
     try {
         const success = await sessionManager.setActiveSession(cli, sessionId || null);
         if (!success) {
             return {
-                content: [{
+                content: [
+                    {
                         type: "text",
                         text: JSON.stringify({
                             success: false,
-                            error: "Session not found or does not belong to the specified CLI"
-                        }, null, 2)
-                    }],
-                isError: true
+                            error: "Session not found or does not belong to the specified CLI",
+                        }, null, 2),
+                    },
+                ],
+                isError: true,
             };
         }
         logger.info(`Set active ${cli} session to: ${sessionId}`);
         return {
-            content: [{
+            content: [
+                {
                     type: "text",
                     text: JSON.stringify({
                         success: true,
                         cli,
-                        activeSessionId: sessionId
-                    }, null, 2)
-                }]
+                        activeSessionId: sessionId,
+                    }, null, 2),
+                },
+            ],
         };
     }
     catch (error) {
@@ -1304,36 +2465,40 @@ server.tool("session_set_active", {
     }
 });
 server.tool("session_delete", {
-    sessionId: z.string().describe("Session ID")
+    sessionId: z.string().describe("Session ID"),
 }, async ({ sessionId }) => {
     try {
         const session = await sessionManager.getSession(sessionId);
         if (!session) {
             return {
-                content: [{
+                content: [
+                    {
                         type: "text",
                         text: JSON.stringify({
                             success: false,
-                            error: "Session not found"
-                        }, null, 2)
-                    }],
-                isError: true
+                            error: "Session not found",
+                        }, null, 2),
+                    },
+                ],
+                isError: true,
             };
         }
         const success = await sessionManager.deleteSession(sessionId);
         logger.info(`Deleted session: ${sessionId}`);
         return {
-            content: [{
+            content: [
+                {
                     type: "text",
                     text: JSON.stringify({
                         success,
                         deletedSession: {
                             id: session.id,
                             cli: session.cli,
-                            description: session.description
-                        }
-                    }, null, 2)
-                }]
+                            description: session.description,
+                        },
+                    }, null, 2),
+                },
+            ],
         };
     }
     catch (error) {
@@ -1341,34 +2506,38 @@ server.tool("session_delete", {
     }
 });
 server.tool("session_get", {
-    sessionId: z.string().describe("Session ID")
+    sessionId: z.string().describe("Session ID"),
 }, async ({ sessionId }) => {
     try {
         const session = await sessionManager.getSession(sessionId);
         if (!session) {
             return {
-                content: [{
+                content: [
+                    {
                         type: "text",
                         text: JSON.stringify({
                             success: false,
-                            error: "Session not found"
-                        }, null, 2)
-                    }],
-                isError: true
+                            error: "Session not found",
+                        }, null, 2),
+                    },
+                ],
+                isError: true,
             };
         }
         const activeSession = await sessionManager.getActiveSession(session.cli);
         return {
-            content: [{
+            content: [
+                {
                     type: "text",
                     text: JSON.stringify({
                         success: true,
                         session: {
                             ...session,
-                            isActive: activeSession?.id === session.id
-                        }
-                    }, null, 2)
-                }]
+                            isActive: activeSession?.id === session.id,
+                        },
+                    }, null, 2),
+                },
+            ],
         };
     }
     catch (error) {
@@ -1376,20 +2545,25 @@ server.tool("session_get", {
     }
 });
 server.tool("session_clear_all", {
-    cli: z.enum(["claude", "codex", "gemini"]).optional().describe("CLI filter (claude|codex|gemini)")
+    cli: z
+        .enum(["claude", "codex", "gemini"])
+        .optional()
+        .describe("CLI filter (claude|codex|gemini)"),
 }, async ({ cli }) => {
     try {
         const count = await sessionManager.clearAllSessions(cli);
-        logger.info(`Cleared ${count} sessions${cli ? ` for ${cli}` : ''}`);
+        logger.info(`Cleared ${count} sessions${cli ? ` for ${cli}` : ""}`);
         return {
-            content: [{
+            content: [
+                {
                     type: "text",
                     text: JSON.stringify({
                         success: true,
                         deletedCount: count,
-                        cli: cli || "all"
-                    }, null, 2)
-                }]
+                        cli: cli || "all",
+                    }, null, 2),
+                },
+            ],
         };
     }
     catch (error) {
@@ -1423,15 +2597,17 @@ function registerHealthResource() {
         server.registerResource("health", "health://status", {
             title: "🏥 Health Status",
             description: "DB connectivity and latency",
-            mimeType: "application/json"
+            mimeType: "application/json",
         }, async () => {
             const health = await checkHealth(db);
             return {
-                contents: [{
+                contents: [
+                    {
                         uri: "health://status",
                         text: JSON.stringify(health, null, 2),
-                        mimeType: "application/json"
-                    }]
+                        mimeType: "application/json",
+                    },
+                ],
             };
         });
         logger.info("Health check resource registered");
@@ -1440,15 +2616,17 @@ function registerHealthResource() {
     server.registerResource("process-health", "metrics://process-health", {
         title: "Process Health",
         description: "Async job health (CPU, memory, zombie detection)",
-        mimeType: "application/json"
+        mimeType: "application/json",
     }, async (uri) => {
         const health = asyncJobManager.getJobHealth();
         return {
-            contents: [{
+            contents: [
+                {
                     uri: uri.href,
                     mimeType: "application/json",
-                    text: JSON.stringify(health, null, 2)
-                }]
+                    text: JSON.stringify(health, null, 2),
+                },
+            ],
         };
     });
     logger.info("Process health resource registered");
@@ -1468,6 +2646,8 @@ async function shutdown(signal) {
             await db.disconnect();
             logger.info("Database connections closed");
         }
+        flightRecorder.close();
+        logger.info("Flight recorder closed");
         process.exit(0);
     }
     catch (error) {
@@ -1492,11 +2672,9 @@ async function main() {
 }
 // Guard: only auto-start when run directly (not imported for testing)
 // Resolve symlinks so `llm-cli-gateway` (npm-linked bin) matches import.meta.url
-const __entryUrl = process.argv[1]
-    ? new URL(realpathSync(process.argv[1]), "file://").href
-    : "";
+const __entryUrl = process.argv[1] ? new URL(realpathSync(process.argv[1]), "file://").href : "";
 if (__entryUrl === import.meta.url) {
-    main().catch((error) => {
+    main().catch(error => {
         logger.error("Fatal server error:", error);
         process.exit(1);
     });