llm-cli-gateway 2.13.2 → 2.14.0

package/dist/upstream-contracts.js

@@ -1,5 +1,6 @@
 import { spawnSync } from "node:child_process";
 import { createHash } from "node:crypto";
+import { getProviderDefinition } from "./provider-definitions.js";
 import { envWithExtendedPath, getExtendedPath, resolveCommandForSpawn } from "./executor.js";
 export const ACP_ENTRYPOINT_CONTRACTS = {
     mistral: {
@@ -8,7 +9,7 @@ export const ACP_ENTRYPOINT_CONTRACTS = {
         status: "native",
         executable: "vibe-acp",
         entrypointArgs: [],
-        targetVersion: "vibe 2.17.1",
+        targetVersion: "vibe 2.18.3",
         probeArgs: [["--version"], ["--help"]],
         evidence: "Native ACP executable vibe-acp; manual initialize + session/new smoke passed. First runtime pilot.",
         docsRef: "docs/plans/first-class-acp-gateway-extension.dag.toml#provider_matrix.mistral",
@@ -19,9 +20,9 @@ export const ACP_ENTRYPOINT_CONTRACTS = {
         status: "native",
         executable: "grok",
         entrypointArgs: ["agent", "stdio"],
-        targetVersion: "grok 0.2.73 (9ff14c43bb)",
+        targetVersion: "grok 0.2.77 (44e77bec3a)",
         probeArgs: [["agent", "stdio", "--help"]],
-        evidence: "Native ACP via `grok agent stdio`; initialize + session/new smoke passed with isolated leader socket. Second runtime pilot. Entrypoint re-probed clean at 0.2.73.",
+        evidence: "Native ACP via `grok agent stdio`; initialize + session/new smoke passed with isolated leader socket. Second runtime pilot. Entrypoint re-probed clean at 0.2.77.",
         docsRef: "docs/plans/first-class-acp-gateway-extension.dag.toml#provider_matrix.grok",
     },
     codex: {
@@ -42,10 +43,10 @@ export const ACP_ENTRYPOINT_CONTRACTS = {
         status: "adapter_mediated_deferred",
         executable: "claude",
         entrypointArgs: [],
-        targetVersion: "claude 2.1.195",
+        targetVersion: "claude 2.1.198",
         probeArgs: [],
         adapterCandidates: ["Claude Agent SDK ACP adapter"],
-        evidence: "No native Claude Code CLI ACP entrypoint at claude 2.1.195. Adapter ownership/permission bridging unresolved; deferred.",
+        evidence: "No native Claude Code CLI ACP entrypoint at claude 2.1.198. Adapter ownership/permission bridging unresolved; deferred.",
         docsRef: "docs/plans/first-class-acp-gateway-extension.dag.toml#provider_matrix.claude",
     },
     gemini: {
@@ -54,9 +55,9 @@ export const ACP_ENTRYPOINT_CONTRACTS = {
         status: "absent_watchlist",
         executable: "agy",
         entrypointArgs: [],
-        targetVersion: "agy 1.0.13",
+        targetVersion: "agy 1.0.14",
         probeArgs: [],
-        evidence: "agy 1.0.13 has no ACP flag or subcommand. Legacy Gemini CLI ACP evidence does not transfer. Watchlist item.",
+        evidence: "agy 1.0.14 has no ACP flag or subcommand. Legacy Gemini CLI ACP evidence does not transfer. Watchlist item.",
         docsRef: "docs/plans/first-class-acp-gateway-extension.dag.toml#provider_matrix.gemini",
     },
     devin: {
@@ -314,37 +315,69 @@ export const UPSTREAM_CLI_CONTRACTS = {
                 arity: "variadic",
                 description: 'Restrict the available built-in tool set ("" disables all)',
             },
+            "--include-hook-events": {
+                arity: "none",
+                description: "Emit hook lifecycle events into the stream-json output",
+            },
+            "--replay-user-messages": {
+                arity: "none",
+                description: "Replay user messages back on stdout in stream-json mode",
+            },
+            "--system-prompt-file": {
+                arity: "one",
+                description: "Replacement system prompt read from a file path",
+            },
+            "--append-system-prompt-file": {
+                arity: "one",
+                description: "Appended system prompt read from a file path",
+            },
+            "--name": { arity: "one", description: "Session name label" },
+            "--plugin-dir": {
+                arity: "one",
+                description: "Additional plugin directory (repeat once per directory)",
+            },
+            "--plugin-url": {
+                arity: "one",
+                description: "Additional plugin URL (repeat once per URL)",
+            },
