llm-cli-gateway 1.17.4 → 1.17.6

package/dist/db.js

@@ -1,7 +1,4 @@
 import { noopLogger } from "./logger.js";
-/**
- * Database connection manager for PostgreSQL-backed sessions.
- */
 export class DatabaseConnection {
     logger;
     pool = null;
@@ -13,12 +10,8 @@ export class DatabaseConnection {
         }
         this.config = config;
     }
-    /**
-     * Initialize connection to PostgreSQL.
-     */
     async connect() {
         const { Pool } = await importOptionalPg();
-        // Initialize PostgreSQL pool
         const poolConfig = {
             connectionString: this.config.database.connectionString,
             max: this.config.database.pool.max,
@@ -27,7 +20,6 @@ export class DatabaseConnection {
             statement_timeout: this.config.database.pool.statementTimeout,
         };
         this.pool = new Pool(poolConfig);
-        // Test PostgreSQL connection
         try {
             const client = await this.pool.connect();
             await client.query("SELECT 1");
@@ -39,9 +31,6 @@ export class DatabaseConnection {
             throw new Error(`Failed to connect to PostgreSQL: ${error instanceof Error ? error.message : String(error)}`);
         }
     }
-    /**
-     * Graceful shutdown - close all connections
-     */
     async disconnect() {
         this.logger.info("Disconnecting database connections");
         const errors = [];
@@ -58,14 +47,10 @@ export class DatabaseConnection {
             throw new Error(`Disconnect errors: ${errors.map(e => e.message).join("; ")}`);
         }
     }
-    /**
-     * Health check for PostgreSQL.
-     */
     async healthCheck() {
         const result = {
             postgres: { connected: false, latency: 0 },
         };
-        // Check PostgreSQL
         if (this.pool) {
             const pgStart = Date.now();
             let client = null;
@@ -79,7 +64,6 @@ export class DatabaseConnection {
                 result.postgres.connected = false;
             }
             finally {
-                // Always release the client to prevent connection leaks
                 if (client) {
                     client.release();
                 }
@@ -90,9 +74,6 @@ export class DatabaseConnection {
         });
         return result;
     }
-    /**
-     * Get PostgreSQL pool
-     */
     getPool() {
         if (!this.pool) {
             throw new Error("PostgreSQL pool not initialized");
@@ -111,9 +92,6 @@ async function importOptionalPg() {
         throw error;
     }
 }
-/**
- * Factory function to create and connect DatabaseConnection
- */
 export async function createDatabaseConnection(config, logger) {
     const db = new DatabaseConnection(config, logger);
     await db.connect();

