llm-cli-gateway 2.13.2 → 2.14.0

package/dist/acp/errors.js

@@ -2,6 +2,9 @@ export function redactAcpMessage(input) {
     let out = redactJsonLikeBodies(input);
     out = out.replace(/\b(bearer|token|api[_-]?key|secret)\b\s*[:=]?\s*\S+/gi, "$1 <redacted>");
     out = out.replace(/\b(sk|xai|gsk|key)-[A-Za-z0-9_-]{8,}\b/gi, "<redacted-token>");
+    out = out.replace(/\bAIza[A-Za-z0-9_-]{10,}/g, "<redacted-token>");
+    out = out.replace(/\bgh[pousr]_[A-Za-z0-9]{20,}\b/g, "<redacted-token>");
+    out = out.replace(/\bxox[baprs]-[A-Za-z0-9-]{10,}\b/gi, "<redacted-token>");
     out = out.replace(/(^|[^A-Za-z0-9._~\\/-])[A-Za-z]:\\[^\s"')\]}>]*/g, "$1<redacted-path>");
     out = out.replace(/(^|[^A-Za-z0-9._~\\/-])\\\\[^\s"')\]}>]+/g, "$1<redacted-path>");
     out = out.replace(/(^|[^A-Za-z0-9._~/-])~\/[^\s"')\]}>]+/g, "$1<redacted-path>");
@@ -150,6 +153,22 @@ export class ProviderUnavailableError extends AcpError {
         this.name = "ProviderUnavailableError";
     }
 }
+export class AcpMethodUnsupportedError extends AcpError {
+    method;
+    constructor(provider, method, debug) {
+        super("method_unsupported", `ACP method ${method} is not advertised by provider ${provider}'s capability set; the agent did not declare support for it.`, { provider, debug: { method, ...(debug ?? {}) } });
+        this.name = "AcpMethodUnsupportedError";
+        this.method = method;
+    }
+}
+export class AcpMutatingDisabledError extends AcpError {
+    method;
+    constructor(provider, method, debug) {
+        super("mutating_disabled", `ACP mutating session op ${method} is disabled. Set allow_mutating_session_ops=true under [acp] to permit state-mutating ACP admin ops.`, { provider, debug: { method, ...(debug ?? {}) } });
+        this.name = "AcpMutatingDisabledError";
+        this.method = method;
+    }
+}
 export class AcpProtocolError extends AcpError {
     code;
     constructor(userMessage, options) {

package/dist/acp/event-normalizer.d.ts

@@ -29,6 +29,12 @@ export type AcpProgressEvent = {
     readonly kind: "usage";
     readonly size: number;
     readonly used: number;
+} | {
+    readonly kind: "session_complete";
+    readonly stopReason: string;
+} | {
+    readonly kind: "error";
+    readonly message: string;
 } | {
     readonly kind: "other";
     readonly sessionUpdate: string;
@@ -37,6 +43,12 @@ export declare function summarizeContentBlock(block: ContentBlock): string;
 export declare function normalizeSessionUpdate(notification: SessionUpdateNotification): AcpProgressEvent;
 export declare class AcpEventNormalizer {
     private text;
+    private stopReasonValue;
+    private errorValue;
     handle(notification: SessionUpdateNotification): AcpProgressEvent;
+    completeWith(stopReason: string): AcpProgressEvent;
+    error(message: string): AcpProgressEvent;
     get finalText(): string;
+    get stopReason(): string | undefined;
+    get errorMessage(): string | undefined;
 }

package/dist/acp/event-normalizer.js

@@ -58,6 +58,8 @@ export function normalizeSessionUpdate(notification) {
 }
 export class AcpEventNormalizer {
     text = "";
+    stopReasonValue;
+    errorValue;
     handle(notification) {
         const event = normalizeSessionUpdate(notification);
         if (event.kind === "agent_message") {
@@ -65,7 +67,21 @@ export class AcpEventNormalizer {
         }
         return event;
     }
+    completeWith(stopReason) {
+        this.stopReasonValue = stopReason;
+        return { kind: "session_complete", stopReason };
+    }
+    error(message) {
+        this.errorValue = message;
+        return { kind: "error", message };
+    }
     get finalText() {
         return this.text;
     }
+    get stopReason() {
+        return this.stopReasonValue;
+    }
+    get errorMessage() {
+        return this.errorValue;
+    }
 }

