llm-cli-gateway 2.12.1 → 2.13.0

package/dist/model-registry.d.ts

@@ -1,4 +1,4 @@
-import type { CliType } from "./session-manager.js";
+import { type CliType } from "./provider-types.js";
 type ModelSource = "fallback" | "observed" | "config" | "env";
 type ModelConfidence = "low" | "medium" | "high";
 export interface ModelMetadata {

package/dist/model-registry.js

@@ -2,6 +2,7 @@ import { existsSync, readFileSync, readdirSync, statSync } from "fs";
 import { homedir } from "os";
 import path from "path";
 import { parse as parseToml } from "smol-toml";
+import { CLI_TYPES } from "./provider-types.js";
 const FALLBACK_INFO = {
     claude: {
         description: "Anthropic's Claude Code CLI - best for code generation, analysis, and agentic coding tasks",
@@ -56,6 +57,15 @@ const FALLBACK_INFO = {
         },
         modelOrder: ["opus", "gpt-5.5", "swe-1.6"],
     },
+    cursor: {
+        description: "Cursor Agent CLI - agentic coding and review in Cursor's headless terminal agent",
+        models: {
+            "gpt-5": "OpenAI GPT-5 model accepted by Cursor Agent examples.",
+            "sonnet-4-thinking": "Claude Sonnet thinking model accepted by Cursor Agent examples.",
+            "claude-opus-4-8": "Parameterized Claude Opus model family accepted by Cursor Agent examples.",
+        },
+        modelOrder: ["gpt-5", "sonnet-4-thinking", "claude-opus-4-8"],
+    },
 };
 const MODEL_CACHE_TTL_MS = 2 * 60 * 1000;
 const MAX_GEMINI_HISTORY_FILES = 200;
@@ -77,14 +87,7 @@ export function getCliInfo(forceRefresh = false) {
 }
 export function getAvailableCliInfo(forceRefresh = false) {
     const info = getCliInfo(forceRefresh);
-    return {
-        claude: filterUnverifiedModelHints(info.claude),
-        codex: filterUnverifiedModelHints(info.codex),
-        gemini: filterUnverifiedModelHints(info.gemini),
-        grok: filterUnverifiedModelHints(info.grok),
-        mistral: filterUnverifiedModelHints(info.mistral),
-        devin: filterUnverifiedModelHints(info.devin),
-    };
+    return Object.fromEntries(CLI_TYPES.map(cli => [cli, filterUnverifiedModelHints(info[cli])]));
 }
 export function clearModelRegistryCache() {
     cachedInfo = null;
@@ -115,14 +118,7 @@ export function resolveModelAlias(cli, model, info) {
     return trimmed;
 }
 function buildCliInfo() {
-    const info = {
-        claude: cloneInfo(FALLBACK_INFO.claude),
-        codex: cloneInfo(FALLBACK_INFO.codex),
-        gemini: cloneInfo(FALLBACK_INFO.gemini),
-        grok: cloneInfo(FALLBACK_INFO.grok),
-        mistral: cloneInfo(FALLBACK_INFO.mistral),
-        devin: cloneInfo(FALLBACK_INFO.devin),
-    };
+    const info = Object.fromEntries(CLI_TYPES.map(cli => [cli, cloneInfo(FALLBACK_INFO[cli])]));
     applyClaudeOverrides(info.claude);
     applyCodexOverrides(info.codex);
     applyGeminiOverrides(info.gemini);

package/dist/provider-login-guidance.d.ts

@@ -1,4 +1,5 @@
 import type { CliType } from "./session-manager.js";
+import type { ApiProviderConfig } from "./config.js";
 export interface ProviderLoginGuidance {
     provider: CliType;
     displayName: string;
@@ -19,3 +20,14 @@ export interface ProviderLoginGuidance {
 }
 export declare function getProviderLoginGuidance(provider: CliType): ProviderLoginGuidance;
 export declare function getAllProviderLoginGuidance(): Record<CliType, ProviderLoginGuidance>;
+export interface ApiProviderLoginGuidance {
+    provider: string;
+    displayName: string;
+    kind: ApiProviderConfig["kind"];
+    baseUrl: string;
+    apiKeyEnv: string | null;
+    summary: string;
+    steps: string[];
+    credentialHandling: string;
+}
+export declare function getApiProviderLoginGuidance(provider: ApiProviderConfig): ApiProviderLoginGuidance;