package/dist/doctor.d.ts

@@ -3,15 +3,6 @@ import { type ProviderLoginStatus } from "./provider-status.js";
 import type { FlightRecorderQuery } from "./flight-recorder.js";
 import { type CacheAwarenessConfig } from "./config.js";
 export type CliType = "claude" | "codex" | "gemini" | "grok" | "mistral";
-/**
- * Slice 3 cross-cutting: doctor report block summarising the gateway's
- * cache-awareness posture. Always PRESENT in the report (zeroed when the
- * flight recorder has no rows for the last 24h).
- *
- * `enabled_features` is an empty array (NOT omitted) when all flags are
- * off so callers can distinguish "configured but dormant" from
- * "cache_awareness block missing".
- */
 export interface CacheAwarenessReport {
     enabled_features: Array<"anthropic_cache_control" | "ttl_warnings">;
     last_24h: {
@@ -33,42 +24,20 @@ export interface VibeSessionLoggingStatus {
     note: string;
 }
 export interface GeminiConfigStatus {
-    /** Presence of a project-local `GEMINI.md` in the gateway's cwd. */
     project_gemini_md_present: boolean;
     project_gemini_md_path: string;
-    /** Presence of `~/.gemini/GEMINI.md`. */
     user_gemini_md_present: boolean;
     user_gemini_md_path: string;
-    /** Presence and contents of `~/.gemini/settings.json` `mcpServers` block. */
     settings_json_present: boolean;
     settings_json_path: string;
     mcp_servers_registered: string[];
-    /** Per-server reconciliation against the gateway's `--allowed-mcp-server-names` whitelist. */
     mcp_reconciliation: {
         whitelisted: string[];
         missing_from_settings: string[];
     };
     next_actions: string[];
 }
-/**
- * Probe ~/.vibe/config.toml to see whether session_logging is enabled. Current
- * Mistral Vibe defaults session logging to enabled; an explicit
- * `[session_logging] enabled = false` disables `--continue` / `--resume`.
- * The probe is read-only: the gateway never mutates this file.
- */
 export declare function checkVibeSessionLogging(home?: string): VibeSessionLoggingStatus;
-/**
- * U27: Probe Gemini's project/user config locations.
- *
- * - `./GEMINI.md` (gateway cwd) and `~/.gemini/GEMINI.md` are documented
- *   "context" surfaces. Missing both means Gemini has no project-specific
- *   guidance.
- * - `~/.gemini/settings.json` defines registered MCP servers (`mcpServers`
- *   block). The gateway tracks its own whitelist (`CLAUDE_MCP_SERVER_NAMES`)
- *   and surfaces a reconciliation warning for each whitelisted server not
- *   present in settings.json so callers don't ship requests for unregistered
- *   servers.
- */
 export declare function checkGeminiConfig(cwd?: string, home?: string, whitelist?: readonly string[]): GeminiConfigStatus;
 export interface DoctorReport {
     schema_version: "1.0";
@@ -136,35 +105,17 @@ export interface DoctorReport {
         note: string;
         recommendation: string;
         how_to_check: string;
-        /** Whether the expensive installed binary probe was performed (requires --probe-upstream). */
         probed: boolean;
-        /** Cheap installed versions (always present when CLIs are detected). */
         installed_versions: Partial<Record<CliType, string | null>>;
-        /** Lightweight declared contracts (always present, no spawning). */
         contracts: ReturnType<typeof import("./upstream-contracts.js").buildUpstreamContractReport>;
-        /** Full probed report only when --probe-upstream was used. */
         probe_report?: ReturnType<typeof import("./upstream-contracts.js").buildUpstreamContractReport>;
     };
     next_actions: string[];
 }
 export interface CreateDoctorReportOptions {
     env?: NodeJS.ProcessEnv;
-    /**
-     * Optional read access to the flight recorder. Drives the
-     * cache_awareness.last_24h and per_cli aggregates. When absent, those
-     * blocks report zeroed aggregates (still PRESENT in the report).
-     */
     flightRecorder?: FlightRecorderQuery;
-    /**
-     * Optional CacheAwarenessConfig. Drives `enabled_features`. When
-     * absent, `enabled_features` is empty (all behaviour considered off).
-     */
     cacheAwareness?: CacheAwarenessConfig;
-    /**
-     * When true, perform the (potentially slow) installed CLI --help probe
-     * for upstream contract drift detection. This is opt-in because it
-     * spawns the real provider CLIs.
-     */
     probeUpstream?: boolean;
 }
 export declare function createDoctorReport(envOrOptions?: NodeJS.ProcessEnv | CreateDoctorReportOptions): DoctorReport;