package/dist/acp/flight-redaction.d.ts

@@ -20,6 +20,9 @@ export interface AcpFlightResultParams {
     readonly exitCode: number;
     readonly inputTokens?: number;
     readonly outputTokens?: number;
+    readonly cacheReadTokens?: number;
     readonly errorMessage?: string;
+    readonly providerSessionId?: string;
+    readonly stopReason?: string;
 }
 export declare function buildAcpFlightResult(params: AcpFlightResultParams): FlightLogResult;

package/dist/acp/flight-redaction.js

@@ -35,6 +35,9 @@ export function buildAcpFlightResult(params) {
         optimizationApplied: false,
         inputTokens: params.inputTokens,
         outputTokens: params.outputTokens,
+        cacheReadTokens: params.cacheReadTokens,
         errorMessage: params.errorMessage !== undefined ? redactAcpTextForFlight(params.errorMessage) : undefined,
+        providerSessionId: params.providerSessionId,
+        stopReason: params.stopReason,
     };
 }

package/dist/acp/permission-bridge.js

@@ -12,9 +12,15 @@ export function categorizeToolCall(toolCall) {
         return "read";
     return "other";
 }
-function isAllowOption(option) {
-    const kind = typeof option.kind === "string" ? option.kind.toLowerCase() : "";
-    return kind.startsWith("allow");
+function selectSingleUseAllow(options) {
+    const kindOf = (o) => typeof o.kind === "string" ? o.kind.toLowerCase() : "";
+    const allowOnce = options.find(o => kindOf(o) === "allow_once");
+    if (allowOnce)
+        return allowOnce;
+    return options.find(o => {
+        const kind = kindOf(o);
+        return kind.startsWith("allow") && !kind.includes("always");
+    });
 }
 const CANCELLED = { outcome: { outcome: "cancelled" } };
 export function createAcpPermissionDecider(deps) {
@@ -75,12 +81,12 @@ export function createAcpPermissionDecider(deps) {
             });
             return CANCELLED;
         }
-        const allow = request.options.find(isAllowOption);
+        const allow = selectSingleUseAllow(request.options);
         if (!allow) {
             logger.info("acp.permission.denied", {
                 provider: deps.provider,
                 category,
-                reason: "no_allow_option",
+                reason: "no_single_use_allow_option",
             });
             return CANCELLED;
         }

package/dist/acp/process-manager.d.ts

@@ -36,6 +36,7 @@ export interface StartProviderOptions {
     readonly hostServices: HostServices;
     readonly callbacks?: AcpClientCallbacks;
     readonly idleTimeoutMs?: number;
+    readonly extraArgs?: readonly string[];
 }
 export interface ManagedAcpProcess {
     readonly provider: CliType;
@@ -51,7 +52,7 @@ export interface ManagedAcpProcess {
     isHealthy(): boolean;
 }
 export declare function buildProviderEnv(provider: CliType, providerConfig: AcpProviderConfig, baseEnv: ProcessEnv): ProcessEnv;
-export declare function resolveProviderSpawn(provider: CliType, config: AcpConfig, baseEnv: ProcessEnv, cwd?: string): ResolvedAcpSpawn;
+export declare function resolveProviderSpawn(provider: CliType, config: AcpConfig, baseEnv: ProcessEnv, cwd?: string, extraArgs?: readonly string[]): ResolvedAcpSpawn;
 export declare const defaultSpawn: AcpSpawnFn;
 export declare class AcpProcessManager {
     private readonly config;