package/dist/provider-login-guidance.js

@@ -1,3 +1,4 @@
+import { redactDiagnosticUrl } from "./endpoint-exposure.js";
 const GUIDANCE = {
     claude: {
         provider: "claude",
@@ -115,6 +116,24 @@ const GUIDANCE = {
             expected: "CLI is installed and `devin auth status` reports an authenticated session",
         },
     },
+    cursor: {
+        provider: "cursor",
+        displayName: "Cursor Agent CLI",
+        install: {
+            summary: "Install Cursor Agent CLI using Cursor's current official installer.",
+            commands: ["cursor-agent update", "cursor-agent --version"],
+            documentationUrl: "https://cursor.com/cli",
+        },
+        login: {
+            summary: "Sign in through Cursor Agent's official login flow, or set CURSOR_API_KEY for headless automation.",
+            commands: ["cursor-agent login", "cursor-agent status"],
+            credentialHandling: "Let Cursor store credentials via `cursor-agent login`, or provide CURSOR_API_KEY in the process environment. Do not paste Cursor API keys into prompts or remote chats.",
+        },
+        verification: {
+            command: "cursor-agent status",
+            expected: "CLI is installed and `cursor-agent status` reports an authenticated account",
+        },
+    },
 };
 export function getProviderLoginGuidance(provider) {
     return GUIDANCE[provider];
@@ -122,3 +141,30 @@ export function getProviderLoginGuidance(provider) {
 export function getAllProviderLoginGuidance() {
     return { ...GUIDANCE };
 }
+export function getApiProviderLoginGuidance(provider) {
+    const keyless = provider.apiKeyEnv === null;
+    const baseUrl = redactDiagnosticUrl(provider.baseUrl) ?? provider.baseUrl;
+    const summary = keyless
+        ? `Keyless-local API provider "${provider.name}" (kind: ${provider.kind}); no credential is required for its loopback endpoint.`
+        : `API provider "${provider.name}" (kind: ${provider.kind}) authenticates with a key read from the ${provider.apiKeyEnv} environment variable.`;
+    const steps = keyless
+        ? [
+            `Ensure the local endpoint at ${baseUrl} is running (e.g. Ollama or llama.cpp).`,
+            `No API key is needed; the provider is enabled as soon as the loopback endpoint is reachable.`,
+        ]
+        : [
+            `Obtain an API key from the provider that serves ${baseUrl}.`,
+            `Export it as ${provider.apiKeyEnv} in the gateway's environment (the value is read only at request time).`,
+            `Confirm [providers.${provider.name}] in the gateway config points at the intended base_url and default_model.`,
+        ];
+    return {
+        provider: provider.name,
+        displayName: provider.name,
+        kind: provider.kind,
+        baseUrl,
+        apiKeyEnv: provider.apiKeyEnv,
+        summary,
+        steps,
+        credentialHandling: "Set the API key only via the named environment variable. Do not paste the key into the gateway config, prompts, or a remote chat.",
+    };
+}