package/dist/doctor.js

@@ -10,12 +10,6 @@ import { loadCacheAwarenessConfig } from "./config.js";
 import { computeGlobalCacheStats } from "./cache-stats.js";
 import { FlightRecorder, resolveFlightRecorderDbPath } from "./flight-recorder.js";
 import { buildUpstreamContractReport } from "./upstream-contracts.js";
-/**
- * Probe ~/.vibe/config.toml to see whether session_logging is enabled. Current
- * Mistral Vibe defaults session logging to enabled; an explicit
- * `[session_logging] enabled = false` disables `--continue` / `--resume`.
- * The probe is read-only: the gateway never mutates this file.
- */
 export function checkVibeSessionLogging(home = homedir()) {
     const configPath = join(home, ".vibe", "config.toml");
     if (!existsSync(configPath)) {
@@ -56,10 +50,6 @@ export function checkVibeSessionLogging(home = homedir()) {
         };
     }
 }
-/**
- * Tiny TOML probe focused on `[session_logging] enabled = ...`. Avoids pulling
- * in the full `toml` parser when only one boolean is needed.
- */
 function parseVibeSessionLoggingEnabled(text) {
     const lines = text.split(/\r?\n/);
     let inSection = false;
@@ -84,7 +74,6 @@ function parseVibeSessionLoggingEnabled(text) {
             }
         }
         else {
-            // Allow dotted form: session_logging.enabled = true
             const dotted = line.match(/^session_logging\.enabled\s*=\s*(.+)$/);
             if (dotted) {
                 const value = dotted[1].trim().toLowerCase();
@@ -98,18 +87,6 @@ function parseVibeSessionLoggingEnabled(text) {
     }
     return undefined;
 }
-/**
- * U27: Probe Gemini's project/user config locations.
- *
- * - `./GEMINI.md` (gateway cwd) and `~/.gemini/GEMINI.md` are documented
- *   "context" surfaces. Missing both means Gemini has no project-specific
- *   guidance.
- * - `~/.gemini/settings.json` defines registered MCP servers (`mcpServers`
- *   block). The gateway tracks its own whitelist (`CLAUDE_MCP_SERVER_NAMES`)
- *   and surfaces a reconciliation warning for each whitelisted server not
- *   present in settings.json so callers don't ship requests for unregistered
- *   servers.
- */
 export function checkGeminiConfig(cwd = process.cwd(), home = homedir(), whitelist = CLAUDE_MCP_SERVER_NAMES) {
     const projectGeminiMd = join(cwd, "GEMINI.md");
     const userGeminiMd = join(home, ".gemini", "GEMINI.md");
@@ -127,7 +104,6 @@ export function checkGeminiConfig(cwd = process.cwd(), home = homedir(), whiteli
             }
         }
         catch {
-            // Best-effort: leave list empty so the next_action surfaces the gap.
         }
     }
     const missingFromSettings = whitelist.filter(name => !mcpServersRegistered.includes(name));
@@ -165,7 +141,6 @@ function packageVersion() {
             return parsed.version || "unknown";
         }
         catch {
-            // Try next candidate.
         }
     }
     return "unknown";
@@ -204,10 +179,6 @@ function chatGPTConnectorUrl(env, rawPublicUrl) {
         return null;
     }
 }
-/**
- * Build the cache_awareness block. ALWAYS present in the report; fields
- * are zeroed when the flight recorder is missing or empty.
- */
 function buildCacheAwarenessReport(opts) {
     const enabled = [];
     if (opts.cacheAwareness?.emitAnthropicCacheControl) {
@@ -264,7 +235,6 @@ function buildCacheAwarenessReport(opts) {
     };
 }
 export function createDoctorReport(envOrOptions = process.env) {
-    // Preserve back-compat: previous signature accepted a bare `env` object.
     const opts = isCreateDoctorReportOptions(envOrOptions)
         ? envOrOptions
         : { env: envOrOptions };
@@ -351,14 +321,10 @@ export function createDoctorReport(envOrOptions = process.env) {
             report.next_actions.push(`${name}: ${provider.login_guidance.summary}`);
         }
     }
-    // Mistral-specific: surface the session_logging toggle BEFORE a --continue/--resume
-    // request fails opaquely. The check is read-only; the gateway never mutates the file.
     const vibeStatus = report.client_config.vibe_session_logging;
     if (report.providers.mistral.cli_available && !vibeStatus.session_logging_enabled) {
         report.next_actions.push(`mistral: ${vibeStatus.note}`);
     }
-    // U27: surface Gemini config gaps (missing GEMINI.md, missing settings.json,
-    // MCP-server whitelist drift) only when Gemini CLI is actually installed.
     if (report.providers.gemini.cli_available) {
         for (const action of report.client_config.gemini_config.next_actions) {
             report.next_actions.push(`gemini: ${action}`);
@@ -367,7 +333,6 @@ export function createDoctorReport(envOrOptions = process.env) {
     if (report.next_actions.length === 0) {
         report.next_actions.push("Run a client setup guide and verify with doctor --json after each step.");
     }
-    // Upstream drift detection recommendation — surfaced for habitual use after provider upgrades.
     const hasAnyCli = Object.values(report.providers).some(p => p.cli_available);
     if (hasAnyCli) {
         if (report.upstream.probed) {
@@ -382,17 +347,12 @@ export function createDoctorReport(envOrOptions = process.env) {
     return report;
 }
 export function printDoctorJson(opts = {}) {
-    // Load cache-awareness config + open the flight recorder so the doctor
-    // command can populate cache_awareness.last_24h. Both are best-effort —
-    // failures degrade to the zeroed block (buildCacheAwarenessReport
-    // handles missing deps).
     let cacheAwareness;
     let flightRecorder;
     try {
         cacheAwareness = loadCacheAwarenessConfig();
     }
     catch {
-        // ignore
     }
     try {
         const dbPath = resolveFlightRecorderDbPath();
@@ -400,7 +360,6 @@ export function printDoctorJson(opts = {}) {
             flightRecorder = new FlightRecorder(dbPath);
     }
     catch {
-        // ignore
     }
     const report = createDoctorReport({
         env: process.env,
@@ -414,16 +373,10 @@ export function printDoctorJson(opts = {}) {
             flightRecorder.close();
         }
         catch {
-            // best effort
         }
     }
 }
 function isCreateDoctorReportOptions(value) {
-    // CreateDoctorReportOptions carries either `env` (an object) or
-    // `flightRecorder` (an object). A NodeJS.ProcessEnv is a flat
-    // Record<string, string|undefined> — even if a shell happens to export
-    // `env=production` or `flightRecorder=...`, the value at that key is a
-    // STRING, not an object, so the typeof checks here cannot collide.
     if (value === null || typeof value !== "object")
         return false;
     if (Object.prototype.hasOwnProperty.call(value, "flightRecorder")) {

