llm-cli-gateway 2.13.0 → 2.13.1

package/.agents/skills/multi-llm-review/SKILL.md

@@ -3,7 +3,7 @@ name: multi-llm-review
 description: Parallel code reviews across Claude, Codex, Gemini, Grok, and Mistral. Use for quality analysis, bug finding, or security audit.
 metadata:
   author: verivus-oss
-  version: "1.6"
+  version: "1.7"
 ---
 
 # Multi-LLM Code Review
@@ -24,10 +24,89 @@ Parallel reviews using gateway MCP tools. Each LLM has different strengths — c
 
 Apply these on every dispatch unless the caller has explicitly overridden a rule in the current turn:
 
-1. **Omit `model`** — let the gateway use its configured default per CLI. Nominating a model risks deprecated IDs (`o3`, `o3-pro`, `gpt-4o`, …) and capability mismatches. Call `list_models` only when the caller has asked for a specific variant.
-2. **`approvalStrategy:"mcp_managed"`** is the skill dispatch default (the gateway schema default is `"legacy"`). It gates the request before execution; Claude then runs with `--permission-mode bypassPermissions`, Gemini with `--approval-mode yolo`, and Codex still needs `fullAuto:true` for autonomous file/shell work. Prefer this over raw bypass flags.
-3. **No wallclock timeout; poll every 60 s** — let sync auto-defer at 45 s or use `*_request_async`. Poll `llm_job_status` once every 60 seconds. Do **not** cancel jobs for taking too long; cancel only on explicit instruction or hard failure. `idleTimeoutMs` (no-output safeguard) is separate.
-4. **Iterate until unconditional APPROVED** (review dispatches only) — every review prompt must end with "End with APPROVED or NOT APPROVED with findings." On `NOT APPROVED` or conditional approval, consolidate findings, dispatch fixes (Codex + `fullAuto:true`), re-dispatch the review to the same reviewer. Repeat until unconditional APPROVED. Escalate after 3 rounds without convergence. This rule does **not** apply to pure implementation or non-review analysis dispatches.
+1. **Use the stdio gateway MCP surface only** — call the host's `mcp__gtwy__*` tools (or the equivalent stdio `gtwy` namespace exposed to the current agent). Do not use connector/shadow gateway tools when the user asked for stdio gateway validation.
+2. **Omit `model`** — let the gateway use its configured default per CLI. Nominating a model risks deprecated IDs (`o3`, `o3-pro`, `gpt-4o`, ...) and capability mismatches. Call `list_models` only when the caller has asked for a specific variant.
+3. **`approvalStrategy:"mcp_managed"`** is the skill dispatch default (the gateway schema default is `"legacy"`). It gates the request before execution. Grant full non-interactive verification permissions on every review round because permission grants are not assumed durable.
+4. **Full verification access for reviewers is required** — reviewers need read, test/build, code-search, docs lookup, web/search, and provider-safe gateway introspection access where appropriate. Do not suppress tools or pass empty allowlists. If a provider-specific permission or MCP server required for verification is rejected, treat that as a review dispatch failure and fix the gateway/permission setup before proceeding, unless the user explicitly authorizes a degraded review.
+5. **No wallclock timeout; poll every 90 s** — use `*_request_async`. Poll `llm_job_status` no more than once every 90 seconds. Do **not** cancel reviewer jobs for taking too long; cancel only on explicit user instruction or a terminal provider/runtime failure. `idleTimeoutMs` (no-output safeguard) is separate.
