llm-cli-gateway 1.11.0 → 1.12.0

package/CHANGELOG.md

@@ -2,6 +2,120 @@
 
 All notable changes to the llm-cli-gateway project.
 
+## [1.12.0] - 2026-05-27 — Phase 4 slice ζ (working-dir + add-dir cross-provider)
+
+Ships the seventh Phase 4 slice: working-directory and additional-directory
+flags are now reachable across four CLIs in a single bundled PR. Three
+commits land together (feature wiring, contract registration, test-veracity
+regressions) plus this release commit.
+
+### Added — working-dir + add-dir parity for four CLIs
+
+- **Claude** — `claude_request` and `claude_request_async` accept a new
+  `addDir: string[]` field. Threaded through `prepareClaudeRequest` →
+  `prepareClaudeHighImpactFlags` (`src/request-helpers.ts:687`). Each
+  entry emits its own `--add-dir` instance per `claude --help` ("Additional
+  directories to allow tool access to"). Claude has no working-dir flag
+  (uses the process cwd).
+- **Codex** — `codex_request` and `codex_request_async` accept new
+  `workingDir: string` (min 1) and `addDir: string[]` fields. Both flags
+  are already in `CODEX_RESUME_FILTERED_FLAGS` (the original session's cwd
+  and writable-dir policy are inherited on resume), so `prepareCodexRequest`
+  gates emission on `sessionPlan.mode === "new"` — resume argv stays clean
+  rather than emitting then stripping. Emits `-C <DIR>` (one) and
+  `--add-dir <DIR>` (one instance per entry).
+- **Grok** — `grok_request` and `grok_request_async` accept a new
+  `workingDir: string` (min 1) field. `prepareGrokRequest` emits
+  `--cwd <DIR>`. Grok has no `--add-dir` analogue.
+- **Vibe (Mistral)** — `mistral_request` and `mistral_request_async`
+  accept new `workingDir: string` (min 1) and `addDir: string[]` fields.
+  `prepareMistralRequest` (the `request-helpers.ts` helper) emits
+  `--workdir <DIR>` (one) and `--add-dir <DIR>` (one per entry; Vibe's
+  `--help` states the flag "Can be specified multiple times").
+  `buildMistralRetryPrep` threads both fields through to the stale-model
+  recovery argv per the slice-δ retry-path invariant.
+- **Gemini** is not re-wired: `--include-directories` was wired in master
+  before this slice. A regression-guard test in REGRESSIONS Zε asserts
+  the existing wiring stays intact while adjacent contract entries
+  changed.
+
+### Out of scope — worktree flags
+
+Worktree flags (`-w/--worktree` on Claude, Gemini, Grok) create new git
+worktree directories on disk with lifecycle implications and are
+explicitly deferred to a later slice with explicit cleanup semantics.
+
+### Contract surface
+
+`UPSTREAM_CLI_CONTRACTS` updates:
+
+- `claude.flags["--add-dir"]` (arity:"one"; repeated instances accepted)
+- `codex.flags["-C"]` (the gateway only emits the short form; codex
+  0.134.0 accepts `--cd` as an alias but the contract registers exactly
+  what we emit — a future code path that emitted `--cd` would correctly
+  fail the contract check).
+- `codex.flags["--add-dir"]`
+- `grok.flags["--cwd"]`
+- `mistral.flags["--workdir"]`
+- `mistral.flags["--add-dir"]`
+- `mcpParameters` arrays updated for all four CLIs.
+- Six new passing conformance fixtures (`claude-add-dir`,
+  `codex-working-dir`, `codex-add-dir`, `grok-working-dir`,
+  `mistral-working-dir`, `mistral-add-dir`); each is mechanically
+  validated against `validateUpstreamCliArgs` in the REGRESSIONS Zε
+  suite, closing the gap class identified in slice ε round 1.
+
+### Test-veracity audit
+
+Per the standing protocol (`feedback_test_veracity_audit_protocol`),
+this slice's tests were audited by all five LLM reviewers (Codex,
+Gemini, Grok, Mistral, Claude) in async parallel with mandatory
+mutation-probe execution against `docs/plans/test-veracity-audit-slice-zeta.spec.md`.
+
+**Round 1 outcomes:**
+
+- Codex: UNCONDITIONAL APPROVE — all 13 probes [as predicted], all 37
+  tests VERIFIED. Baseline (`npx vitest run` on the slice file: 37/37;
+  `npm test`: 54 files / 853 tests; build + format:check clean).
+- Grok: UNCONDITIONAL APPROVE — all 13 probes [as predicted].
+- Mistral: UNCONDITIONAL APPROVE — all 13 probes [as predicted].
+- Claude: UNCONDITIONAL APPROVE — all 13 probes red as predicted; ran
+  in an isolated `/tmp/zeta-audit-claude` worktree because the four
+  parallel reviewers were concurrently mutating the live tree.
+- Gemini: UNCONDITIONAL APPROVE — all 13 probes [as predicted].
+
+First unanimous round-1 pass on a multi-CLI slice. The 37 new tests
+(816 → 853 total) cover every new field/flag/fixture across REGRESSIONS
+Zα/β/ε:
+
+- **Zα** — Registered tool inputSchema for every new field on every
+  tool (sync + async), including `.min(1)` empty-string rejection on
+  `workingDir`.
+- **Zβ** — `prepare*Request` end-to-end argv emission per CLI. The
+  Codex resume branch asserts NEITHER `-C` NOR `--add-dir` appears
+  in resume argv. `buildMistralRetryPrep` regression catches the
+  slice-δ retry-path bug class. Prepare → contract end-to-end
+  consistency covers all four CLIs.
+- **Zε** — `UPSTREAM_CLI_CONTRACTS` introspection + mechanical
+  fixture validation in the same `it()` block (slice-ε round-1 gap
+  class). Includes a regression guard for the pre-existing Gemini
+  `--include-directories` wiring.
+
+### Mechanical anchors (verify with `rg` before relying)
+
+- `src/request-helpers.ts` — `ClaudeHighImpactFlagsInput.addDir`
+  (`:610`), `prepareClaudeHighImpactFlags` emission (`:686-690`).
+  `PrepareMistralRequestInput.workingDir`/`.addDir` (`:248-264`),
+  `prepareMistralRequest` emission (`:300-307`).
+- `src/index.ts` — `prepareClaudeRequest` (`:1338`),
+  `prepareCodexRequest` new-session gate (`:1687-1700`),
+  `prepareGrokRequest` `--cwd` emission (`:2065-2067`),
+  `prepareMistralRequest` wrapper (`:2153-2168`),
+  `buildMistralRetryPrep` (`:2249-2289`).
+- `src/upstream-contracts.ts` — flag registrations and conformance
+  fixtures for the four CLIs (`:146-149`, `:281-292`, `:438-441`,
+  `:524-533`, plus `mcpParameters` entries).
+
 ## [1.11.0] - 2026-05-27 — Phase 4 slice η (Claude `--fallback-model` + `--json-schema`)
 