package/dist/provider-status.d.ts

@@ -1,5 +1,6 @@
-import type { CliType } from "./session-manager.js";
+import { type CliType } from "./provider-types.js";
 import { type ProviderLoginGuidance } from "./provider-login-guidance.js";
+import { type ApiProviderConfig } from "./config.js";
 export type ProviderLoginStatus = "authenticated" | "not_authenticated" | "unknown" | "not_checked";
 export interface ProviderRuntimeStatus {
     provider: CliType;
@@ -17,6 +18,17 @@ export interface ProviderRuntimeStatus {
     };
     guidance: ProviderLoginGuidance;
 }
+export interface ApiProviderRuntimeStatus {
+    provider: string;
+    kind: ApiProviderConfig["kind"];
+    baseUrl: string;
+    defaultModel: string;
+    models: string[] | null;
+    apiKeyEnv: string | null;
+    apiKeyPresent: boolean;
+    enabled: boolean;
+}
+export declare function getApiProviderStatus(provider: ApiProviderConfig, env?: NodeJS.ProcessEnv): ApiProviderRuntimeStatus;
 export declare const PROVIDER_COMMANDS: Record<CliType, string>;
 export declare function listProviderRuntimeStatuses(): Record<CliType, ProviderRuntimeStatus>;
 export declare function getProviderRuntimeStatus(provider: CliType): ProviderRuntimeStatus;

package/dist/provider-status.js

@@ -2,24 +2,32 @@ import { existsSync } from "node:fs";
 import { homedir } from "node:os";
 import { join } from "node:path";
 import { spawnSync } from "node:child_process";
+import { CLI_TYPES } from "./provider-types.js";
 import { getProviderLoginGuidance } from "./provider-login-guidance.js";
+import { apiProviderKeyPresent, isApiProviderEnabled } from "./config.js";
+import { redactDiagnosticUrl } from "./endpoint-exposure.js";
 import { envWithExtendedPath, getExtendedPath, providerCommandName, resolveCommandForSpawn, } from "./executor.js";
-const PROVIDERS = ["claude", "codex", "gemini", "grok", "mistral", "devin"];
-const VERSION_ARGS = {
-    claude: ["--version"],
-    codex: ["--version"],
-    gemini: ["--version"],
-    grok: ["--version"],
-    mistral: ["--version"],
-    devin: ["--version"],
-};
+export function getApiProviderStatus(provider, env = process.env) {
+    return {
+        provider: provider.name,
+        kind: provider.kind,
+        baseUrl: redactDiagnosticUrl(provider.baseUrl) ?? provider.baseUrl,
+        defaultModel: provider.defaultModel,
+        models: provider.models ?? null,
+        apiKeyEnv: provider.apiKeyEnv,
+        apiKeyPresent: apiProviderKeyPresent(provider, env),
+        enabled: isApiProviderEnabled(provider, env),
+    };
+}
+const VERSION_ARGS = Object.fromEntries(CLI_TYPES.map(provider => [provider, ["--version"]]));
 export const PROVIDER_COMMANDS = {
-    claude: "claude",
-    codex: "codex",
+    claude: providerCommandName("claude"),
+    codex: providerCommandName("codex"),
     gemini: providerCommandName("gemini"),
-    grok: "grok",
+    grok: providerCommandName("grok"),
     mistral: providerCommandName("mistral"),
     devin: providerCommandName("devin"),
+    cursor: providerCommandName("cursor"),
 };
 const LOGIN_CHECKS = {
     claude: ["auth", "status", "--json"],
@@ -27,9 +35,10 @@ const LOGIN_CHECKS = {
     grok: ["inspect", "--json"],
     mistral: ["auth", "status"],
     devin: ["auth", "status"],
+    cursor: ["status"],
 };
 export function listProviderRuntimeStatuses() {
-    return Object.fromEntries(PROVIDERS.map(provider => [provider, getProviderRuntimeStatus(provider)]));
+    return Object.fromEntries(CLI_TYPES.map(provider => [provider, getProviderRuntimeStatus(provider)]));
 }
 export function getProviderRuntimeStatus(provider) {
     const guidance = getProviderLoginGuidance(provider);