+            "--safe-mode": {
+                arity: "none",
+                description: "Start with all customizations disabled (troubleshooting)",
+            },
+            "--bare": {
+                arity: "none",
+                description: "Minimal mode: skip hooks, LSP, plugin sync, attribution, auto-memory, keychain, CLAUDE.md discovery",
+            },
+            "--debug": {
+                arity: "optional",
+                description: "Enable debug mode with an optional category filter (e.g. api,hooks)",
+            },
+            "--debug-file": {
+                arity: "one",
+                description: "Write debug logs to a specific file path (implies debug mode)",
+            },
         },
         acknowledgedUpstreamFlags: [
             "--allow-dangerously-skip-permissions",
             "--allowed",
             "--ax-screen-reader",
             "--background",
-            "--bare",
             "--betas",
             "--bg",
             "--brief",
             "--chrome",
             "--dangerously-skip-permissions",
-            "--debug",
-            "--debug-file",
             "--disable-slash-commands",
             "--disallowed",
             "--file",
             "--from-pr",
             "--ide",
-            "--include-hook-events",
-            "--name",
             "--no-chrome",
-            "--plugin-dir",
-            "--plugin-url",
             "--print",
             "--prompt-suggestions",
             "--remote-control",
             "--remote-control-session-name-prefix",
-            "--replay-user-messages",
             "--resume",
-            "--safe-mode",
             "--tmux",
             "--version",
             "--worktree",
@@ -405,6 +438,33 @@ export const UPSTREAM_CLI_CONTRACTS = {
                 ],
                 expect: "pass",
             },
+            {
+                id: "claude-part-a-high-impact-flags",
+                description: "Phase 4 Part A: all wired headless-safe modifier flags accepted together",
+                args: [
+                    "-p",
+                    "hello",
+                    "--include-hook-events",
+                    "--replay-user-messages",
+                    "--system-prompt-file",
+                    "/tmp/sys.txt",
+                    "--append-system-prompt-file",
+                    "/tmp/append.txt",
+                    "--name",
+                    "my-session",
+                    "--plugin-dir",
+                    "/tmp/plugA",
+                    "--plugin-url",
+                    "https://example.com/a.zip",
+                    "--safe-mode",
+                    "--bare",
+                    "--debug",
+                    "api,hooks",
+                    "--debug-file",
+                    "/tmp/debug.log",
+                ],
+                expect: "pass",
+            },
             {
                 id: "claude-stream-json-requires-verbose",
                 description: "Claude CLI 2.x: --output-format stream-json + --include-partial-messages + --verbose accepted together",
@@ -434,7 +494,7 @@ export const UPSTREAM_CLI_CONTRACTS = {
             },
             {
                 id: "claude-background-acknowledged-not-emitted",
-                description: "Claude 2.1.195 advertises --bg/--background (background agent), but the gateway acknowledges them without emitting; caller argv is rejected",
+                description: "Claude 2.1.198 advertises --bg/--background (background agent), but the gateway acknowledges them without emitting; caller argv is rejected",
                 args: ["-p", "hello", "--background"],
                 expect: "fail",
             },
@@ -942,6 +1002,7 @@ export const UPSTREAM_CLI_CONTRACTS = {
             "yolo",
             "project",
             "newProject",
+            "printTimeout",
         ],
         flags: {
             "--print": { arity: "none", description: "Run a single prompt non-interactively" },
@@ -962,8 +1023,12 @@ export const UPSTREAM_CLI_CONTRACTS = {
                 arity: "none",
                 description: "Create a new Antigravity project for this session",
             },
+            "--print-timeout": {
+                arity: "one",
+                description: "Print-mode wait timeout as a Go duration string (e.g. 5m0s)",
+            },