 Ships the sixth Phase 4 slice: Claude's reliability fallback and

package/dist/index.d.ts

@@ -157,6 +157,7 @@ export declare function prepareClaudeRequest(params: {
     excludeDynamicSystemPromptSections?: boolean;
     fallbackModel?: string;
     jsonSchema?: string | Record<string, unknown>;
+    addDir?: string[];
 }, runtime?: GatewayServerRuntime): CliRequestPrep | ExtendedToolResponse;
 export interface CodexRequestPrep extends CliRequestPrep {
     /**
@@ -199,6 +200,8 @@ export declare function prepareCodexRequest(params: {
     images?: string[];
     ignoreUserConfig?: boolean;
     ignoreRules?: boolean;
+    workingDir?: string;
+    addDir?: string[];
 }, runtime?: GatewayServerRuntime): CodexRequestPrep | ExtendedToolResponse;
 export declare function prepareGeminiRequest(params: {
     prompt?: string;
@@ -254,6 +257,11 @@ export declare function prepareGrokRequest(params: {
      * iterations for cost / latency control. Mirrors Claude's wiring.
      */
     maxTurns?: number;
+    /**
+     * Phase 4 slice ζ: emit `--cwd <DIR>` so headless callers can set Grok's
+     * working directory without depending on the gateway process's cwd.
+     */
+    workingDir?: string;
 }, runtime?: GatewayServerRuntime): CliRequestPrep | ExtendedToolResponse;
 export declare function prepareMistralRequest(params: {
     prompt?: string;
@@ -280,6 +288,10 @@ export declare function prepareMistralRequest(params: {
     maxTurns?: number;
     /** Phase 4 slice δ: Vibe `--max-price DOLLARS` cumulative-cost cap. */
     maxPrice?: number;
+    /** Phase 4 slice ζ: Vibe `--workdir <DIR>` working-directory parity. */
+    workingDir?: string;
+    /** Phase 4 slice ζ: Vibe `--add-dir <DIR>` repeatable add-dir parity. */
+    addDir?: string[];
 }, runtime?: GatewayServerRuntime): (CliRequestPrep & {
     mistralEnv: Record<string, string>;
 }) | ExtendedToolResponse;
@@ -292,7 +304,7 @@ export declare function prepareMistralRequest(params: {
  * through here, or a fresh-workspace / budgeted run can degrade on
  * the second attempt.
  */
-export declare function buildMistralRetryPrep(params: Pick<MistralRequestParams, "outputFormat" | "permissionMode" | "effort" | "reasoningEffort" | "allowedTools" | "disallowedTools" | "approvalStrategy" | "trust" | "maxTurns" | "maxPrice"> & {
+export declare function buildMistralRetryPrep(params: Pick<MistralRequestParams, "outputFormat" | "permissionMode" | "effort" | "reasoningEffort" | "allowedTools" | "disallowedTools" | "approvalStrategy" | "trust" | "maxTurns" | "maxPrice" | "workingDir" | "addDir"> & {
     effectivePrompt: string;
 }, recoveryModel: string): {
     args: string[];
@@ -368,6 +380,8 @@ export interface GrokRequestParams {
     forceRefresh?: boolean;
     /** Phase 4 slice δ: cap agent-loop iterations via `--max-turns N`. */
     maxTurns?: number;
+    /** Phase 4 slice ζ: emit `--cwd <DIR>` so the CLI uses the specified working directory. */
+    workingDir?: string;
 }
 export declare function handleGrokRequest(deps: HandlerDeps, params: GrokRequestParams): Promise<ExtendedToolResponse>;
 export declare function handleGrokRequestAsync(deps: AsyncHandlerDeps, params: Omit<GrokRequestParams, "optimizeResponse">): Promise<ExtendedToolResponse>;
@@ -398,6 +412,10 @@ export interface MistralRequestParams {
     maxTurns?: number;
     /** Phase 4 slice δ: Vibe `--max-price DOLLARS` cumulative-cost cap. */
     maxPrice?: number;
+    /** Phase 4 slice ζ: Vibe `--workdir <DIR>` working-directory parity. */
+    workingDir?: string;
+    /** Phase 4 slice ζ: Vibe `--add-dir <DIR>` repeatable add-dir parity. */
+    addDir?: string[];
 }
 export declare function handleMistralRequest(deps: HandlerDeps, params: MistralRequestParams): Promise<ExtendedToolResponse>;
 export declare function handleMistralRequestAsync(deps: AsyncHandlerDeps, params: Omit<MistralRequestParams, "optimizeResponse">): Promise<ExtendedToolResponse>;
@@ -430,6 +448,8 @@ export declare function handleCodexRequestAsync(deps: AsyncHandlerDeps, params:
     images?: string[];
     ignoreUserConfig?: boolean;
     ignoreRules?: boolean;
+    workingDir?: string;
+    addDir?: string[];
 }): Promise<ExtendedToolResponse>;
 export declare function createGatewayServer(deps?: GatewayServerDeps): McpServer;
 export {};