+6. **Iterate until unconditional APPROVED** (review dispatches only) — every review prompt must end with a strict verdict requirement. On `NOT APPROVED`, `CHANGES_REQUIRED`, `BLOCKER`, or conditional approval, consolidate findings, apply fixes, refresh the verification report and exact diff/commit evidence, then re-dispatch the same reviewers. Repeat until unconditional approval or a concrete blocker remains after evidence-based rebuttal. This rule does **not** apply to pure implementation or non-review analysis dispatches.
+
+## Standard Validation Gate
+
+Use this gate whenever the user asks for "the other LLMs", "cross review",
+"red team", "validation", or similar review work.
+
+### Evidence Packet
+
+Before dispatch, prepare a stable packet and pass the same packet to every
+reviewer:
+
+- **Corrective-program verification report**: the local verification report used
+  as the spec for the review. It must list claims, commands run, test names,
+  command-result digests, and code/doc evidence.
+- **Exact change set**: commit SHA(s) when available, the diff range or explicit
+  `git diff` command, and the changed-file list. If the work is uncommitted,
+  state that clearly and include the exact dirty-file list.
+- **Scope and invariants**: DAG step(s), issue/PR references, security
+  invariants, docs that define intended behavior, and out-of-scope files.
+- **Review log from prior rounds**: verbatim reviewer findings plus per-finding
+  responses marked `FIXED`, `DISAGREE`, or `BLOCKER`, each with file:line, test,
+  command, or doc evidence.
+
+The packet is not a substitute for inspection. The prompt must explicitly say
+that the verification report and summary are claims, not evidence.
+
+### Reviewer Contract
+
+Every reviewer prompt must require:
+
+- Verify claims against actual code, tests, docs, and upstream documentation.
+- Open/read the changed files and relevant neighboring code directly.
+- Run or inspect the cited tests/builds; approval cannot be based on a summary,
+  intent, plan-compliance, or "should be fixed" language.
+- Cite concrete evidence for each finding: `file:line`, test name + command, or
+  upstream doc URL. If a claim cannot be verified, report it as at least a major
+  finding.
+- Return strict structured output with `verdict`, `findings`, `inspected`, and
+  `unconditional_approval_blockers`.
+
+Recommended final verdict enum:
+
+```json
+{
+  "verdict": "APPROVED | CHANGES_REQUIRED | BLOCKER",
+  "findings": [
+    {
+      "id": "F1",
+      "severity": "blocker | major | minor | nit",
+      "file": "src/example.ts",
+      "line": 123,
+      "claim": "Exact claim reviewed",
+      "issue": "What is wrong",
+      "evidence": "file:line, command/test output digest, URL, or unable to verify: reason",
+      "suggested_fix": "Concrete fix"
+    }
+  ],
+  "inspected": ["files, tests, commands, docs actually inspected"],
+  "unconditional_approval_blockers": ["F1"]
+}
+```
+
+### Evidence-Based Triage
+
+For every finding:
+
+- If correct: fix it, run the relevant local gates, update the verification
+  report, and start a new review round with a fresh exact change set.
+- If disputed: respond to that reviewer through the gateway with code/doc/test
+  evidence. Do not rebut with assertion, intent, "by design", or "the code should
+  already do that" unless accompanied by the exact evidence. The reviewer must
+  withdraw the finding or provide counter-evidence.
+- If unresolvable in scope: record it as a concrete `BLOCKER` with evidence and
+  stop advancing the change until the user decides scope.
+
+"Approved with nits" is not unconditional approval. Fix the nits or get the
+reviewer to withdraw them as non-blocking with evidence.
 