         },
-        acknowledgedUpstreamFlags: ["--log-file", "--print-timeout", "--prompt-interactive"],
+        acknowledgedUpstreamFlags: ["--log-file", "--prompt-interactive"],
         env: {},
         conformanceFixtures: [
             {
@@ -1004,16 +1069,22 @@ export const UPSTREAM_CLI_CONTRACTS = {
             },
             {
                 id: "gemini-project-wired",
-                description: "Antigravity 1.0.13: --project <ID> is wired",
+                description: "Antigravity 1.0.14: --project <ID> is wired",
                 args: ["--print", "hello", "--project", "proj-123"],
                 expect: "pass",
             },
             {
                 id: "gemini-new-project-wired",
-                description: "Antigravity 1.0.13: --new-project is wired",
+                description: "Antigravity 1.0.14: --new-project is wired",
                 args: ["--print", "hello", "--new-project"],
                 expect: "pass",
             },
+            {
+                id: "gemini-print-timeout-wired",
+                description: "Antigravity --print-timeout <DURATION> is wired",
+                args: ["--print", "hello", "--print-timeout", "30s"],
+                expect: "pass",
+            },
         ],
     },
     grok: {
@@ -1488,7 +1559,7 @@ export const UPSTREAM_CLI_CONTRACTS = {
             },
             {
                 id: "grok-json-schema-wired",
-                description: "Grok 0.2.73: --json-schema <SCHEMA> is wired (structured output, implies json)",
+                description: "Grok 0.2.77: --json-schema <SCHEMA> is wired (structured output, implies json)",
                 args: [
                     "-p",
                     "hello",
@@ -1499,19 +1570,19 @@ export const UPSTREAM_CLI_CONTRACTS = {
             },
             {
                 id: "grok-fork-session-wired",
-                description: "Grok 0.2.73: --fork-session is wired (fork resumed session into a new ID)",
+                description: "Grok 0.2.77: --fork-session is wired (fork resumed session into a new ID)",
                 args: ["-p", "hello", "--resume", "sess-1", "--fork-session"],
                 expect: "pass",
             },
             {
                 id: "grok-worktree-ref-wired",
-                description: "Grok 0.2.73: --worktree-ref <REF> is wired (with --worktree)",
+                description: "Grok 0.2.77: --worktree-ref <REF> is wired (with --worktree)",
                 args: ["-p", "hello", "--worktree", "--worktree-ref", "main"],
                 expect: "pass",
             },
             {
                 id: "grok-session-id-acknowledged-not-emitted",
-                description: "Grok 0.2.73 advertises --session-id, but the gateway owns session-id lifecycle and does not emit it; caller argv is rejected",
+                description: "Grok 0.2.77 advertises --session-id, but the gateway owns session-id lifecycle and does not emit it; caller argv is rejected",
                 args: ["-p", "hello", "--session-id", "11111111-1111-1111-1111-111111111111"],
                 expect: "fail",
             },
@@ -1703,21 +1774,21 @@ export const UPSTREAM_CLI_CONTRACTS = {
             },
             {
                 id: "mistral-current-help-surface",
-                description: "Vibe 2.17.1 request-time help surface: --prompt, -v, --version, --setup accepted",
+                description: "Vibe 2.18.3 request-time help surface: --prompt, -v, --version, --setup accepted",
                 args: ["--prompt", "hello", "--agent", "auto-approve", "-v", "--version", "--setup"],
                 env: { VIBE_ACTIVE_MODEL: "mistral-medium-3.5" },
                 expect: "pass",
             },
             {
                 id: "mistral-yolo-shortcut-rejected",
-                description: "Vibe 2.17.1 advertises --yolo as a shortcut, but the gateway keeps using explicit --agent auto-approve",
+                description: "Vibe 2.18.3 advertises --yolo as a shortcut, but the gateway keeps using explicit --agent auto-approve",
                 args: ["-p", "hello", "--yolo"],
                 env: { VIBE_ACTIVE_MODEL: "mistral-medium-3.5" },
                 expect: "fail",
             },
             {
                 id: "mistral-check-upgrade-rejected",
-                description: "Vibe 2.17.1 advertises --check-upgrade, but gateway request validation rejects update-prompt flags",