package/dist/index.js

@@ -1007,6 +1007,7 @@ export function prepareClaudeRequest(params, runtime = resolveGatewayServerRunti
         excludeDynamicSystemPromptSections: params.excludeDynamicSystemPromptSections,
         fallbackModel: params.fallbackModel,
         jsonSchema: params.jsonSchema,
+        addDir: params.addDir,
     }));
     return {
         corrId,
@@ -1126,6 +1127,19 @@ export function prepareCodexRequest(params, runtime = resolveGatewayServerRuntim
     // and are emitted in both branches.
     let highImpactCleanup;
     if (sessionPlan.mode === "new") {
+        // Phase 4 slice ζ: emit working-dir and add-dir on new sessions only.
+        // Both flags are listed in CODEX_RESUME_FILTERED_FLAGS — resume inherits
+        // the original session's cwd and writable-dir policy, so emitting them
+        // on resume would be silently stripped (wasteful + misleading on argv
+        // logs). Gating here mirrors `--search` / `--sandbox` / `--full-auto`.
+        if (params.workingDir) {
+            args.push("-C", params.workingDir);
+        }
+        if (params.addDir && params.addDir.length > 0) {
+            for (const dir of params.addDir) {
+                args.push("--add-dir", dir);
+            }
+        }
         const high = prepareCodexHighImpactFlags({
             outputSchema: params.outputSchema,
             search: params.search,
@@ -1381,6 +1395,9 @@ export function prepareGrokRequest(params, runtime = resolveGatewayServerRuntime
     if (params.maxTurns !== undefined) {
         args.push("--max-turns", String(params.maxTurns));
     }
+    if (params.workingDir) {
+        args.push("--cwd", params.workingDir);
+    }
     return {
         corrId,
         effectivePrompt,
@@ -1467,6 +1484,8 @@ export function prepareMistralRequest(params, runtime = resolveGatewayServerRunt
         trust: params.trust,
         maxTurns: params.maxTurns,
         maxPrice: params.maxPrice,
+        workingDir: params.workingDir,
+        addDir: params.addDir,
     });
     if (prep.ignoredDisallowedTools) {
         runtime.logger.info(`[${corrId}] Mistral does not support disallowedTools; ignoring (caller passed ${params.disallowedTools?.length ?? 0} entries)`);
@@ -1521,6 +1540,8 @@ export function buildMistralRetryPrep(params, recoveryModel) {
         trust: params.trust,
         maxTurns: params.maxTurns,
         maxPrice: params.maxPrice,
+        workingDir: params.workingDir,
+        addDir: params.addDir,
     });
 }
 function buildCliResponse(cli, stdout, optimizeResponse, corrId, sessionId, prep, durationMs, resumable, outputFormat, warnings) {
@@ -1862,6 +1883,7 @@ export async function handleGrokRequest(deps, params) {
         optimizePrompt: params.optimizePrompt,
         operation: "grok_request",
         maxTurns: params.maxTurns,
+        workingDir: params.workingDir,
     }, runtime);
     if (!("args" in prep))
         return prep;
@@ -1983,6 +2005,7 @@ export async function handleGrokRequestAsync(deps, params) {
         optimizePrompt: params.optimizePrompt,
         operation: "grok_request_async",
         maxTurns: params.maxTurns,
+        workingDir: params.workingDir,
     }, runtime);
     if (!("args" in prep))
         return prep;
@@ -2067,6 +2090,8 @@ export async function handleMistralRequest(deps, params) {
         trust: params.trust,
         maxTurns: params.maxTurns,
         maxPrice: params.maxPrice,
+        workingDir: params.workingDir,
+        addDir: params.addDir,
     }, runtime);
     if (!("args" in prep))
         return prep;
@@ -2202,6 +2227,8 @@ export async function handleMistralRequestAsync(deps, params) {
         trust: params.trust,
         maxTurns: params.maxTurns,
         maxPrice: params.maxPrice,
+        workingDir: params.workingDir,
+        addDir: params.addDir,
     }, runtime);
     if (!("args" in prep))
         return prep;
@@ -2290,6 +2317,8 @@ export async function handleCodexRequestAsync(deps, params) {
         images: params.images,
         ignoreUserConfig: params.ignoreUserConfig,
         ignoreRules: params.ignoreRules,
+        workingDir: params.workingDir,
+        addDir: params.addDir,
     }, runtime);
     if (!("args" in prep))
         return prep;
@@ -2493,6 +2522,11 @@ export function createGatewayServer(deps = {}) {
             .union([z.string(), z.record(z.unknown())])
             .optional()
             .describe("Claude --json-schema: JSON Schema literal (NOT a path) constraining structured output. Object values are JSON.stringify-d; string values are passed verbatim. Use with outputFormat='json'."),
+        // Phase 4 slice ζ — Claude additional-workspace-dirs parity
+        addDir: z
+            .array(z.string())
+            .optional()
+            .describe("Claude --add-dir: additional directories the CLI is allowed to read/write beyond the process cwd. Each entry is emitted as its own --add-dir instance."),
         approvalStrategy: z
             .enum(["legacy", "mcp_managed"])
             .default("legacy")
@@ -2523,7 +2557,7 @@ export function createGatewayServer(deps = {}) {
             .boolean()
             .default(false)
             .describe("Bypass dedup and force a fresh CLI run even if a recent identical request exists"),