 ## Workflow
 
@@ -61,28 +140,30 @@ CLIs share Claude's tool names or MCP semantics. The same data is available as
 
 ### 2. Send Parallel Reviews
 
-Sync tools auto-defer at 45s — if response contains `status:"deferred"`, poll `jobId` via `llm_job_status` every 60s, fetch with `llm_job_result`.
+Sync tools auto-defer at 45s, but review gates should prefer async tools. Poll
+`jobId` via `llm_job_status` no more than once every 90s, fetch with
+`llm_job_result` only after a terminal status.
 
 **Tip — share the stable prefix across reviewers:** when the same long brief / file dump is sent to every reviewer, switch from `prompt` to the structured `promptParts` field. The gateway concatenates in canonical order `system → tools → context → task`, so every reviewer sees byte-identical stable prefix bytes, raising implicit cache hit rate at each provider. `prompt` and `promptParts` are mutually exclusive — the runtime returns `provide exactly one of \`prompt\` or \`promptParts\`` if both are supplied. After the round, read `cache-state://prefix/{hash}` (tokens/hashes only, no prompt text) to confirm reviewers actually shared the prefix.
 
 **Claude — Quality & Architecture:**
 ```
-claude_request({prompt:"Review changes in {path} for architecture, design patterns, maintainability, documentation gaps. Read the files directly. Specific line numbers and fixes. End with APPROVED or NOT APPROVED with findings.",approvalStrategy:"mcp_managed",optimizePrompt:true,optimizeResponse:true})
+claude_request_async({prompt:"Review the attached evidence packet and exact change set for architecture, design patterns, maintainability, and documentation gaps. The packet is a claim, not evidence. Verify against the changed files, neighboring source, tests, and docs directly. Cite file:line/test/doc evidence. Return strict JSON and end with APPROVED, CHANGES_REQUIRED, or BLOCKER.",approvalStrategy:"mcp_managed",optimizePrompt:true})
 ```
 
 **Codex — Logic & Correctness:**
 ```
-codex_request({prompt:"Analyze {path} for logic bugs, off-by-one, missing error handling, race conditions, test gaps. Read the files directly. Severity: critical/high/medium/low. End with APPROVED or NOT APPROVED with findings.",fullAuto:true,approvalStrategy:"mcp_managed",optimizePrompt:true,optimizeResponse:true})
+codex_request_async({prompt:"Review the attached evidence packet and exact change set for logic bugs, off-by-one errors, missing error handling, races, and test gaps. The packet is a claim, not evidence. Verify against code/tests/docs directly. Cite file:line/test/doc evidence. Return strict JSON and end with APPROVED, CHANGES_REQUIRED, or BLOCKER.",fullAuto:true,approvalStrategy:"mcp_managed",optimizePrompt:true})
 ```
 
 **Gemini — Security & Edge Cases:**
 ```
-gemini_request({prompt:"Security audit {path}: injection, auth bypasses, data leaks, OWASP Top 10, crash-causing edge cases. Read the files directly. End with APPROVED or NOT APPROVED with findings.",approvalStrategy:"mcp_managed",optimizePrompt:true,optimizeResponse:true})
+gemini_request_async({prompt:"Review the attached evidence packet and exact change set for security issues: injection, auth bypasses, data leaks, OWASP Top 10, and crash-causing edge cases. The packet is a claim, not evidence. Verify against code/tests/docs/upstream docs directly. Cite evidence. Return strict JSON and end with APPROVED, CHANGES_REQUIRED, or BLOCKER.",approvalStrategy:"mcp_managed",optimizePrompt:true})
 ```
 
 **Grok — Independent Diversity (optional 4th reviewer):**
 ```
-grok_request({prompt:"Independent review of {path}. Read the files directly. Flag issues the other reviewers may have missed, contradict findings you disagree with, and call out blind spots. End with APPROVED or NOT APPROVED with findings.",approvalStrategy:"mcp_managed",optimizePrompt:true,optimizeResponse:true})
+grok_request_async({prompt:"Independent review of the attached evidence packet and exact change set. The packet is a claim, not evidence. Verify against code/tests/docs directly, flag blind spots, and contradict weak findings with evidence. Return strict JSON and end with APPROVED, CHANGES_REQUIRED, or BLOCKER.",approvalStrategy:"mcp_managed",optimizePrompt:true})
 ```
 