package/dist/provider-tool-capabilities.d.ts

@@ -1,5 +1,6 @@
 import { type CliInfo } from "./model-registry.js";
 import { type CliType } from "./session-manager.js";
+import { type ProvidersConfig } from "./config.js";
 export interface ProviderToolControl {
     name?: string;
     supported: boolean;
@@ -128,6 +129,7 @@ export interface ProviderCapabilityQuery {
     includeUnsupported?: boolean;
     includePaths?: boolean;
     refresh?: boolean;
+    providersConfig?: ProvidersConfig;
 }
 export type ProviderToolCapabilitiesMap = Partial<Record<ProviderCapabilityId, ProviderToolCapabilities>>;
 export declare function getProviderToolCapabilities(queryOrCli?: ProviderCapabilityQuery | ProviderCapabilityId): ProviderToolCapabilitiesMap;
@@ -137,4 +139,5 @@ export declare function _getCapabilityCacheForTest(): Map<string, {
     loadedAt: number;
     value: ProviderToolCapabilities;
 }>;
-export declare function providerCapabilityIds(): readonly KnownProviderCapabilityId[];
+export declare function providerCapabilityIds(providersConfig?: ProvidersConfig): readonly ProviderCapabilityId[];
+export declare function knownProviderCapabilityIds(): readonly KnownProviderCapabilityId[];