-    }, async ({ prompt, promptParts, model, outputFormat, sessionId, continueSession, createNewSession, allowedTools, disallowedTools, dangerouslySkipPermissions, permissionMode, agent, agents, forkSession, systemPrompt, appendSystemPrompt, maxBudgetUsd, maxTurns, effort, excludeDynamicSystemPromptSections, fallbackModel, jsonSchema, approvalStrategy, approvalPolicy, mcpServers, strictMcpConfig, correlationId, optimizePrompt, optimizeResponse, idleTimeoutMs, forceRefresh, }) => {
+    }, async ({ prompt, promptParts, model, outputFormat, sessionId, continueSession, createNewSession, allowedTools, disallowedTools, dangerouslySkipPermissions, permissionMode, agent, agents, forkSession, systemPrompt, appendSystemPrompt, maxBudgetUsd, maxTurns, effort, excludeDynamicSystemPromptSections, fallbackModel, jsonSchema, addDir, approvalStrategy, approvalPolicy, mcpServers, strictMcpConfig, correlationId, optimizePrompt, optimizeResponse, idleTimeoutMs, forceRefresh, }) => {
         const startTime = Date.now();
         if (systemPrompt !== undefined && appendSystemPrompt !== undefined) {
             return createErrorResponse("claude", 1, "", correlationId, new Error("systemPrompt and appendSystemPrompt are mutually exclusive; use one or the other (not both)."));
@@ -2555,6 +2589,7 @@ export function createGatewayServer(deps = {}) {
             excludeDynamicSystemPromptSections,
             fallbackModel,
             jsonSchema,
+            addDir,
         }, runtime);
         if (!("args" in prep))
             return prep;
@@ -2809,7 +2844,17 @@ export function createGatewayServer(deps = {}) {
             .boolean()
             .optional()
             .describe("Codex --ignore-rules: skip project rule files for this run."),
-    }, async ({ prompt, promptParts, model, fullAuto, sandboxMode, askForApproval, useLegacyFullAutoFlag, dangerouslyBypassApprovalsAndSandbox, approvalStrategy, approvalPolicy, mcpServers, sessionId, resumeLatest, createNewSession, correlationId, optimizePrompt, optimizeResponse, idleTimeoutMs, forceRefresh, outputFormat, outputSchema, search, profile, configOverrides, ephemeral, images, ignoreUserConfig, ignoreRules, }) => {
+        // Phase 4 slice ζ — Codex working-dir + add-dir parity (new sessions only).
+        workingDir: z
+            .string()
+            .min(1)
+            .optional()
+            .describe("Codex -C/--cd <DIR>: working root for this session. Emitted on new sessions only; resume inherits the original session's cwd via CODEX_RESUME_FILTERED_FLAGS."),
+        addDir: z
+            .array(z.string())
+            .optional()
+            .describe("Codex --add-dir <DIR>: additional writable workspace directories. Emitted once per entry on new sessions only; resume inherits the original session's writable-dir policy."),
+    }, async ({ prompt, promptParts, model, fullAuto, sandboxMode, askForApproval, useLegacyFullAutoFlag, dangerouslyBypassApprovalsAndSandbox, approvalStrategy, approvalPolicy, mcpServers, sessionId, resumeLatest, createNewSession, correlationId, optimizePrompt, optimizeResponse, idleTimeoutMs, forceRefresh, outputFormat, outputSchema, search, profile, configOverrides, ephemeral, images, ignoreUserConfig, ignoreRules, workingDir, addDir, }) => {
         const startTime = Date.now();
         const prep = prepareCodexRequest({
             prompt,
@@ -2838,6 +2883,8 @@ export function createGatewayServer(deps = {}) {
             images,
             ignoreUserConfig,
             ignoreRules,
+            workingDir,
+            addDir,
         }, runtime);
         if (!("args" in prep))
             return prep;
@@ -3209,7 +3256,13 @@ export function createGatewayServer(deps = {}) {
             .default(false)
             .describe("Bypass dedup and force a fresh CLI run even if a recent identical request exists"),
         maxTurns: MAX_TURNS_SCHEMA.optional().describe("Grok `--max-turns N`: cap on agent-loop iterations for cost / latency control (Phase 4 slice δ). Bounded to safe integers ≤ 10000."),
-    }, async ({ prompt, promptParts, model, outputFormat, sessionId, resumeLatest, createNewSession, alwaysApprove, permissionMode, effort, reasoningEffort, approvalStrategy, approvalPolicy, mcpServers, allowedTools, disallowedTools, correlationId, optimizePrompt, optimizeResponse, idleTimeoutMs, forceRefresh, maxTurns, }) => {
+        // Phase 4 slice ζ — Grok working-directory parity.
+        workingDir: z
+            .string()
+            .min(1)
+            .optional()
+            .describe("Grok --cwd <DIR>: working directory for this invocation. Lets headless callers run Grok against a directory other than the gateway process's cwd."),
+    }, async ({ prompt, promptParts, model, outputFormat, sessionId, resumeLatest, createNewSession, alwaysApprove, permissionMode, effort, reasoningEffort, approvalStrategy, approvalPolicy, mcpServers, allowedTools, disallowedTools, correlationId, optimizePrompt, optimizeResponse, idleTimeoutMs, forceRefresh, maxTurns, workingDir, }) => {
         return handleGrokRequest({ sessionManager, logger, runtime }, {
             prompt,
             promptParts,
@@ -3233,6 +3286,7 @@ export function createGatewayServer(deps = {}) {
             idleTimeoutMs,
             forceRefresh,
             maxTurns,
+            workingDir,
         });
     });
     //──────────────────────────────────────────────────────────────────────────────
@@ -3312,7 +3366,17 @@ export function createGatewayServer(deps = {}) {
             .describe("Emit `--trust` so Vibe trusts the cwd for this invocation only (not persisted to trusted_folders.toml) and skips the interactive trust prompt (Phase 4 slice γ)."),