+                description: "Vibe 2.18.3 advertises --check-upgrade, but gateway request validation rejects update-prompt flags",
                 args: ["--check-upgrade"],
                 env: { VIBE_ACTIVE_MODEL: "mistral-medium-3.5" },
                 expect: "fail",
@@ -1754,6 +1825,11 @@ export const UPSTREAM_CLI_CONTRACTS = {
             "resumeLatest",
             "createNewSession",
             "promptFile",
+            "config",
+            "sandbox",
+            "exportSession",
+            "respectWorkspaceTrust",
+            "agentConfig",
         ],
         flags: {
             "-p": {
@@ -1767,18 +1843,22 @@ export const UPSTREAM_CLI_CONTRACTS = {
                 description: "Permission mode (auto = read-only auto-approve; smart = additionally auto-runs safe actions per fast model; dangerous = approve all)",
             },
             "--prompt-file": { arity: "one", description: "Load the initial prompt from a file" },
+            "--config": { arity: "one", description: "Config file path" },
+            "--sandbox": { arity: "none", description: "Run the session in a sandbox" },
+            "--export": {
+                arity: "optional",
+                description: "Export the session (optional output path; bare flag uses the default)",
+            },
+            "--respect-workspace-trust": {
+                arity: "optional",
+                values: ["true", "false"],
+                description: "Respect workspace trust (defaults true for interactive, false for print mode)",
+            },
+            "--agent-config": { arity: "one", description: "Agent config file path" },
             "--resume": { arity: "one", description: "Resume a specific session by ID" },
             "--continue": { arity: "none", description: "Resume the most recent session in cwd" },
         },
-        acknowledgedUpstreamFlags: [
-            "--agent-config",
-            "--config",
-            "--export",
-            "--print",
-            "--respect-workspace-trust",
-            "--sandbox",
-            "--version",
-        ],
+        acknowledgedUpstreamFlags: ["--print", "--version"],
         env: {},
         conformanceFixtures: [
             {
@@ -1835,6 +1915,48 @@ export const UPSTREAM_CLI_CONTRACTS = {
                 args: ["-p", "hello", "--resume", "abc12345"],
                 expect: "pass",
             },
+            {
+                id: "devin-config",
+                description: "--config path is accepted",
+                args: ["-p", "hello", "--config", "/tmp/devin.toml"],
+                expect: "pass",
+            },
+            {
+                id: "devin-sandbox",
+                description: "--sandbox (bare flag) is accepted",
+                args: ["-p", "hello", "--sandbox"],
+                expect: "pass",
+            },
+            {
+                id: "devin-export-bare",
+                description: "--export as a bare flag (no path) is accepted",
+                args: ["-p", "hello", "--export"],
+                expect: "pass",
+            },
+            {
+                id: "devin-export-path",
+                description: "--export with an output path is accepted",
+                args: ["-p", "hello", "--export", "/tmp/session.json"],
+                expect: "pass",
+            },
+            {
+                id: "devin-respect-workspace-trust",
+                description: "--respect-workspace-trust with an explicit boolean is accepted",
+                args: ["-p", "hello", "--respect-workspace-trust", "true"],
+                expect: "pass",
+            },
+            {
+                id: "devin-respect-workspace-trust-invalid",
+                description: "--respect-workspace-trust with a non-boolean value is rejected",
+                args: ["-p", "hello", "--respect-workspace-trust", "maybe"],
+                expect: "fail",
+            },
+            {
+                id: "devin-agent-config",
+                description: "--agent-config path is accepted",
+                args: ["-p", "hello", "--agent-config", "/tmp/agent.toml"],
+                expect: "pass",
+            },
         ],
     },
     cursor: {
@@ -2709,3 +2831,54 @@ export function buildUpstreamContractReport(options = {}) {