package/dist/endpoint-exposure.js

@@ -112,7 +112,6 @@ function inferTunnelProvider(rawUrl) {
             return host;
     }
     catch {
-        // Treat unparsable URLs as not classified.
     }
     return "";
 }

package/dist/executor.d.ts

@@ -5,15 +5,7 @@ export interface ExecuteOptions {
     idleTimeout?: number;
     cwd?: string;
     logger?: Logger;
-    /** Extra environment variables to inject; merged after PATH. */
     env?: NodeJS.ProcessEnv;
-    /**
-     * Slice κ: optional UTF-8 payload to write to the child's stdin
-     * immediately after spawn. When provided, stdio for stdin switches
-     * from "ignore" to "pipe" so the CLI can read the payload (used by
-     * `claude --input-format stream-json`). Undefined preserves the
-     * legacy stdio:["ignore","pipe","pipe"] shape.
-     */
     stdin?: string;
 }
 export interface ExecuteResult {
@@ -36,18 +28,7 @@ export declare function resolveCommandForSpawn(command: string, args: string[],
 export declare function shouldDetachProviderProcess(platform?: NodeJS.Platform): boolean;
 export declare function registerProcessGroup(pid: number): void;
 export declare function unregisterProcessGroup(pid: number): void;
-/**
- * Kill all active process groups. Called on gateway shutdown.
- * Sends SIGTERM to all groups, waits 3s, then SIGKILL survivors.
- * Returns a Promise that resolves after SIGKILL escalation completes.
- * The returned Promise keeps the event loop alive (no .unref()),
- * ensuring the process does NOT exit before SIGKILL fires.
- */
 export declare function killAllProcessGroups(): Promise<void>;
-/**
- * Kill an entire process group. Falls back to killing just the process
- * if the group kill fails (e.g., pid not yet assigned).
- */
 export declare function killProcessGroup(proc: ChildProcess, signal: NodeJS.Signals): boolean;
 export declare function spawnCliProcess(command: string, args: string[], options: {
     cwd?: string;