         maxTurns: MAX_TURNS_SCHEMA.optional().describe("Vibe `--max-turns N`: cap the agent-loop iteration count (programmatic mode only, Phase 4 slice δ). Bounded to safe integers ≤ 10000."),
         maxPrice: MAX_PRICE_SCHEMA.optional().describe("Vibe `--max-price DOLLARS`: interrupt the session when cumulative cost crosses this cap (programmatic mode only, Phase 4 slice δ). Bounded to finite values ≤ 10000 USD."),
-    }, async ({ prompt, promptParts, model, outputFormat, sessionId, resumeLatest, createNewSession, permissionMode, effort, reasoningEffort, approvalStrategy, approvalPolicy, mcpServers, allowedTools, disallowedTools, correlationId, optimizePrompt, optimizeResponse, idleTimeoutMs, forceRefresh, trust, maxTurns, maxPrice, }) => {
+        // Phase 4 slice ζ — Vibe working-directory + additional-dirs parity.
+        workingDir: z
+            .string()
+            .min(1)
+            .optional()
+            .describe("Vibe --workdir <DIR>: change to this directory before running. Single value (Vibe accepts one --workdir per invocation)."),
+        addDir: z
+            .array(z.string())
+            .optional()
+            .describe("Vibe --add-dir <DIR>: additional writable workspace directories. Each entry is emitted as its own --add-dir instance (Vibe states this flag may be specified multiple times)."),
+    }, async ({ prompt, promptParts, model, outputFormat, sessionId, resumeLatest, createNewSession, permissionMode, effort, reasoningEffort, approvalStrategy, approvalPolicy, mcpServers, allowedTools, disallowedTools, correlationId, optimizePrompt, optimizeResponse, idleTimeoutMs, forceRefresh, trust, maxTurns, maxPrice, workingDir, addDir, }) => {
         return handleMistralRequest({ sessionManager, logger, runtime }, {
             prompt,
             promptParts,
@@ -3337,6 +3401,8 @@ export function createGatewayServer(deps = {}) {
             trust,
             maxTurns,
             maxPrice,
+            workingDir,
+            addDir,
         });
     });
     //──────────────────────────────────────────────────────────────────────────────
@@ -3432,6 +3498,11 @@ export function createGatewayServer(deps = {}) {
                 .union([z.string(), z.record(z.unknown())])
                 .optional()
                 .describe("Claude --json-schema: JSON Schema literal (NOT a path) constraining structured output. Object values are JSON.stringify-d; string values are passed verbatim. Use with outputFormat='json'."),
+            // Phase 4 slice ζ — Claude additional-workspace-dirs parity
+            addDir: z
+                .array(z.string())
+                .optional()
+                .describe("Claude --add-dir: additional directories the CLI is allowed to read/write beyond the process cwd. Each entry is emitted as its own --add-dir instance."),
             approvalStrategy: z
                 .enum(["legacy", "mcp_managed"])
                 .default("legacy")
@@ -3461,7 +3532,7 @@ export function createGatewayServer(deps = {}) {
                 .boolean()
                 .default(false)
                 .describe("Bypass dedup and force a fresh CLI run even if a recent identical request exists"),
-        }, async ({ prompt, promptParts, model, outputFormat, sessionId, continueSession, createNewSession, allowedTools, disallowedTools, dangerouslySkipPermissions, permissionMode, agent, agents, forkSession, systemPrompt, appendSystemPrompt, maxBudgetUsd, maxTurns, effort, excludeDynamicSystemPromptSections, fallbackModel, jsonSchema, approvalStrategy, approvalPolicy, mcpServers, strictMcpConfig, correlationId, optimizePrompt, idleTimeoutMs, forceRefresh, }) => {
+        }, async ({ prompt, promptParts, model, outputFormat, sessionId, continueSession, createNewSession, allowedTools, disallowedTools, dangerouslySkipPermissions, permissionMode, agent, agents, forkSession, systemPrompt, appendSystemPrompt, maxBudgetUsd, maxTurns, effort, excludeDynamicSystemPromptSections, fallbackModel, jsonSchema, addDir, approvalStrategy, approvalPolicy, mcpServers, strictMcpConfig, correlationId, optimizePrompt, idleTimeoutMs, forceRefresh, }) => {
             if (systemPrompt !== undefined && appendSystemPrompt !== undefined) {
                 return createErrorResponse("claude", 1, "", correlationId, new Error("systemPrompt and appendSystemPrompt are mutually exclusive; use one or the other (not both)."));
             }
@@ -3492,6 +3563,7 @@ export function createGatewayServer(deps = {}) {
                 excludeDynamicSystemPromptSections,
                 fallbackModel,
                 jsonSchema,
+                addDir,
             }, runtime);
             if (!("args" in prep))
                 return prep;
@@ -3646,7 +3718,17 @@ export function createGatewayServer(deps = {}) {
             images: z.array(z.string()).optional().describe("Codex -i <path>: image attachments."),
             ignoreUserConfig: z.boolean().optional().describe("Codex --ignore-user-config."),
             ignoreRules: z.boolean().optional().describe("Codex --ignore-rules."),
-        }, async ({ prompt, promptParts, model, fullAuto, sandboxMode, askForApproval, useLegacyFullAutoFlag, dangerouslyBypassApprovalsAndSandbox, approvalStrategy, approvalPolicy, mcpServers, sessionId, resumeLatest, createNewSession, correlationId, optimizePrompt, idleTimeoutMs, forceRefresh, outputFormat, outputSchema, search, profile, configOverrides, ephemeral, images, ignoreUserConfig, ignoreRules, }) => {
+            // Phase 4 slice ζ — Codex working-dir + add-dir parity (new sessions only).
