llm-cli-gateway 2.14.1 → 2.16.0

package/dist/upstream-contracts.js

@@ -1,6 +1,6 @@
 import { spawnSync } from "node:child_process";
 import { createHash } from "node:crypto";
-import { getProviderDefinition } from "./provider-definitions.js";
+import { getProviderDefinition, PROVIDER_TARGET_VERSIONS, } from "./provider-definitions.js";
 import { envWithExtendedPath, getExtendedPath, resolveCommandForSpawn } from "./executor.js";
 export const ACP_ENTRYPOINT_CONTRACTS = {
     mistral: {
@@ -9,7 +9,7 @@ export const ACP_ENTRYPOINT_CONTRACTS = {
         status: "native",
         executable: "vibe-acp",
         entrypointArgs: [],
-        targetVersion: "vibe 2.18.3",
+        targetVersion: PROVIDER_TARGET_VERSIONS.mistral,
         probeArgs: [["--version"], ["--help"]],
         evidence: "Native ACP executable vibe-acp; manual initialize + session/new smoke passed. First runtime pilot.",
         docsRef: "docs/plans/first-class-acp-gateway-extension.dag.toml#provider_matrix.mistral",
@@ -20,9 +20,9 @@ export const ACP_ENTRYPOINT_CONTRACTS = {
         status: "native",
         executable: "grok",
         entrypointArgs: ["agent", "stdio"],
-        targetVersion: "grok 0.2.77 (44e77bec3a)",
+        targetVersion: PROVIDER_TARGET_VERSIONS.grok,
         probeArgs: [["agent", "stdio", "--help"]],
-        evidence: "Native ACP via `grok agent stdio`; initialize + session/new smoke passed with isolated leader socket. Second runtime pilot. Entrypoint re-probed clean at 0.2.77.",
+        evidence: `Native ACP via \`grok agent stdio\`; initialize + session/new smoke passed with isolated leader socket. Second runtime pilot. Entrypoint re-probed clean at ${PROVIDER_TARGET_VERSIONS.grok}.`,
         docsRef: "docs/plans/first-class-acp-gateway-extension.dag.toml#provider_matrix.grok",
     },
     codex: {
@@ -31,10 +31,10 @@ export const ACP_ENTRYPOINT_CONTRACTS = {
         status: "adapter_mediated_deferred",
         executable: "codex",
         entrypointArgs: [],
-        targetVersion: "codex-cli 0.142.4",
+        targetVersion: PROVIDER_TARGET_VERSIONS.codex,
         probeArgs: [],
         adapterCandidates: ["zed-industries/codex-acp", "agentclientprotocol/codex-acp"],
-        evidence: "No native ACP entrypoint at codex-cli 0.142.4. Adapter evidence tracked as documentation only; not native gateway ACP support.",
+        evidence: `No native ACP entrypoint at ${PROVIDER_TARGET_VERSIONS.codex}. Adapter evidence tracked as documentation only; not native gateway ACP support.`,
         docsRef: "docs/plans/first-class-acp-gateway-extension.dag.toml#provider_matrix.codex",
     },
     claude: {
@@ -43,10 +43,10 @@ export const ACP_ENTRYPOINT_CONTRACTS = {
         status: "adapter_mediated_deferred",
         executable: "claude",
         entrypointArgs: [],
-        targetVersion: "claude 2.1.198",
+        targetVersion: PROVIDER_TARGET_VERSIONS.claude,
         probeArgs: [],
         adapterCandidates: ["Claude Agent SDK ACP adapter"],
-        evidence: "No native Claude Code CLI ACP entrypoint at claude 2.1.198. Adapter ownership/permission bridging unresolved; deferred.",
+        evidence: `No native Claude Code CLI ACP entrypoint at ${PROVIDER_TARGET_VERSIONS.claude}. Adapter ownership/permission bridging unresolved; deferred.`,
         docsRef: "docs/plans/first-class-acp-gateway-extension.dag.toml#provider_matrix.claude",
     },
     gemini: {
@@ -55,9 +55,9 @@ export const ACP_ENTRYPOINT_CONTRACTS = {
         status: "absent_watchlist",
         executable: "agy",
         entrypointArgs: [],
-        targetVersion: "agy 1.0.14",
+        targetVersion: PROVIDER_TARGET_VERSIONS.gemini,
         probeArgs: [],
-        evidence: "agy 1.0.14 has no ACP flag or subcommand. Legacy Gemini CLI ACP evidence does not transfer. Watchlist item.",