package/dist/provider-tool-capabilities.js

@@ -5,7 +5,8 @@ import { parse as parseToml } from "smol-toml";
 import { CLAUDE_MCP_SERVER_NAMES } from "./claude-mcp-config.js";
 import { getAvailableCliInfo } from "./model-registry.js";
 import { CLI_TYPES } from "./session-manager.js";
-import { isXaiProviderEnabled, loadProvidersConfig } from "./config.js";
+import { enabledApiProviders, isXaiProviderEnabled, loadProvidersConfig, } from "./config.js";
+import { apiContinuityForKind } from "./api-provider.js";
 const MAX_SKILLS_PER_DIR = 100;
 const MAX_SKILL_BYTES = 64 * 1024;
 const MAX_CONFIG_BYTES = 128 * 1024;
@@ -59,6 +60,10 @@ export const ACP_CONTRACT = {
             classification: "native_candidate",
             summary: "Cognition Devin CLI exposes a native ACP server via `devin acp` (stdio); Slice D1 initialize + session/new smoke passed (protocolVersion 1, third runtime pilot). Runtime routing stays config-gated.",
         },
+        cursor: {
+            classification: "native_candidate",
+            summary: "Cursor Agent CLI exposes a hidden native ACP stdio entrypoint via `cursor-agent acp`; initialize + session/new smoke passed locally (protocolVersion 1, session created).",
+        },
     },
 };
 const ACP_DOCS_REFERENCE = "docs/plans/first-class-acp-gateway-extension.dag.toml";
@@ -160,6 +165,20 @@ const ACP_CAPABILITIES = {
         ],
         docs: ACP_DOCS_REFERENCE,
     },
+    cursor: {
+        status: "native_smoke_passed",
+        mediation: "native",
+        targetVersion: "cursor-agent 2026.06.29-2ad2186",
+        entrypoint: { command: "cursor-agent", args: ["acp"] },
+        runtimeEnabled: false,
+        smokeSupported: true,
+        smokeStatus: "passed",
+        caveats: [
+            "Native ACP via hidden `cursor-agent acp` stdio JSON-RPC entrypoint; manual initialize + session/new smoke passed locally (protocolVersion 1, session created; no agentInfo returned).",
+            "Runtime routing stays disabled until ACP is enabled in gateway config.",
+        ],
+        docs: ACP_DOCS_REFERENCE,
+    },
 };
 function cloneAcpCapability(acp) {
     return {
@@ -805,11 +824,76 @@ const TOOL_CONTROLS = {
             },
         ],
     },
+    cursor: {
+        providerKind: "cli",
+        gatewayRequestTools: ["cursor_request", "cursor_request_async"],
+        summary: "Cursor Agent CLI runs a headless agentic coding/review session; the gateway passes prompt, model, mode, sandbox/trust controls, workspace roots, and session resume on the CLI transport, with ACP transport gated and fail-closed.",
+        controls: {
+            allowlist: {
+                supported: false,
+                behavior: "Cursor Agent exposes force/auto-review modes, not per-request allow lists.",
+            },
+            denylist: {
+                supported: false,
+                behavior: "Cursor Agent has no per-request deny-list flag on the tracked surface.",
+            },
+            mcpServers: {
+                supported: false,
+                requestField: "mcpServers",
+                behavior: "Cursor manages its own MCP configuration via `cursor-agent mcp`; the gateway does not mutate Cursor MCP config.",
+            },
+            nativeSkills: {
+                supported: false,
+                behavior: "Cursor owns rules/plugins; the gateway does not discover Cursor-native rules as skills.",
+            },
+            permissionMode: {
+                supported: true,
+                requestField: "mode/force/autoReview/sandbox/trust/approvalStrategy/approvalPolicy",
+                cliFlag: "--mode/--force/--auto-review/--sandbox/--trust",
+                behavior: 'Cursor supports read-only plan/ask modes, Smart Auto-review, force/yolo, sandbox overrides, and workspace trust in headless mode; under approvalStrategy:"mcp_managed", high-impact force/trust/sandbox-disabled requests are gated by the gateway approval manager.',
+            },
+            promptControl: {
+                supported: true,
+                requestField: "prompt",
+                behavior: "Prompt is passed as the positional prompt to `cursor-agent --print`.",
+            },
+            session: {
+                supported: true,
+                requestField: "sessionId/resumeLatest/createNewSession",
+                cliFlag: "--resume/--continue",
+                behavior: "Resumes a Cursor chat/session (--resume <id>) or the most recent chat (--continue); gateway-created gw-* session ids are tracking ids and are not resumable Cursor chat ids.",
+            },
+            workspace: {
+                supported: true,
+                requestField: "workspace/addDir",
+                cliFlag: "--workspace/--add-dir",