             : null,
     };
 }
+function extractVersionNumber(text) {
+    return /\d+(?:\.\d+)+/.exec(text)?.[0] ?? null;
+}
+export function computeDiscoveryContractDrift(cli, discovered) {
+    const contract = UPSTREAM_CLI_CONTRACTS[cli];
+    const contractTargetVersion = getProviderDefinition(cli).upstreamContract.targetVersion;
+    const discoveredSet = new Set(discovered.discoveredFlagNames);
+    const contractFlagSet = new Set(Object.keys(contract.flags));
+    const acknowledged = new Set(contract.acknowledgedUpstreamFlags ?? []);
+    const missingContractFlags = [];
+    for (const [flag, spec] of Object.entries(contract.flags)) {
+        if (spec.hiddenFromHelp)
+            continue;
+        if (!discoveredSet.has(flag))
+            missingContractFlags.push(flag);
+    }
+    const ignored = new Set(["--help", "-h", "--version", "-V"]);
+    const newDiscoveredFlags = [];
+    for (const flag of discovered.discoveredFlagNames) {
+        if (contractFlagSet.has(flag))
+            continue;
+        if (acknowledged.has(flag))
+            continue;
+        if (ignored.has(flag))
+            continue;
+        newDiscoveredFlags.push(flag);
+    }
+    const discoveredNumber = extractVersionNumber(discovered.version);
+    const contractNumber = extractVersionNumber(contractTargetVersion);
+    const versionMatchesContract = discoveredNumber !== null && contractNumber !== null && discoveredNumber === contractNumber;
+    let status;
+    if (discovered.status !== "ok") {
+        status = "degraded";
+    }
+    else if (missingContractFlags.length > 0 || newDiscoveredFlags.length > 0) {
+        status = "drift";
+    }
+    else {
+        status = "clean";
+    }
+    return {
+        cli,
+        version: discovered.version,
+        contractTargetVersion,
+        versionMatchesContract,
+        missingContractFlags,
+        newDiscoveredFlags,
+        discoveredUnmappedCount: discovered.discoveredUnmappedCount,
+        status,
+    };
+}

package/npm-shrinkwrap.json

@@ -1,12 +1,12 @@
 {
   "name": "llm-cli-gateway",
-  "version": "2.13.2",
+  "version": "2.14.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "llm-cli-gateway",
-      "version": "2.13.2",
+      "version": "2.14.0",
       "license": "MIT",
       "dependencies": {
         "@modelcontextprotocol/sdk": "^1.29.0",

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "llm-cli-gateway",
-  "version": "2.13.2",
+  "version": "2.14.0",
   "mcpName": "io.github.verivus-oss/llm-cli-gateway",
-  "description": "MCP server providing unified access to Claude Code, Codex, Gemini, Grok, Mistral Vibe, and Devin CLIs with session management, retry logic, async job orchestration, durable job results, and cross-LLM validation.",
+  "description": "Local-first MCP gateway for cross-model review across native coding-agent CLIs and API-token LLMs with sessions, durable jobs, and validation receipts.",
   "license": "MIT",
   "author": "VerivusAI Labs (https://github.com/verivus-oss)",
   "repository": {
@@ -82,12 +82,17 @@
     "smoke:cache-control": "node docs/plans/slice-kappa-smoke-test.mjs",
     "upstream:contracts": "node scripts/upstream-scan.mjs --contracts-check",
     "upstream:scan": "node scripts/upstream-scan.mjs",
+    "provider:surfaces:check": "node scripts/provider-surfaces-check.mjs",
     "lint": "eslint src/**/*.ts",
     "lint:fix": "eslint src/**/*.ts --fix",
     "format": "prettier --write 'src/**/*.ts'",
     "format:check": "prettier --check 'src/**/*.ts'",
     "security:audit": "bash scripts/release-security-audit.sh",
-    "check": "npm run build && npm run lint && npm run format:check && npm test && npm run security:audit",
+    "search:google:submit": "node scripts/submit-google-search-console.mjs",
+    "search:google:submit:dry-run": "node scripts/submit-google-search-console.mjs --dry-run",
+    "search:submit": "node scripts/submit-indexnow.mjs",
+    "search:submit:dry-run": "node scripts/submit-indexnow.mjs --dry-run",
+    "check": "npm run build && npm run lint && npm run format:check && npm run provider:surfaces:check && npm test && npm run security:audit",
     "release:build": "bash installer/build-release.sh",
     "release:checksums": "cd installer/dist && sha256sum --check SHA256SUMS",
     "release:docker": "docker compose -f docker/personal.compose.yml build"