package/dist/acp/process-manager.js

@@ -7,6 +7,7 @@ import { JsonRpcStdioTransport, } from "./json-rpc-stdio.js";
 import { getAcpProviderEntry } from "./provider-registry.js";
 import { envWithExtendedPath, getExtendedPath } from "../executor.js";
 import { noopLogger } from "../logger.js";
+const SHUTDOWN_KILL_GRACE_MS = 5000;
 const SHELL_METACHARACTERS = /[\s|&;<>(){}$`"'\\*?[\]~#! ]/;
 function assertSafeExecutable(command, provider) {
     if (command.length === 0 || SHELL_METACHARACTERS.test(command)) {
@@ -22,7 +23,7 @@ export function buildProviderEnv(provider, providerConfig, baseEnv) {
     }
     return env;
 }
-export function resolveProviderSpawn(provider, config, baseEnv, cwd) {
+export function resolveProviderSpawn(provider, config, baseEnv, cwd, extraArgs = []) {
     const providerConfig = config.providers[provider];
     const registryEntry = getAcpProviderEntry(provider);
     let command;
@@ -38,8 +39,9 @@ export function resolveProviderSpawn(provider, config, baseEnv, cwd) {
     else {
         throw new ProviderUnavailableError(provider, "no ACP entrypoint configured and provider has no native ACP entrypoint", { provider });
     }
+    const combinedArgs = [...args, ...extraArgs];
     assertSafeExecutable(command, provider);
-    for (const arg of args) {
+    for (const arg of combinedArgs) {
         if (typeof arg !== "string") {
             throw new ProviderUnavailableError(provider, "ACP args must be strings", { provider });
         }
@@ -53,7 +55,7 @@ export function resolveProviderSpawn(provider, config, baseEnv, cwd) {
     };
     return {
         command,
-        args: [...args],
+        args: [...combinedArgs],
         cwd: cwd ?? `${tmpdir()}/llm-gateway-acp-${provider}`,
         env: buildProviderEnv(provider, effectiveConfig, baseEnv),
     };
@@ -82,7 +84,7 @@ export class AcpProcessManager {
         this.baseEnv = options.baseEnv ?? process.env;
     }
     async start(options) {
-        const resolved = resolveProviderSpawn(options.provider, this.config, this.baseEnv, options.cwd);
+        const resolved = resolveProviderSpawn(options.provider, this.config, this.baseEnv, options.cwd, options.extraArgs);
         let child;
         try {
             child = this.spawnFn(resolved);
@@ -119,6 +121,7 @@ export class AcpProcessManager {
             initializeTimeoutMs: this.config.initializeTimeoutMs,
             sessionNewTimeoutMs: this.config.sessionNewTimeoutMs,
             promptTimeoutMs: this.config.promptTimeoutMs,
+            allowMutatingSessionOps: this.config.allowMutatingSessionOps,
             onTerminal: m => this.live.delete(m),
         });
         this.live.add(managed);
@@ -162,6 +165,7 @@ class ManagedProcessImpl {
     _signal = null;
     _terminalError = null;
     idleTimer = null;
+    killTimer = null;
     constructor(options) {
         this.provider = options.provider;
         this.child = options.child;
@@ -199,6 +203,7 @@ class ManagedProcessImpl {
                 sessionNewMs: options.sessionNewTimeoutMs,
                 promptMs: options.promptTimeoutMs,
             },
+            allowMutatingSessionOps: options.allowMutatingSessionOps ?? false,
         });
         options.child.on("exit", (code, signal) => this.handleExit(code, signal));
         options.child.on("error", err => this.handleSpawnError(err));
@@ -259,7 +264,37 @@ class ManagedProcessImpl {
             this.idleTimer = null;
         }
     }
+    armKillTimer() {
+        if (this.killTimer || SHUTDOWN_KILL_GRACE_MS <= 0) {
+            return;
+        }
+        this.killTimer = setTimeout(() => {
+            this.killTimer = null;
+            try {
+                this.child.kill("SIGKILL");
+                this.logger.info("acp.process.force_killed", {
+                    provider: this.provider,
+                    pid: this.pid,
+                });
+            }
+            catch (err) {
+                this.logger.error("acp.process.kill_failed", {
+                    provider: this.provider,
+                    pid: this.pid,
+                    errorClass: err instanceof Error ? err.name : "unknown",
+                });
+            }
+        }, SHUTDOWN_KILL_GRACE_MS);
+        this.killTimer.unref?.();
+    }
+    clearKillTimer() {
+        if (this.killTimer) {
+            clearTimeout(this.killTimer);
+            this.killTimer = null;
+        }
+    }
     handleExit(code, signal) {
+        this.clearKillTimer();
         if (this._state === "exited" || this._state === "quarantined") {
             this._exitCode = code;
             this._signal = signal;
@@ -322,6 +357,7 @@ class ManagedProcessImpl {
         this.client.notifyProcessExit(error);
         try {
             this.child.kill("SIGTERM");
+            this.armKillTimer();
         }
         catch (err) {
             this.logger.error("acp.process.kill_failed", {
@@ -348,6 +384,9 @@ class ManagedProcessImpl {
         if (wasRunning) {
             try {
                 this.child.kill(signal);
+                if (signal !== "SIGKILL") {
+                    this.armKillTimer();
+                }
             }
             catch (err) {
                 this.logger.error("acp.process.kill_failed", {