+                behavior: "Sets the Cursor workspace and additional workspace roots; remote HTTP/OAuth callers must use registered workspace aliases/roots rather than raw paths.",
+            },
+        },
+        features: baseFeatures({
+            sessionContinuity: true,
+            approvalAndSandboxControls: true,
+            promptControl: true,
+            workspaceControls: true,
+        }),
+        unsupportedInputs: [
+            {
+                input: "mcpServers",
+                behavior: "not_supported",
+                details: "Cursor owns MCP config via `cursor-agent mcp`; gateway request-time MCP server injection is not implemented.",
+            },
+            {
+                input: 'transport:"acp" with CLI-only options',
+                behavior: "reject",
+                details: "Cursor ACP routing currently accepts prompt/model/session inputs only; mode, outputFormat, workspace, addDir, force, autoReview, sandbox, trust, and prompt/response optimization are rejected instead of silently ignored.",
+            },
+        ],
+    },
 };
 const CAPABILITY_CACHE = new Map();
 export function getProviderToolCapabilities(queryOrCli = {}) {
     const query = normalizeQuery(queryOrCli);
-    const providers = query.cli ? [query.cli] : PROVIDER_CAPABILITY_IDS;
+    const providers = query.cli ? [query.cli] : allProviderCapabilityIds(query.providersConfig);
     const entries = providers.map(provider => [
         provider,
         getOneProviderToolCapabilities(provider, query),
@@ -833,14 +917,35 @@ export function clearProviderToolCapabilitiesCache() {
 export function _getCapabilityCacheForTest() {
     return CAPABILITY_CACHE;
 }
-export function providerCapabilityIds() {
+function providersConfigForQuery(query) {
+    return query.providersConfig ?? loadProvidersConfig();
+}
+function enabledApiCapabilityIds(providersConfig) {
+    return enabledApiProviders(providersConfig ?? loadProvidersConfig()).map(provider => provider.name);
+}
+function allProviderCapabilityIds(providersConfig) {
+    return [
+        ...new Set([
+            ...PROVIDER_CAPABILITY_IDS,
+            ...enabledApiCapabilityIds(providersConfig),
+        ]),
+    ];
+}
+export function providerCapabilityIds(providersConfig) {
+    return allProviderCapabilityIds(providersConfig);
+}
+export function knownProviderCapabilityIds() {
     return PROVIDER_CAPABILITY_IDS;
 }
 function buildOneProviderToolCapabilities(cli, query) {
     const warnings = [];
     if (!isKnownProviderCapabilityId(cli)) {
-        throw new Error(`No tool-capability metadata for provider "${cli}". ` +
-            `Known providers: ${PROVIDER_CAPABILITY_IDS.join(", ")}.`);
+        const runtime = enabledApiProviders(providersConfigForQuery(query)).find(provider => provider.name === cli);
+        if (!runtime) {
+            throw new Error(`No tool-capability metadata for provider "${cli}". ` +
+                `Known providers: ${allProviderCapabilityIds(query.providersConfig).join(", ")}.`);
+        }
+        return buildApiProviderToolCapabilities(runtime, query);
     }
     const definition = TOOL_CONTROLS[cli];
     const discoveredSkills = query.includeSkills && cli !== "grok_api" ? discoverSkills(cli, warnings, query) : [];
@@ -848,7 +953,7 @@ function buildOneProviderToolCapabilities(cli, query) {
         ? extractProviderTools(cli, discoveredSkills)
         : [];
     const features = { ...definition.features };
-    const gatewayRequestTools = cli === "grok_api" && !isXaiProviderEnabled(loadProvidersConfig())
+    const gatewayRequestTools = cli === "grok_api" && !isXaiProviderEnabled(providersConfigForQuery(query))
         ? []
         : [...definition.gatewayRequestTools];
     if (cli === "grok") {
@@ -864,7 +969,7 @@ function buildOneProviderToolCapabilities(cli, query) {
         providerKind: definition.providerKind,
         gatewayRequestTools,
         gatewayRequestTool: gatewayRequestTools[0] ?? definition.gatewayRequestTools[0],
-        modelInfo: getModelInfo(cli, query.refresh),
+        modelInfo: getModelInfo(cli, query),
         summary: definition.summary,
         acpContract: { ...ACP_CONTRACT.providers[cli] },
         acp: cloneAcpCapability(ACP_CAPABILITIES[cli]),
@@ -883,6 +988,172 @@ function buildOneProviderToolCapabilities(cli, query) {
         },
     };
 }
+function apiProviderCapabilityDefinition(runtime) {
+    const { name, kind } = runtime;
+    const forwardsReasoning = kind === "xai-responses";
+    const continuity = apiContinuityForKind(kind);
+    const continuityTracked = continuity !== "none";
+    return {
+        providerKind: "api",
+        gatewayRequestTools: [`api_${name}_request`],
+        summary: `Generic ${kind} API provider "${name}" configured through [providers.${name}]. ` +