+            workingDir: z
+                .string()
+                .min(1)
+                .optional()
+                .describe("Codex -C/--cd <DIR>: working root for this session. New sessions only; resume inherits the original session's cwd."),
+            addDir: z
+                .array(z.string())
+                .optional()
+                .describe("Codex --add-dir <DIR>: additional writable workspace directories (repeat per entry). New sessions only."),
+        }, async ({ prompt, promptParts, model, fullAuto, sandboxMode, askForApproval, useLegacyFullAutoFlag, dangerouslyBypassApprovalsAndSandbox, approvalStrategy, approvalPolicy, mcpServers, sessionId, resumeLatest, createNewSession, correlationId, optimizePrompt, idleTimeoutMs, forceRefresh, outputFormat, outputSchema, search, profile, configOverrides, ephemeral, images, ignoreUserConfig, ignoreRules, workingDir, addDir, }) => {
             return handleCodexRequestAsync({ sessionManager, asyncJobManager, logger, runtime }, {
                 prompt,
                 promptParts,
@@ -3675,6 +3757,8 @@ export function createGatewayServer(deps = {}) {
                 images,
                 ignoreUserConfig,
                 ignoreRules,
+                workingDir,
+                addDir,
             });
         });
         server.tool("gemini_request_async", {
@@ -3841,7 +3925,13 @@ export function createGatewayServer(deps = {}) {
                 .default(false)
                 .describe("Bypass dedup and force a fresh CLI run even if a recent identical request exists"),
             maxTurns: MAX_TURNS_SCHEMA.optional().describe("Grok `--max-turns N`: cap on agent-loop iterations for cost / latency control (Phase 4 slice δ). Bounded to safe integers ≤ 10000."),
-        }, async ({ prompt, promptParts, model, outputFormat, sessionId, resumeLatest, createNewSession, alwaysApprove, permissionMode, effort, reasoningEffort, approvalStrategy, approvalPolicy, mcpServers, allowedTools, disallowedTools, correlationId, optimizePrompt, idleTimeoutMs, forceRefresh, maxTurns, }) => {
+            // Phase 4 slice ζ — Grok working-directory parity.
+            workingDir: z
+                .string()
+                .min(1)
+                .optional()
+                .describe("Grok --cwd <DIR>: working directory for this invocation. Lets headless callers run Grok against a directory other than the gateway process's cwd."),
+        }, async ({ prompt, promptParts, model, outputFormat, sessionId, resumeLatest, createNewSession, alwaysApprove, permissionMode, effort, reasoningEffort, approvalStrategy, approvalPolicy, mcpServers, allowedTools, disallowedTools, correlationId, optimizePrompt, idleTimeoutMs, forceRefresh, maxTurns, workingDir, }) => {
             return handleGrokRequestAsync({ sessionManager, asyncJobManager, logger, runtime }, {
                 prompt,
                 promptParts,
@@ -3864,6 +3954,7 @@ export function createGatewayServer(deps = {}) {
                 idleTimeoutMs,
                 forceRefresh,
                 maxTurns,
+                workingDir,
             });
         });
         server.tool("mistral_request_async", {
@@ -3939,7 +4030,17 @@ export function createGatewayServer(deps = {}) {
                 .describe("Emit `--trust` so Vibe trusts the cwd for this invocation only (not persisted to trusted_folders.toml) and skips the interactive trust prompt (Phase 4 slice γ)."),
             maxTurns: MAX_TURNS_SCHEMA.optional().describe("Vibe `--max-turns N`: cap the agent-loop iteration count (programmatic mode only, Phase 4 slice δ). Bounded to safe integers ≤ 10000."),
             maxPrice: MAX_PRICE_SCHEMA.optional().describe("Vibe `--max-price DOLLARS`: interrupt the session when cumulative cost crosses this cap (programmatic mode only, Phase 4 slice δ). Bounded to finite values ≤ 10000 USD."),
-        }, async ({ prompt, promptParts, model, outputFormat, sessionId, resumeLatest, createNewSession, permissionMode, effort, reasoningEffort, approvalStrategy, approvalPolicy, mcpServers, allowedTools, disallowedTools, correlationId, optimizePrompt, idleTimeoutMs, forceRefresh, trust, maxTurns, maxPrice, }) => {
+            // Phase 4 slice ζ — Vibe working-directory + additional-dirs parity.
+            workingDir: z
+                .string()
+                .min(1)
+                .optional()
+                .describe("Vibe --workdir <DIR>: change to this directory before running. Single value per invocation."),
+            addDir: z
+                .array(z.string())
+                .optional()
+                .describe("Vibe --add-dir <DIR>: additional writable workspace directories. Each entry is emitted as its own --add-dir instance."),
+        }, async ({ prompt, promptParts, model, outputFormat, sessionId, resumeLatest, createNewSession, permissionMode, effort, reasoningEffort, approvalStrategy, approvalPolicy, mcpServers, allowedTools, disallowedTools, correlationId, optimizePrompt, idleTimeoutMs, forceRefresh, trust, maxTurns, maxPrice, workingDir, addDir, }) => {
             return handleMistralRequestAsync({ sessionManager, asyncJobManager, logger, runtime }, {
                 prompt,
                 promptParts,
@@ -3963,6 +4064,8 @@ export function createGatewayServer(deps = {}) {
                 trust,
                 maxTurns,
                 maxPrice,
+                workingDir,
+                addDir,
             });
         });
         server.tool("llm_job_status", {