package/dist/acp/provider-registry.js

@@ -1,11 +1,19 @@
+import { getProviderDefinition } from "../provider-definitions.js";
+function acpEntrypointFromDefinition(provider) {
+    const entry = getProviderDefinition(provider).acp.entrypoint;
+    if (!entry) {
+        return null;
+    }
+    return Object.freeze({ command: entry.command, args: Object.freeze([...entry.args]) });
+}
 const ACP_PROVIDER_REGISTRY = Object.freeze({
     mistral: Object.freeze({
         provider: "mistral",
         displayName: "Mistral Vibe",
         status: "native_smoke_passed",
         supportKind: "native",
-        targetVersion: "vibe 2.17.1",
-        entrypoint: Object.freeze({ command: "vibe-acp", args: Object.freeze([]) }),
+        targetVersion: "vibe 2.18.3",
+        entrypoint: acpEntrypointFromDefinition("mistral"),
         runtimeEnabledDefault: false,
         shipRuntimePilot: true,
         runtimePriority: 1,
@@ -17,8 +25,8 @@ const ACP_PROVIDER_REGISTRY = Object.freeze({
         displayName: "xAI Grok CLI",
         status: "native_smoke_passed",
         supportKind: "native",
-        targetVersion: "grok 0.2.73 (9ff14c43bb)",
-        entrypoint: Object.freeze({ command: "grok", args: Object.freeze(["agent", "stdio"]) }),
+        targetVersion: "grok 0.2.77 (44e77bec3a)",
+        entrypoint: acpEntrypointFromDefinition("grok"),
         runtimeEnabledDefault: false,
         shipRuntimePilot: true,
         runtimePriority: 2,
@@ -31,7 +39,7 @@ const ACP_PROVIDER_REGISTRY = Object.freeze({
         status: "adapter_mediated_deferred",
         supportKind: "adapter_mediated",
         targetVersion: "codex-cli 0.142.4",
-        entrypoint: null,
+        entrypoint: acpEntrypointFromDefinition("codex"),
         runtimeEnabledDefault: false,
         shipRuntimePilot: false,
         runtimePriority: 0,
@@ -43,8 +51,8 @@ const ACP_PROVIDER_REGISTRY = Object.freeze({
         displayName: "Anthropic Claude Code",
         status: "adapter_mediated_deferred",
         supportKind: "adapter_mediated",
-        targetVersion: "claude 2.1.195",
-        entrypoint: null,
+        targetVersion: "claude 2.1.198",
+        entrypoint: acpEntrypointFromDefinition("claude"),
         runtimeEnabledDefault: false,
         shipRuntimePilot: false,
         runtimePriority: 0,
@@ -56,8 +64,8 @@ const ACP_PROVIDER_REGISTRY = Object.freeze({
         displayName: "Google Antigravity",
         status: "absent_watchlist",
         supportKind: "none",
-        targetVersion: "agy 1.0.13",
-        entrypoint: null,
+        targetVersion: "agy 1.0.14",
+        entrypoint: acpEntrypointFromDefinition("gemini"),
         runtimeEnabledDefault: false,
         shipRuntimePilot: false,
         runtimePriority: 0,
@@ -70,7 +78,7 @@ const ACP_PROVIDER_REGISTRY = Object.freeze({
         status: "native_smoke_passed",
         supportKind: "native",
         targetVersion: "devin 2026.8.18 (16737566)",
-        entrypoint: Object.freeze({ command: "devin", args: Object.freeze(["acp"]) }),
+        entrypoint: acpEntrypointFromDefinition("devin"),
         runtimeEnabledDefault: false,
         shipRuntimePilot: true,
         runtimePriority: 3,
@@ -83,7 +91,7 @@ const ACP_PROVIDER_REGISTRY = Object.freeze({
         status: "native_smoke_passed",
         supportKind: "native",
         targetVersion: "cursor-agent 2026.06.29-2ad2186",
-        entrypoint: Object.freeze({ command: "cursor-agent", args: Object.freeze(["acp"]) }),
+        entrypoint: acpEntrypointFromDefinition("cursor"),
         runtimeEnabledDefault: false,
         shipRuntimePilot: true,
         runtimePriority: 4,

package/dist/acp/runtime.d.ts

@@ -25,11 +25,19 @@ export interface AcpRunRequest {
     readonly sessionId?: string;
     readonly cwd?: string;
     readonly correlationId: string;
+    readonly agentType?: string;
 }
 export interface AcpRunResult {
     readonly text: string;
     readonly gatewaySessionId: string;
     readonly protocolVersion: number | null;
     readonly durationMs: number;
+    readonly stopReason: string | null;
 }
+export interface AcpPromptUsage {
+    inputTokens?: number;
+    outputTokens?: number;
+    cacheReadTokens?: number;
+}
+export declare function extractAcpPromptUsage(meta: unknown): AcpPromptUsage;
 export declare function runAcpRequest(deps: AcpRuntimeDeps, req: AcpRunRequest): Promise<AcpRunResult>;