 Add Grok when consensus matters (high-stakes changes, security-critical paths) or to break ties between the other three. Auth must already be set up (`grok login` OAuth or `GROK_CODE_XAI_API_KEY`).
@@ -122,7 +203,10 @@ grok_request_async({prompt:"Independent diversity review of all TS files in src/
 mistral_request_async({prompt:"Independent Vibe review of all TS files in src/... End with APPROVED or NOT APPROVED with findings.",approvalStrategy:"mcp_managed",correlationId:"review-mistral"})
 ```
 
-Poll with `llm_job_status` every 60s, retrieve with `llm_job_result` when terminal. Jobs are durable — if your polling wrapper times out, re-issue the same call (the gateway auto-dedups onto the live job) or fetch by `jobId` later (default 30-day retention).
+Poll with `llm_job_status` no more than once every 90s, retrieve with
+`llm_job_result` when terminal. Jobs are durable — if your polling wrapper times
+out, re-issue the same call (the gateway auto-dedups onto the live job) or fetch
+by `jobId` later (default 30-day retention).
 
 For iterative Gemini reviews, pass `sessionId` for resumability:
 
@@ -135,23 +219,34 @@ gemini_request_async({prompt:"Deep security audit of src/... End with APPROVED o
 
 These patterns undermine review quality and trigger review integrity warnings:
 
-- **Don't inline code in `<code>` blocks** — provide file paths and let reviewers read files directly
+- **Don't use non-stdio gateway surfaces** when the requested validation path is
+  the local stdio gateway.
+- **Don't provide only a summary** — provide the verification report and exact
+  change set, while requiring reviewers to verify against files/tests/docs
+  directly.
+- **Don't under-grant review access** — full read, test/build, and MCP
+  verification access is the default. A partial-access review is not a valid
+  approval unless the user explicitly accepts that limitation.
 - **Don't suppress tools** — never include "do not run tools" or "respond only based on code provided" in review prompts
 - **Don't use `allowedTools:[]`** for reviews — reviewers need tool access to
   verify claims
 - **Don't copy tool names between providers** — Claude's `Read` / `Grep` /
   `Glob` names are not Grok, Codex, Gemini, or Vibe allowlist names. Check
   `provider_tool_capabilities` first, or omit provider tool allowlists.
-- **Do provide file paths** — `"Review changes in src/auth.ts"` instead of dumping file contents
+- **Don't cancel reviewer jobs** just because they are slow. Let them reach a
+  terminal status unless the user explicitly says to stop them.
+- **Do provide file paths and exact diff identifiers** — `"Review commit
+  abc123, diff range base..head, changed files src/auth.ts ..."` instead of
+  vague summaries.
 
 ## Iteration Loop (mandatory)
 
 Reviews are not one-shot. The caller runs this loop:
 
 1. Dispatch reviewer(s) with the verdict clause in the prompt
-2. Poll every 60s if deferred; fetch result
+2. Poll every 90s if deferred; fetch result only after terminal status
 3. Parse verdict from each reviewer — APPROVED / NOT APPROVED / conditional
-4. **Any NOT APPROVED or conditional** → consolidate findings → dispatch fixes (Codex + `fullAuto:true`) → re-dispatch same review → goto 2
+4. **Any NOT APPROVED, CHANGES_REQUIRED, BLOCKER, or conditional** → triage each finding with evidence → fix or rebut with code/doc/test citations → refresh verification report and exact diff → re-dispatch same review → goto 2
 5. **All APPROVED (unconditional)** → done
 6. After 3 rounds without convergence, escalate to the user
 
@@ -169,6 +264,6 @@ Reviews are not one-shot. The caller runs this loop:
 - Use all five async variants for true parallel reviews when you want Grok's
   independent perspective and Mistral Vibe's fifth review
 - Pass `sessionId` to `gemini_request_async` / `grok_request_async` for resumable follow-up
-- Check for `status:"deferred"` in sync responses — poll `jobId` every 60s if present
+- Check for `status:"deferred"` in sync responses — poll `jobId` no more than once every 90s if present
 - Gateway `mcpServers` default to the host's configured Claude MCP set; pass explicit server names only when the review needs those capabilities