package/dist/executor.js

@@ -73,14 +73,13 @@ function windowsCommonCliPaths(env, home) {
 export function buildExtendedPath(env = process.env, home = homedir(), nodePath = process.execPath, platform = process.platform) {
     const additionalPaths = [
         pathJoinFor(platform, home, ".local", "bin"),
-        dirnameFor(platform, nodePath), // Current node's bin directory
+        dirnameFor(platform, nodePath),
         "/usr/local/bin",
         "/usr/bin",
     ];
     if (platform === "win32") {
         additionalPaths.push(...windowsCommonCliPaths(env, home));
     }
-    // Add all nvm node version bin directories
     const nvmPath = getNvmPath();
     if (nvmPath) {
         additionalPaths.push(nvmPath);
@@ -90,7 +89,6 @@ export function buildExtendedPath(env = process.env, home = homedir(), nodePath
         .filter(Boolean)
         .join(pathDelimiterFor(platform));
 }
-// Extend PATH to include common locations for CLI tools.
 export function getExtendedPath() {
     return buildExtendedPath();
 }
@@ -143,11 +141,6 @@ export function resolveCommandForSpawn(command, args, options = {}) {
                 "/d",
                 "/s",
                 "/c",
-                // Windows .cmd/.bat shims require cmd.exe. `buildWindowsCmdCommand`
-                // applies CommandLineToArgvW quoting and cmd metacharacter escaping
-                // to every dynamic segment before it reaches this shell boundary.
-                //
-                // codeql[js/shell-command-constructed-from-input]
                 `"${buildWindowsCmdCommand(resolved, args)}"`,
             ],
             windowsVerbatimArguments: true,
@@ -156,7 +149,6 @@ export function resolveCommandForSpawn(command, args, options = {}) {
     return { command: resolved, args };
 }
 function buildWindowsCmdCommand(command, args) {
-    // codeql[js/shell-command-constructed-from-input]
     return [escapeWindowsCmdCommand(command), ...args.map(escapeWindowsCmdArgument)].join(" ");
 }
 const WINDOWS_CMD_META_CHARS = new Set([
@@ -182,11 +174,6 @@ const WINDOWS_CMD_META_CHARS = new Set([
 function escapeWindowsCmdCommand(value) {
     return escapeWindowsCmdMetaChars(win32.normalize(value));
 }
-// CommandLineToArgvW rules: a run of N backslashes before a literal " must be
-// doubled and followed by \" (yielding 2N+1 backslashes total, so the parser
-// strips N and keeps the quote as literal); a run of N backslashes immediately
-// before the closing " must be doubled (2N) so the quote still terminates the
-// arg. Then wrap in quotes and caret-escape cmd.exe metacharacters.
 function escapeWindowsCmdArgument(value) {
     return escapeWindowsCmdMetaChars(quoteWindowsArgForCommandLineToArgv(`${value}`));
 }
@@ -237,12 +224,8 @@ function resolveWindowsCommandPath(command, envPath) {
     }
     return null;
 }
-/** Registry of active detached process groups for shutdown cleanup. */
 const activeProcessGroups = new Set();
 export function shouldDetachProviderProcess(platform = process.platform) {
-    // On Windows, detached console children can flash visible cmd/conhost windows
-    // when provider CLIs are native console apps or .cmd shims. Keep them in the
-    // gateway process tree and rely on hidden-window spawn plus taskkill cleanup.
     return platform !== "win32";
 }
 export function registerProcessGroup(pid) {
@@ -251,13 +234,6 @@ export function registerProcessGroup(pid) {
 export function unregisterProcessGroup(pid) {
     activeProcessGroups.delete(pid);
 }
-/**
- * Kill all active process groups. Called on gateway shutdown.
- * Sends SIGTERM to all groups, waits 3s, then SIGKILL survivors.
- * Returns a Promise that resolves after SIGKILL escalation completes.
- * The returned Promise keeps the event loop alive (no .unref()),
- * ensuring the process does NOT exit before SIGKILL fires.
- */
 export function killAllProcessGroups() {
     if (activeProcessGroups.size === 0)
         return Promise.resolve();
@@ -270,7 +246,6 @@ export function killAllProcessGroups() {
                 process.kill(-pid, "SIGTERM");
             }
             catch {
-                /* ESRCH ok */
             }
         }
     }
@@ -285,19 +260,14 @@ export function killAllProcessGroups() {
                         process.kill(-pid, "SIGKILL");
                     }
                     catch {
-                        /* ESRCH ok */
                     }
                 }
             }
             activeProcessGroups.clear();
             resolve();
-        }, 3000); // No .unref() — keeps event loop alive through escalation
+        }, 3000);
     });
 }
-/**
- * Kill an entire process group. Falls back to killing just the process
- * if the group kill fails (e.g., pid not yet assigned).
- */
 export function killProcessGroup(proc, signal) {
     if (proc.pid) {
         if (process.platform === "win32") {
@@ -308,7 +278,6 @@ export function killProcessGroup(proc, signal) {
             return true;
         }
         catch (err) {
-            // ESRCH = process/group already dead — not an error
             if (err.code !== "ESRCH") {
                 try {
                     return proc.kill(signal);
@@ -376,7 +345,6 @@ export async function executeCli(command, args, options = {}) {
         let exited = false;
         let outputSize = 0;
         let settled = false;
-        // Single cleanup flag to prevent double-unregister
         let groupCleaned = false;
         const cleanupProcessGroup = () => {
             if (groupCleaned)
@@ -399,7 +367,6 @@ export async function executeCli(command, args, options = {}) {
                 }, 5000);
             }, timeoutMs)
             : undefined;
-        // Idle timeout: kill process if no stdout/stderr activity for idleMs
         const idleMs = typeof idleTimeout === "number" && Number.isFinite(idleTimeout) && idleTimeout > 0
             ? idleTimeout
             : undefined;
@@ -421,7 +388,6 @@ export async function executeCli(command, args, options = {}) {
                 }, 5000);
             }, idleMs);
         };
-        // Start idle timer immediately (covers case where process never outputs)
         resetIdleTimer();
         const finalizeReject = (error) => {
             if (settled) {
@@ -475,7 +441,6 @@ export async function executeCli(command, args, options = {}) {
             if (idleTimerId) {
                 clearTimeout(idleTimerId);
             }
-            // Unregister process group on clean exit (no kill was issued)
             if (!timedOut && !idledOut && !overflowed) {
                 cleanupProcessGroup();
             }
@@ -489,7 +454,7 @@ export async function executeCli(command, args, options = {}) {
                 const result = {
                     stdout,
                     stderr: stderr + `\nProcess timed out after ${timeoutMs}ms`,
-                    code: 124, // Standard timeout exit code
+                    code: 124,
                 };
                 const error = new Error(result.stderr);
                 error.code = 124;