package/dist/request-helpers.d.ts

@@ -125,6 +125,17 @@ export interface PrepareMistralRequestInput {
      * only).
      */
     maxPrice?: number;
+    /**
+     * Phase 4 slice ζ: emit `--workdir <DIR>` so Vibe changes into the named
+     * directory before running. Single value (Vibe accepts one --workdir).
+     */
+    workingDir?: string;
+    /**
+     * Phase 4 slice ζ: emit `--add-dir <DIR>` per directory. Vibe's `--help`
+     * states the flag "Can be specified multiple times" — each entry is its
+     * own argv pair.
+     */
+    addDir?: string[];
 }
 export interface PrepareMistralRequestResult {
     args: string[];
@@ -364,6 +375,15 @@ export interface ClaudeHighImpactFlagsInput {
      * `--output-schema`, which takes a path).
      */
     jsonSchema?: string | Record<string, unknown>;
+    /**
+     * Phase 4 slice ζ — Claude `--add-dir <dirs...>`. Additional directories the
+     * Claude CLI is allowed to read/write beyond the process cwd. The CLI accepts
+     * a single variadic flag (space-separated values) per `claude --help`; we
+     * emit one `--add-dir` instance per directory so each path is its own argv
+     * token (survives any future tightening of the variadic parser without
+     * changing the call site).
+     */
+    addDir?: string[];
 }
 /**
  * Emit Claude high-impact feature flags (U25) as a flat argv segment.

package/dist/request-helpers.js

@@ -185,6 +185,14 @@ export function prepareMistralRequest(input) {
     if (input.maxPrice !== undefined) {
         args.push("--max-price", String(input.maxPrice));
     }
+    if (input.workingDir) {
+        args.push("--workdir", input.workingDir);
+    }
+    if (input.addDir && input.addDir.length > 0) {
+        for (const dir of input.addDir) {
+            args.push("--add-dir", dir);
+        }
+    }
     const ignoredDisallowedTools = Boolean(input.disallowedTools && input.disallowedTools.length > 0);
     return { args, env, ignoredDisallowedTools };
 }
@@ -445,6 +453,11 @@ export function prepareClaudeHighImpactFlags(input) {
         const schemaArg = typeof input.jsonSchema === "string" ? input.jsonSchema : JSON.stringify(input.jsonSchema);
         args.push("--json-schema", schemaArg);
     }
+    if (input.addDir && input.addDir.length > 0) {
+        for (const dir of input.addDir) {
+            args.push("--add-dir", dir);
+        }
+    }
     return args;
 }
 //──────────────────────────────────────────────────────────────────────────────