+            "HTTP request tool only: no local CLI tools, skills, MCP servers, or workspaces.",
+        controls: {
+            allowlist: {
+                supported: false,
+                behavior: `api_${name}_request has no CLI tool allow-list input.`,
+            },
+            denylist: {
+                supported: false,
+                behavior: `api_${name}_request has no CLI tool deny-list input.`,
+            },
+            mcpServers: {
+                supported: false,
+                behavior: "API requests do not configure or expose MCP servers.",
+            },
+            nativeSkills: {
+                supported: false,
+                behavior: "API requests do not read local provider skills.",
+            },
+            reasoningEffort: forwardsReasoning
+                ? {
+                    supported: true,
+                    requestField: "reasoningEffort",
+                    behavior: "Passed to the xAI Responses API reasoning.effort field.",
+                }
+                : {
+                    supported: false,
+                    requestField: "reasoningEffort",
+                    behavior: `Accepted by the schema but ignored by the ${kind} adapter.`,
+                },
+            maxOutputTokens: {
+                supported: true,
+                requestField: "maxOutputTokens",
+                behavior: "Bounds the provider API max output tokens.",
+            },
+            sampling: {
+                supported: true,
+                requestField: "temperature/topP",
+                behavior: "Sampling controls are passed through to the provider API.",
+            },
+            timeout: {
+                supported: true,
+                requestField: "timeoutMs",
+                behavior: "Bounds the API HTTP request timeout.",
+            },
+            session: continuityTracked
+                ? {
+                    supported: true,
+                    requestField: "sessionId/createNewSession",
+                    behavior: continuity === "server-side-id"
+                        ? "Gateway stores the provider continuation handle (previous_response_id) in session metadata."
+                        : "Gateway tracks the session (active/owner); stateless adapters resend prior context caller-side without storing conversation content.",
+                }
+                : {
+                    supported: false,
+                    requestField: "sessionId/createNewSession",
+                    behavior: "This provider kind does not support multi-turn continuity.",
+                },
+        },
+        features: baseFeatures({
+            apiProvider: true,
+            structuredTextResponses: true,
+            sessionContinuity: continuityTracked,
+        }),
+        unsupportedInputs: [
+            {
+                input: "localSkills",
+                behavior: "not_supported",
+                details: `api_${name}_request does not inspect local CLI skills.`,
+            },
+            {
+                input: "allowedTools/disallowedTools",
+                behavior: "not_supported",
+                details: "Tool allow/deny controls are CLI-only and are not routed to the API.",
+            },
+            {
+                input: "workspace/worktree",
+                behavior: "not_supported",
+                details: "API providers have no local workspace or worktree controls.",
+            },
+        ],
+    };
+}
+function apiProviderModelInfo(runtime) {
+    const list = runtime.models && runtime.models.length > 0 ? runtime.models : [runtime.defaultModel];
+    const models = {};
+    for (const model of list) {
+        models[model] =
+            model === runtime.defaultModel ? "Configured default model" : "Configured allowlisted model";
+    }
+    if (!(runtime.defaultModel in models)) {
+        models[runtime.defaultModel] = "Configured default model (always permitted)";
+    }
+    return {
+        description: `Generic ${runtime.kind} API provider configured through [providers.${runtime.name}].`,
+        models,
+        defaultModel: runtime.defaultModel,
+        defaultModelSource: `[providers.${runtime.name}].default_model`,
+    };
+}
+function apiProviderConfigSurfaces(runtime) {
+    return [
+        {
+            name: `providers.${runtime.name}`,
+            kind: "gateway",
+            present: true,
+            details: `Generic ${runtime.kind} API provider; secret key material is read only from the named environment variable at request time.`,
+        },
+        {
+            name: "api_key_env",
+            kind: "env",
+            present: runtime.apiKey.length > 0,
+            entries: runtime.apiKeyEnv ? [runtime.apiKeyEnv] : [],
+            details: "Reports only the configured environment variable name and whether a key is resolved (keyless-local providers report false); never the value.",