 - **Re-issuing after a polling timeout is safe** — auto-dedup (default 1 h window, `LLM_GATEWAY_DEDUP_WINDOW_MS`) reattaches the new call to the existing job. Use `forceRefresh:true` only when inputs genuinely changed

package/CHANGELOG.md

@@ -2,6 +2,32 @@
 
 All notable changes to the llm-cli-gateway project.
 
+## [2.13.1] - 2026-07-01: code-scanning hardening and review-gate discipline
+
+### Security
+
+- **CodeQL remediation for URL, ReDoS, logging, and OAuth cookie alerts.**
+  API endpoint joining no longer uses slash-trimming regexes; ACP message
+  redaction now uses a stack-based single-pass JSON payload scanner with
+  truncated structured-payload fallback; central gateway stderr logging redacts
+  message strings, structured args, and nested `Error` name/message/stack
+  values; the xAI missing-key error no longer leaks the configured env var name;
+  and OAuth consent CSRF cookies now include `HttpOnly`, `Secure`,
+  `SameSite=Lax`, `Path=/oauth`, and `Max-Age=300`.
+- **Regression coverage for the fixed alert surfaces.** Added focused tests for
+  endpoint slash normalization, nested and truncated ACP payload redaction,
+  logger redaction before stderr output, generic xAI missing-key messaging, and
+  complete OAuth CSRF cookie attributes.
+
+### Docs
+
+- **Standardized cross-LLM review validation.** The shipped multi-LLM review
+  skill and best-practices guide now require the stdio gateway surface, no
+  provider model nomination, full non-interactive verification access,
+  90-second polling, exact evidence packets, no cancellation of slow reviewers,
+  evidence-based rebuttals, and iteration until unconditional approval or a
+  concrete blocker.
+
 ## [2.13.0] - 2026-07-01: Cursor Agent CLI provider
 
 ### Added

package/dist/acp/errors.js

@@ -1,7 +1,5 @@
 export function redactAcpMessage(input) {
-    let out = input;
-    out = out.replace(/\{[\s\S]*?\}/g, "<redacted-json>");
-    out = out.replace(/\[[\s\S]*?\]/g, "<redacted-json>");
+    let out = redactJsonLikeBodies(input);
     out = out.replace(/\b(bearer|token|api[_-]?key|secret)\b\s*[:=]?\s*\S+/gi, "$1 <redacted>");
     out = out.replace(/\b(sk|xai|gsk|key)-[A-Za-z0-9_-]{8,}\b/gi, "<redacted-token>");
     out = out.replace(/(^|[^A-Za-z0-9._~\\/-])[A-Za-z]:\\[^\s"')\]}>]*/g, "$1<redacted-path>");
@@ -11,6 +9,64 @@ export function redactAcpMessage(input) {
     out = out.replace(/[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,}/gi, "<redacted-email>");
     return out;
 }
+function redactJsonLikeBodies(input) {
+    let out = "";
+    let cursor = 0;
+    let bodyStart = -1;
+    let stack = [];
+    let inString = false;
+    let escaped = false;
+    for (let index = 0; index < input.length; index += 1) {
+        const char = input.charAt(index);
+        if (bodyStart === -1) {
+            const close = char === "{" ? "}" : char === "[" ? "]" : "";
+            if (!close)
+                continue;
+            bodyStart = index;
+            stack = [close];
+            inString = false;
+            escaped = false;
+            continue;
+        }
+        if (escaped) {
+            escaped = false;
+            continue;
+        }
+        if (char === "\\") {
+            escaped = inString;
+            continue;
+        }
+        if (char === '"') {
+            inString = !inString;
+            continue;
+        }
+        if (inString)
+            continue;
+        const nestedClose = char === "{" ? "}" : char === "[" ? "]" : "";
+        if (nestedClose) {
+            stack.push(nestedClose);
+            continue;
+        }
+        if (char !== stack[stack.length - 1])
+            continue;
+        stack.pop();
+        if (stack.length > 0)
+            continue;
+        out += input.slice(cursor, bodyStart);
+        out += "<redacted-json>";
+        cursor = index + 1;
+        bodyStart = -1;
+    }
+    if (bodyStart !== -1 && isLikelyJsonPayload(input.slice(bodyStart))) {
+        out += input.slice(cursor, bodyStart);
+        out += "<redacted-json>";
+        cursor = input.length;
+    }
+    return cursor === 0 ? input : out + input.slice(cursor);