package/dist/upstream-contracts.js

@@ -39,6 +39,8 @@ export const UPSTREAM_CLI_CONTRACTS = {
             "excludeDynamicSystemPromptSections",
             "fallbackModel",
             "jsonSchema",
+            // Phase 4 slice ζ
+            "addDir",
             "approvalStrategy",
             "mcpServers",
             "strictMcpConfig",
@@ -88,6 +90,10 @@ export const UPSTREAM_CLI_CONTRACTS = {
                 arity: "one",
                 description: "JSON Schema literal constraining structured output",
             },
+            "--add-dir": {
+                arity: "one",
+                description: "Additional workspace directory (Phase 4 slice ζ; repeat once per directory)",
+            },
             "--continue": { arity: "none", description: "Continue active session" },
             "--session-id": { arity: "one", description: "Session id" },
         },
@@ -128,6 +134,14 @@ export const UPSTREAM_CLI_CONTRACTS = {
                 ],
                 expect: "pass",
             },
+            {
+                // Phase 4 slice ζ: --add-dir wired through prepareClaudeHighImpactFlags.
+                // Repeated once per directory; each instance has arity:"one".
+                id: "claude-add-dir",
+                description: "Phase 4 slice ζ: repeated --add-dir is accepted",
+                args: ["-p", "hello", "--add-dir", "/tmp/a", "--add-dir", "/tmp/b"],
+                expect: "pass",
+            },
         ],
     },
     codex: {
@@ -164,6 +178,9 @@ export const UPSTREAM_CLI_CONTRACTS = {
             "images",
             "ignoreUserConfig",
             "ignoreRules",
+            // Phase 4 slice ζ
+            "workingDir",
+            "addDir",
         ],
         resumeOnlyFlags: ["--last"],
         // Phase 4 slice α (v1.8.0) verified that `codex exec resume` accepts
@@ -203,6 +220,18 @@ export const UPSTREAM_CLI_CONTRACTS = {
             "-i": { arity: "one", description: "Image path" },
             "--ignore-user-config": { arity: "none", description: "Ignore user config" },
             "--ignore-rules": { arity: "none", description: "Ignore rule files" },
+            // The gateway only ever emits the short form `-C` (codex 0.134.0 accepts
+            // both `-C` and `--cd` as aliases). The contract registers exactly what
+            // we emit; if a future code path emits `--cd` instead, the contract
+            // check will fail loudly — which is the intended catch.
+            "-C": {
+                arity: "one",
+                description: "Working root for the session (Phase 4 slice ζ; new sessions only)",
+            },
+            "--add-dir": {
+                arity: "one",
+                description: "Additional writable workspace directory (Phase 4 slice ζ; repeat once per directory; new sessions only)",
+            },
         },
         env: {},
         conformanceFixtures: [
@@ -239,6 +268,26 @@ export const UPSTREAM_CLI_CONTRACTS = {
                 args: ["exec", "resume", "--search", "session-id", "hello"],
                 expect: "fail",
             },
+            {
+                id: "codex-working-dir",
+                description: "Phase 4 slice ζ: -C <DIR> accepted on a new session",
+                args: ["exec", "--skip-git-repo-check", "-C", "/tmp/work", "hello"],
+                expect: "pass",
+            },
+            {
+                id: "codex-add-dir",
+                description: "Phase 4 slice ζ: repeated --add-dir accepted on a new session",
+                args: [
+                    "exec",
+                    "--skip-git-repo-check",
+                    "--add-dir",
+                    "/tmp/a",
+                    "--add-dir",
+                    "/tmp/b",
+                    "hello",
+                ],
+                expect: "pass",
+            },
         ],
     },
     gemini: {
@@ -350,6 +399,8 @@ export const UPSTREAM_CLI_CONTRACTS = {
             "disallowedTools",
             // Phase 4 slice δ
             "maxTurns",
+            // Phase 4 slice ζ
+            "workingDir",
         ],
         flags: {
             "-p": { arity: "one", description: "Prompt text" },
@@ -379,6 +430,10 @@ export const UPSTREAM_CLI_CONTRACTS = {
                 pattern: /^[1-9][0-9]*$/,
                 description: "Agent-loop iteration cap (Phase 4 slice δ)",
             },
+            "--cwd": {
+                arity: "one",
+                description: "Working directory for the invocation (Phase 4 slice ζ)",
+            },
         },
         env: {},
         conformanceFixtures: [
@@ -406,6 +461,12 @@ export const UPSTREAM_CLI_CONTRACTS = {
                 args: ["-p", "hello", "--max-turns", "0"],
                 expect: "fail",
             },
+            {
+                id: "grok-working-dir",
+                description: "Phase 4 slice ζ: --cwd <DIR> is accepted",
+                args: ["-p", "hello", "--cwd", "/tmp/work"],
+                expect: "pass",
+            },
         ],
     },
     mistral: {
@@ -434,6 +495,9 @@ export const UPSTREAM_CLI_CONTRACTS = {
             // Phase 4 slice δ
             "maxTurns",
             "maxPrice",
+            // Phase 4 slice ζ
+            "workingDir",
+            "addDir",
         ],
         flags: {
             "-p": { arity: "one", description: "Prompt text" },
@@ -468,6 +532,14 @@ export const UPSTREAM_CLI_CONTRACTS = {
                 pattern: /^(0|[1-9][0-9]*)(\.[0-9]+)?$/,
                 description: "Cumulative cost cap in USD (Phase 4 slice δ, programmatic mode only)",
             },
+            "--workdir": {
+                arity: "one",
+                description: "Working directory for the invocation (Phase 4 slice ζ)",
+            },
+            "--add-dir": {
+                arity: "one",
+                description: "Additional writable workspace directory (Phase 4 slice ζ; repeat once per directory)",
+            },
         },
         env: {
             VIBE_ACTIVE_MODEL: {
@@ -512,6 +584,29 @@ export const UPSTREAM_CLI_CONTRACTS = {
                 env: { VIBE_ACTIVE_MODEL: "mistral-medium-3.5" },
                 expect: "fail",
             },
+            {
+                id: "mistral-working-dir",
+                description: "Phase 4 slice ζ: --workdir <DIR> is accepted",
+                args: ["-p", "hello", "--agent", "auto-approve", "--workdir", "/tmp/work"],
+                env: { VIBE_ACTIVE_MODEL: "mistral-medium-3.5" },
+                expect: "pass",
+            },
+            {
+                id: "mistral-add-dir",
+                description: "Phase 4 slice ζ: repeated --add-dir is accepted",
+                args: [
+                    "-p",
+                    "hello",
+                    "--agent",
+                    "auto-approve",
+                    "--add-dir",
+                    "/tmp/a",
+                    "--add-dir",
+                    "/tmp/b",
+                ],
+                env: { VIBE_ACTIVE_MODEL: "mistral-medium-3.5" },
+                expect: "pass",
+            },
         ],
     },
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "llm-cli-gateway",
-  "version": "1.11.0",
+  "version": "1.12.0",
   "mcpName": "io.github.verivus-oss/llm-cli-gateway",
   "description": "MCP server providing unified access to Claude Code, Codex, Gemini, Grok, and Mistral Vibe CLIs with session management, retry logic, async job orchestration, durable job results, and cross-LLM validation.",
   "license": "MIT",