package/dist/flight-recorder.d.ts

@@ -8,12 +8,6 @@ export interface FlightLogStart {
     asyncJobId?: string;
     stablePrefixHash?: string;
     stablePrefixTokens?: number;
-    /**
-     * Slice κ: number of caller-supplied prompt-parts content blocks
-     * that the gateway emitted with an explicit `cache_control`
-     * breakpoint on this request. `null` (default) for non-κ requests,
-     * including pre-κ rows after a v4 migration of a legacy DB.
-     */
     cacheControlBlocks?: number;
 }
 export interface FlightLogResult {
@@ -45,21 +39,6 @@ export declare class FlightRecorder {
     constructor(dbPath: string);
     logStart(entry: FlightLogStart): void;
     logComplete(correlationId: string, result: FlightLogResult): void;
-    /**
-     * Read-only query over the requests + gateway_metadata tables. Used by
-     * cache-stats / MCP resources / doctor without exposing a second SQLite
-     * connection. better-sqlite3 in WAL mode handles concurrent readers
-     * inside a single process safely.
-     *
-     * Safety:
-     * - Caller MUST pass parameterised SQL — direct string interpolation of
-     *   untrusted values is unsafe.
-     * - The compiled statement's `.readonly` flag is checked at runtime;
-     *   anything that can mutate rows (INSERT/UPDATE/DELETE, including the
-     *   `RETURNING` forms that better-sqlite3 surfaces via `.all()`) throws.
-     *   This blocks the writer-disguised-as-reader vector codex-r1/F3
-     *   flagged, even when the caller is internal gateway code.
-     */
     queryRequests<T = Record<string, unknown>>(sql: string, ...params: unknown[]): T[];
     flush(): void;
     close(): void;
@@ -72,11 +51,6 @@ export declare class NoopFlightRecorder {
     close(): void;
 }
 export type FlightRecorderLike = FlightRecorder | NoopFlightRecorder;
-/**
- * Read-only subset of FlightRecorder used by cache-stats / MCP resources /
- * doctor. Accepts either FlightRecorder or NoopFlightRecorder; the noop
- * returns `[]` from every query so downstream aggregation is empty by design.
- */
 export interface FlightRecorderQuery {
     queryRequests<T = Record<string, unknown>>(sql: string, ...params: unknown[]): T[];
 }