+        evidence: `${PROVIDER_TARGET_VERSIONS.gemini} has no ACP flag or subcommand. Legacy Gemini CLI ACP evidence does not transfer. Watchlist item.`,
         docsRef: "docs/plans/first-class-acp-gateway-extension.dag.toml#provider_matrix.gemini",
     },
     devin: {
@@ -66,7 +66,7 @@ export const ACP_ENTRYPOINT_CONTRACTS = {
         status: "native",
         executable: "devin",
         entrypointArgs: ["acp"],
-        targetVersion: "devin 2026.8.18 (16737566)",
+        targetVersion: PROVIDER_TARGET_VERSIONS.devin,
         probeArgs: [["--version"]],
         evidence: 'Native ACP entrypoint `devin acp` (stdio JSON-RPC). Slice D1 manual initialize + session/new smoke passed (protocolVersion 1, agent "Affogato", session created). Third native runtime pilot; routing stays config-gated.',
         docsRef: "docs/plans/first-class-acp-gateway-extension.dag.toml#provider_matrix.devin",
@@ -77,7 +77,7 @@ export const ACP_ENTRYPOINT_CONTRACTS = {
         status: "native",
         executable: "cursor-agent",
         entrypointArgs: ["acp"],
-        targetVersion: "cursor-agent 2026.06.29-2ad2186",
+        targetVersion: PROVIDER_TARGET_VERSIONS.cursor,
         probeArgs: [["acp", "--help"]],
         evidence: "Native hidden ACP entrypoint `cursor-agent acp` (stdio JSON-RPC). `cursor-agent acp --help` was verified locally; manual initialize + session/new smoke passed locally (protocolVersion 1, session created; no agentInfo returned). Runtime routing stays config-gated.",
         docsRef: "docs/plans/first-class-acp-gateway-extension.dag.toml#provider_matrix.cursor",
@@ -326,10 +326,12 @@ export const UPSTREAM_CLI_CONTRACTS = {
             "--system-prompt-file": {
                 arity: "one",
                 description: "Replacement system prompt read from a file path",
+                hiddenFromHelp: true,
             },
             "--append-system-prompt-file": {
                 arity: "one",
                 description: "Appended system prompt read from a file path",
+                hiddenFromHelp: true,
             },
             "--name": { arity: "one", description: "Session name label" },
             "--plugin-dir": {
@@ -494,7 +496,7 @@ export const UPSTREAM_CLI_CONTRACTS = {
             },
             {
                 id: "claude-background-acknowledged-not-emitted",
-                description: "Claude 2.1.198 advertises --bg/--background (background agent), but the gateway acknowledges them without emitting; caller argv is rejected",
+                description: "Claude 2.1.204 advertises --bg/--background (background agent), but the gateway acknowledges them without emitting; caller argv is rejected",
                 args: ["-p", "hello", "--background"],
                 expect: "fail",
             },
@@ -658,8 +660,11 @@ export const UPSTREAM_CLI_CONTRACTS = {
                 "--disable",
                 "--enable",
                 "--include-managed-config",
-                "--permissions-profile",
+                "--permission-profile",
                 "--profile",
+                "--sandbox-state-disable-network",
+                "--sandbox-state-json",
+                "--sandbox-state-readable-root",
             ], { exposure: "not_exposed" }),
             debug: subcommand(["debug"], "Run Codex debugging utilities.", "read_only", ["--config", "--disable", "--enable"], { tier: "diagnostic" }),
             apply: subcommand(["apply"], "Apply a Codex patch to the workspace.", "destructive", ["--config", "--disable", "--enable"], { exposure: "not_exposed" }),
@@ -1028,7 +1033,7 @@ export const UPSTREAM_CLI_CONTRACTS = {
                 description: "Print-mode wait timeout as a Go duration string (e.g. 5m0s)",
             },
         },
-        acknowledgedUpstreamFlags: ["--log-file", "--prompt-interactive"],