+}
+function isLikelyJsonPayload(span) {
+    return /"(?:jsonrpc|method|params|prompt|content|body|token|secret|api[_-]?key|credential|auth|cwd|path|[A-Za-z0-9_-]+)"\s*:/i.test(span);
+}
 export function redactAcpDebug(value) {
     const sensitiveKey = /(payload|body|prompt|content|token|secret|api[_-]?key|credential|auth|cwd|path)/i;
     if (typeof value === "string") {

package/dist/api-http.js

@@ -40,8 +40,8 @@ export function isLoopbackUrl(value) {
     }
 }
 export function buildEndpointUrl(baseUrl, path) {
-    const trimmedBase = baseUrl.replace(/\/+$/, "");
-    const trimmedPath = path.replace(/^\/+/, "");
+    const trimmedBase = stripTrailingSlashChars(baseUrl);
+    const trimmedPath = stripLeadingSlashChars(path);
     const url = new URL(`${trimmedBase}/${trimmedPath}`);
     if (url.protocol !== "https:" &&
         !(url.protocol === "http:" && LOOPBACK_HOSTS.includes(url.hostname))) {
@@ -49,6 +49,20 @@ export function buildEndpointUrl(baseUrl, path) {
     }
     return url;
 }
+function stripTrailingSlashChars(value) {
+    let end = value.length;
+    while (end > 0 && value.charCodeAt(end - 1) === 47) {
+        end -= 1;
+    }
+    return value.slice(0, end);
+}
+function stripLeadingSlashChars(value) {
+    let start = 0;
+    while (start < value.length && value.charCodeAt(start) === 47) {
+        start += 1;
+    }
+    return value.slice(start);
+}
 export function isHttpTransient(error) {
     const status = typeof error?.status === "number" ? error.status : null;
     if (status === 429 || (status !== null && status >= 500))

package/dist/index.d.ts

@@ -38,11 +38,11 @@ type ExtendedToolResponse = {
     reviewIntegrity?: ReviewIntegrityResult;
     warnings?: WarningEntry[];
 };
-declare const logger: {
-    info: (message: string, ...args: any[]) => void;
-    warn: (message: string, ...args: any[]) => void;
-    error: (message: string, ...args: any[]) => void;
-    debug: (message: string, ...args: any[]) => void;
+export declare const logger: {
+    info: (message: string, ...args: unknown[]) => void;
+    warn: (message: string, ...args: unknown[]) => void;
+    error: (message: string, ...args: unknown[]) => void;
+    debug: (message: string, ...args: unknown[]) => void;
 };
 type GatewayLogger = typeof logger;
 export declare function buildServerInstructions(asyncJobsEnabled: boolean, grokApiToolsEnabled?: boolean): string;

package/dist/index.js

@@ -21,6 +21,7 @@ import { estimateTokens, optimizePrompt as optimizePromptText, optimizeResponse
 import { loadConfig, loadPersistenceConfig, loadCacheAwarenessConfig, loadProvidersConfig, loadAcpConfig, loadLimitsConfig, defaultGatewayConfigPath, isXaiProviderEnabled, enabledApiProviders, minStableTokensForModel, } from "./config.js";
 import { runAcpRequest } from "./acp/runtime.js";
 import { isAcpError } from "./acp/errors.js";
+import { redactSecrets } from "./secret-redaction.js";
 import { createApiProvider, runApiRequest, apiProviderBreakerState, } from "./api-provider.js";
 import { prepareApiRequest, apiProviderCatalogEntry, ApiModelNotAllowedError, } from "./api-request.js";
 import { checkHealth } from "./health.js";
@@ -47,22 +48,65 @@ import { currentCaller, resolveValidationReceipt } from "./validation-receipt.js
 import { assertUpstreamCliArgs, assertUpstreamCliEnv, buildProviderSubcommandsCompactCatalog, buildUpstreamContractReport, getCliSubcommandContract, probeInstalledCliContract, serializeCliSubcommandContract, UPSTREAM_CLI_CONTRACTS, } from "./upstream-contracts.js";
 import { buildArgvFromGeneration, deriveZodShapeFromGeneration, GROK_FLAG_GENERATION, GROK_GEN_OUTPUT_FORMAT, GROK_GEN_MAIN, GROK_GEN_PROMPT_FILE, GROK_GEN_SINGLE, GROK_GEN_TAIL, } from "./provider-codegen.js";
 import { entrypointFileURL } from "./entrypoint-url.js";
-const logger = {
+export const logger = {
     info: (message, ...args) => {
-        console.error(`[INFO] ${new Date().toISOString()} - ${message}`, ...args);
+        console.error(formatLogLine("INFO", message), ...args.map(sanitizeLogArg));
     },
     warn: (message, ...args) => {
-        console.error(`[WARN] ${new Date().toISOString()} - ${message}`, ...args);