package/dist/acp/runtime.js

@@ -1,11 +1,29 @@
 import { AcpEventNormalizer } from "./event-normalizer.js";
-import { AcpDisabledError, AcpError, AcpProtocolError, ProviderRuntimeDisabledError, isAcpError, } from "./errors.js";
+import { AcpDisabledError, AcpError, AcpProtocolError, ProviderAcpDisabledError, ProviderRuntimeDisabledError, isAcpError, } from "./errors.js";
 import { buildAcpFlightResult, buildAcpFlightStart } from "./flight-redaction.js";
 import { GatewayHostServices } from "./host-services.js";
 import { createAcpPermissionDecider } from "./permission-bridge.js";
 import { AcpProcessManager } from "./process-manager.js";
 import { createAcpSession, recordAcpSessionInfo, resolveAcpResume } from "./session-map.js";
+import { DEVIN_ACP_AGENT_TYPES } from "../provider-definitions.js";
 import { noopLogger } from "../logger.js";
+export function extractAcpPromptUsage(meta) {
+    if (!meta || typeof meta !== "object" || Array.isArray(meta))
+        return {};
+    const record = meta;
+    const num = (value) => typeof value === "number" && Number.isFinite(value) ? value : undefined;
+    const usage = {};
+    const inputTokens = num(record.inputTokens);
+    if (inputTokens !== undefined)
+        usage.inputTokens = inputTokens;
+    const outputTokens = num(record.outputTokens);
+    if (outputTokens !== undefined)
+        usage.outputTokens = outputTokens;
+    const cacheReadTokens = num(record.cachedReadTokens);
+    if (cacheReadTokens !== undefined)
+        usage.cacheReadTokens = cacheReadTokens;
+    return usage;
+}
 export async function runAcpRequest(deps, req) {
     const logger = deps.logger ?? noopLogger;
     const now = deps.now ?? Date.now;
@@ -15,7 +33,10 @@ export async function runAcpRequest(deps, req) {
         throw new AcpDisabledError({ provider: req.provider });
     }
     const providerConfig = deps.config.providers[req.provider];
-    if (!providerConfig?.runtimeEnabled) {
+    if (providerConfig?.enabled !== true) {
+        throw new ProviderAcpDisabledError(req.provider, { provider: req.provider });
+    }
+    if (providerConfig?.runtimeEnabled !== true) {
         throw new ProviderRuntimeDisabledError(req.provider, { provider: req.provider });
     }
     const permissionDecider = createAcpPermissionDecider({
@@ -60,6 +81,11 @@ export async function runAcpRequest(deps, req) {
         prompt: promptBlocks,
         gatewaySessionId,
     }));
+    const extraArgs = req.provider === "devin" &&
+        req.agentType !== undefined &&
+        DEVIN_ACP_AGENT_TYPES.includes(req.agentType)
+        ? ["--agent-type", req.agentType]
+        : [];
     let proc = null;
     try {
         proc = await manager.start({
@@ -67,6 +93,7 @@ export async function runAcpRequest(deps, req) {
             cwd: req.cwd,
             hostServices,
             callbacks: { onSessionUpdate: update => normalizer.handle(update) },
+            extraArgs,
         });
         const cwd = proc.resolved.cwd;
         const init = proc.client.agentInfo;
@@ -85,16 +112,32 @@ export async function runAcpRequest(deps, req) {
                 agentVersion: init?.agentInfo?.version,
             });
         }
-        await proc.client.prompt({ sessionId: providerSessionId, prompt: promptBlocks });
+        const promptResult = await proc.client.prompt({
+            sessionId: providerSessionId,
+            prompt: promptBlocks,
+        });
+        normalizer.completeWith(promptResult.stopReason);
         const text = normalizer.finalText;
         const durationMs = elapsed();
-        deps.flightRecorder?.logComplete(req.correlationId, buildAcpFlightResult({ responseText: text, durationMs, status: "completed", exitCode: 0 }));
+        const usage = extractAcpPromptUsage(promptResult._meta);
+        deps.flightRecorder?.logComplete(req.correlationId, buildAcpFlightResult({
+            responseText: text,
+            durationMs,
+            status: "completed",
+            exitCode: 0,
+            providerSessionId,
+            stopReason: normalizer.stopReason,
+            inputTokens: usage.inputTokens,
+            outputTokens: usage.outputTokens,
+            cacheReadTokens: usage.cacheReadTokens,
+        }));
         logger.info("acp.request.success", { provider: req.provider, durationMs });
         return {
             text,
             gatewaySessionId,
             protocolVersion: init?.protocolVersion ?? null,
             durationMs,
+            stopReason: normalizer.stopReason ?? null,
         };
     }
     catch (err) {