+        acknowledgedUpstreamFlags: ["--log-file", "--mode", "--prompt-interactive"],
         env: {},
         conformanceFixtures: [
             {
@@ -1109,6 +1114,7 @@ export const UPSTREAM_CLI_CONTRACTS = {
                 "--leader-socket",
                 "--model",
                 "--no-leader",
+                "--plugin-dir",
                 "--reasoning-effort",
                 "--reauth",
                 "--xai-api-base-url",
@@ -1189,11 +1195,11 @@ export const UPSTREAM_CLI_CONTRACTS = {
                     "--deny",
                     "--disable-web-search",
                     "--disallowed-tools",
-                    "--effort",
                     "--experimental-memory",
                     "--fork-session",
                     "--json-schema",
                     "--max-turns",
+                    "--minimal",
                     "--model",
                     "--no-alt-screen",
                     "--no-memory",
@@ -1233,7 +1239,7 @@ export const UPSTREAM_CLI_CONTRACTS = {
             worktree: subcommand(["worktree"], "Manage Grok worktree sessions.", "writes_local_config", ["--leader-socket"]),
         }, GROK_DEBUG_HELP_FLAGS),
         maxPositionals: 0,
-        acknowledgedUpstreamFlags: [...GROK_DEBUG_HELP_FLAGS, "--session-id"],
+        acknowledgedUpstreamFlags: [...GROK_DEBUG_HELP_FLAGS, "--minimal", "--session-id"],
         mcpTools: ["grok_request", "grok_request_async"],
         mcpParameters: [
             "prompt",
@@ -1675,7 +1681,13 @@ export const UPSTREAM_CLI_CONTRACTS = {
                 description: "Additional writable workspace directory (Phase 4 slice ζ; repeat once per directory)",
             },
         },
-        acknowledgedUpstreamFlags: ["--auto-approve", "--check-upgrade", "--yolo"],
+        acknowledgedUpstreamFlags: [
+            "--auto-approve",
+            "--check-upgrade",
+            "--disabled-tools",
+            "--worktree",
+            "--yolo",
+        ],
         env: {
             VIBE_ACTIVE_MODEL: {
                 arity: "one",
@@ -1774,25 +1786,39 @@ export const UPSTREAM_CLI_CONTRACTS = {
             },
             {
                 id: "mistral-current-help-surface",
-                description: "Vibe 2.18.3 request-time help surface: --prompt, -v, --version, --setup accepted",
+                description: "Vibe 2.19.1 request-time help surface: --prompt, -v, --version, --setup accepted",
                 args: ["--prompt", "hello", "--agent", "auto-approve", "-v", "--version", "--setup"],
                 env: { VIBE_ACTIVE_MODEL: "mistral-medium-3.5" },
                 expect: "pass",
             },
             {
                 id: "mistral-yolo-shortcut-rejected",
-                description: "Vibe 2.18.3 advertises --yolo as a shortcut, but the gateway keeps using explicit --agent auto-approve",
+                description: "Vibe 2.19.0 advertises --yolo as a shortcut, but the gateway keeps using explicit --agent auto-approve",
                 args: ["-p", "hello", "--yolo"],
                 env: { VIBE_ACTIVE_MODEL: "mistral-medium-3.5" },
                 expect: "fail",
             },
             {
                 id: "mistral-check-upgrade-rejected",
-                description: "Vibe 2.18.3 advertises --check-upgrade, but gateway request validation rejects update-prompt flags",
+                description: "Vibe 2.19.0 advertises --check-upgrade, but gateway request validation rejects update-prompt flags",
                 args: ["--check-upgrade"],
                 env: { VIBE_ACTIVE_MODEL: "mistral-medium-3.5" },
                 expect: "fail",
             },
+            {
+                id: "mistral-worktree-rejected",
+                description: "Vibe 2.19.0 advertises --worktree (native worktree); the gateway uses slice-λ worktree (spawns with cwd) and rejects raw --worktree as caller argv",