+        console.error(formatLogLine("WARN", message), ...args.map(sanitizeLogArg));
     },
     error: (message, ...args) => {
-        console.error(`[ERROR] ${new Date().toISOString()} - ${message}`, ...args);
+        console.error(formatLogLine("ERROR", message), ...args.map(sanitizeLogArg));
     },
     debug: (message, ...args) => {
         if (process.env.DEBUG) {
-            console.error(`[DEBUG] ${new Date().toISOString()} - ${message}`, ...args);
+            console.error(formatLogLine("DEBUG", message), ...args.map(sanitizeLogArg));
         }
     },
 };
+function formatLogLine(level, message) {
+    return `[${level}] ${new Date().toISOString()} - ${redactSecrets(message)}`;
+}
+function sanitizeLogArg(value) {
+    return sanitizeLogValue(value, new WeakSet(), 0);
+}
+function sanitizeLogValue(value, seen, depth) {
+    if (typeof value === "string") {
+        return redactSecrets(value);
+    }
+    if (value instanceof Error) {
+        return sanitizeLogError(value);
+    }
+    if (Array.isArray(value)) {
+        if (depth >= 4)
+            return "[Array]";
+        return value.map(item => sanitizeLogValue(item, seen, depth + 1));
+    }
+    if (value !== null && typeof value === "object") {
+        if (seen.has(value))
+            return "[Circular]";
+        if (depth >= 4)
+            return "[Object]";
+        seen.add(value);
+        const out = {};
+        for (const [key, inner] of Object.entries(value)) {
+            out[key] = sanitizeLogValue(inner, seen, depth + 1);
+        }
+        seen.delete(value);
+        return out;
+    }
+    return value;
+}
+function sanitizeLogError(error) {
+    const out = {
+        name: redactSecrets(error.name),
+        message: redactSecrets(error.message),
+    };
+    if (error.stack) {
+        out.stack = redactSecrets(error.stack);
+    }
+    return out;
+}
 function startWindowsBootstrapperSelfHeal() {
     if (process.platform !== "win32")
         return;
@@ -2415,7 +2459,7 @@ export async function handleGrokApiRequest(deps, params) {
     }
     const apiKey = process.env[xaiConfig.apiKeyEnv]?.trim();
     if (!apiKey) {
-        return createErrorResponse("grok_api_request", 1, "", corrId, new Error(`xAI API key env var ${xaiConfig.apiKeyEnv} is not set`));
+        return createErrorResponse("grok_api_request", 1, "", corrId, new Error("xAI API key is not configured"));
     }
     safeFlightStart({
         correlationId: corrId,

package/dist/oauth.js

@@ -77,6 +77,10 @@ function readCookie(req, name) {
     }
     return null;
 }
+function oauthCsrfCookie(csrf) {
+    const maxAgeSeconds = Math.floor(OAUTH_CODE_TTL_MS / 1000);
+    return `gw_oauth_csrf=${csrf}; HttpOnly; Secure; SameSite=Lax; Path=/oauth; Max-Age=${maxAgeSeconds}`;
+}
 function methodNotAllowed(res) {
     res.writeHead(405, { allow: "GET, POST", "content-type": "application/json" });
     res.end(JSON.stringify({ error: "Method not allowed" }));
@@ -466,7 +470,7 @@ ${errorBlock}
 <p class="muted">Only approve if you initiated this connection.</p></div></body></html>`;
         res.writeHead(200, {
             "content-type": "text/html; charset=utf-8",
-            "set-cookie": `gw_oauth_csrf=${csrf}; HttpOnly; SameSite=Lax; Path=/oauth`,
+            "set-cookie": oauthCsrfCookie(csrf),
             "cache-control": "no-store",
         });
         res.end(html);

package/npm-shrinkwrap.json

@@ -1,12 +1,12 @@
 {
   "name": "llm-cli-gateway",
-  "version": "2.13.0",
+  "version": "2.13.1",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "llm-cli-gateway",
-      "version": "2.13.0",
+      "version": "2.13.1",
       "license": "MIT",
       "dependencies": {
         "@modelcontextprotocol/sdk": "^1.29.0",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "llm-cli-gateway",
-  "version": "2.13.0",
+  "version": "2.13.1",
   "mcpName": "io.github.verivus-oss/llm-cli-gateway",
   "description": "MCP server providing unified access to Claude Code, Codex, Gemini, Grok, Mistral Vibe, and Devin CLIs with session management, retry logic, async job orchestration, durable job results, and cross-LLM validation.",
   "license": "MIT",