+        },
+    ];
+}
+function buildApiProviderToolCapabilities(runtime, query) {
+    const definition = apiProviderCapabilityDefinition(runtime);
+    return {
+        schemaVersion: "provider-tool-capabilities.v2",
+        generatedAt: new Date().toISOString(),
+        cli: runtime.name,
+        providerKind: "api",
+        gatewayRequestTools: [...definition.gatewayRequestTools],
+        gatewayRequestTool: definition.gatewayRequestTools[0],
+        modelInfo: apiProviderModelInfo(runtime),
+        summary: definition.summary,
+        acpContract: {
+            classification: "absent_watchlist",
+            summary: `${runtime.name} is an HTTP API provider with no ACP process transport; watchlist item only.`,
+        },
+        acp: {
+            status: "not_applicable",
+            mediation: "none",
+            targetVersion: `${runtime.kind} API`,
+            entrypoint: null,
+            runtimeEnabled: false,
+            smokeSupported: false,
+            smokeStatus: "unsupported",
+            caveats: ["ACP is a CLI-stdio transport; the HTTP API provider has no ACP surface."],
+            docs: ACP_DOCS_REFERENCE,
+        },
+        controls: cloneControls(definition.controls),
+        features: { ...definition.features },
+        discoveredSkills: [],
+        discoveredProviderTools: [],
+        configSurfaces: apiProviderConfigSurfaces(runtime),
+        unsupportedInputs: query.includeUnsupported ? [...definition.unsupportedInputs] : [],
+        warnings: [],
+        metadata: {
+            deprecatedFields: {
+                gatewayRequestTool: "Use gatewayRequestTools instead.",
+            },
+            cacheTtlMs: CAPABILITY_CACHE_TTL_MS,
+        },
+    };
+}
 function discoverSkills(cli, warnings, query) {
     const skills = [];
     for (const root of skillRoots(cli)) {
@@ -925,6 +1196,8 @@ function skillRoots(cli) {
             return [{ path: path.join(home, ".vibe", "skills"), source: "user" }];
         case "devin":
             return [];
+        case "cursor":
+            return [];
     }
 }
 function readSkill(cli, skillPath, fallbackName, source, warnings, query) {
@@ -960,6 +1233,7 @@ function normalizeQuery(queryOrCli) {
         includeUnsupported: query.includeUnsupported ?? true,
         includePaths: query.includePaths ?? false,
         refresh: query.refresh ?? false,
+        providersConfig: query.providersConfig,
     };
 }
 function capabilityCacheKey(cli, query) {
@@ -969,8 +1243,33 @@ function capabilityCacheKey(cli, query) {
         includeProviderTools: query.includeProviderTools,
         includeUnsupported: query.includeUnsupported,
         includePaths: query.includePaths,
+        providersConfig: query.providersConfig ? providerConfigCacheKey(query.providersConfig) : null,
     });
 }
+function providerConfigCacheKey(config) {
+    return {
+        xai: config.xai
+            ? {
+                apiKeyEnv: config.xai.apiKeyEnv,
+                baseUrl: config.xai.baseUrl,
+                defaultModel: config.xai.defaultModel,
+            }
+            : null,
+        providers: Object.fromEntries(Object.entries(config.providers ?? {})
+            .sort(([a], [b]) => a.localeCompare(b))
+            .map(([name, provider]) => [
+            name,
+            {
+                kind: provider.kind,
+                apiKeyEnv: provider.apiKeyEnv,
+                baseUrl: provider.baseUrl,
+                defaultModel: provider.defaultModel,
+                models: provider.models ?? null,
+                usageInclude: provider.usageInclude ?? null,
+            },
+        ])),
+    };
+}
 function baseFeatures(overrides) {
     const names = [
         "gatewayRequestTools",
@@ -1012,11 +1311,11 @@ function baseFeatures(overrides) {
 function cloneControls(controls) {
     return Object.fromEntries(Object.entries(controls).map(([name, control]) => [name, { name, ...control }]));
 }
-function getModelInfo(cli, refresh) {
+function getModelInfo(cli, query) {
     if (cli !== "grok_api") {
-        return getAvailableCliInfo(refresh)[cli];
+        return getAvailableCliInfo(query.refresh)[cli];
     }
-    const providers = loadProvidersConfig();
+    const providers = providersConfigForQuery(query);
     const enabled = isXaiProviderEnabled(providers);
     const defaultModel = providers.xai?.defaultModel;
     return {
@@ -1031,7 +1330,7 @@ function getModelInfo(cli, refresh) {
 }
 function discoverConfigSurfaces(cli, query, discoveredSkills) {
     if (cli === "grok_api") {
-        const providers = loadProvidersConfig();
+        const providers = providersConfigForQuery(query);
         return [
             {
                 name: "providers.xai",