+                args: ["-p", "hello", "--worktree", "feature"],
+                env: { VIBE_ACTIVE_MODEL: "mistral-medium-3.5" },
+                expect: "fail",
+            },
+            {
+                id: "mistral-disabled-tools-rejected",
+                description: "Vibe 2.19.1 adds --disabled-tools (denylist counterpart to --enabled-tools); the gateway does not emit it (disallowedTools is accepted but ignored) and rejects raw --disabled-tools as caller argv",
+                args: ["-p", "hello", "--disabled-tools", "shell"],
+                env: { VIBE_ACTIVE_MODEL: "mistral-medium-3.5" },
+                expect: "fail",
+            },
             {
                 id: "mistral-resume-bare",
                 description: "Vibe --resume without session ID is accepted (optional arity)",
@@ -2031,22 +2057,16 @@ export const UPSTREAM_CLI_CONTRACTS = {
         acknowledgedUpstreamFlags: [
             "--api-key",
             "--header",
-            "-H",
-            "-p",
             "--plan",
             "--yolo",
             "--approve-mcps",
             "--plugin-dir",
             "--worktree",
-            "-w",
             "--worktree-base",
             "--skip-worktree-setup",
             "--stream-partial-output",
             "--list-models",
             "--version",
-            "-v",
-            "--help",
-            "-h",
         ],
         env: {
             CURSOR_API_KEY: {

package/npm-shrinkwrap.json

@@ -1,12 +1,12 @@
 {
   "name": "llm-cli-gateway",
-  "version": "2.14.1",
+  "version": "2.16.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "llm-cli-gateway",
-      "version": "2.14.1",
+      "version": "2.16.0",
       "license": "MIT",
       "dependencies": {
         "@modelcontextprotocol/sdk": "^1.29.0",

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "llm-cli-gateway",
-  "version": "2.14.1",
+  "version": "2.16.0",
   "mcpName": "io.github.verivus-oss/llm-cli-gateway",
-  "description": "Local-first MCP gateway for cross-model review across native coding-agent CLIs and API-token LLMs with sessions, durable jobs, and validation receipts.",
+  "description": "Secure local control plane for AI coding agents across supported MCP clients, with workspace-scoped remote access, approval gates, durable jobs, sessions, and audit receipts.",
   "license": "MIT",
   "author": "VerivusAI Labs (https://github.com/verivus-oss)",
   "repository": {
@@ -20,6 +20,7 @@
     "codex",
     "gemini",
     "orchestration",
+    "control-plane",
     "model-context-protocol",
     "ai",
     "cli-gateway"
@@ -84,6 +85,9 @@
     "upstream:contracts": "node scripts/upstream-scan.mjs --contracts-check",
     "upstream:scan": "node scripts/upstream-scan.mjs",
     "provider:surfaces:check": "node scripts/provider-surfaces-check.mjs",
+    "site:generate": "node scripts/generate-site-discovery.mjs",
+    "site:generate:check": "node scripts/generate-site-discovery.mjs --check",
+    "site:validate": "node scripts/validate-site-discovery.mjs",
     "lint": "eslint src/**/*.ts",
     "lint:fix": "eslint src/**/*.ts --fix",
     "format": "prettier --write 'src/**/*.ts'",
@@ -93,7 +97,7 @@
     "search:google:submit:dry-run": "node scripts/submit-google-search-console.mjs --dry-run",
     "search:submit": "node scripts/submit-indexnow.mjs",
     "search:submit:dry-run": "node scripts/submit-indexnow.mjs --dry-run",
-    "check": "npm run build && npm run lint && npm run format:check && npm run provider:surfaces:check && npm test && npm run security:audit",
+    "check": "npm run build && npm run lint && npm run format:check && npm run provider:surfaces:check && npm run site:generate:check && npm run site:validate && npm test && npm run security:audit",
     "release:build": "bash installer/build-release.sh",
     "release:checksums": "cd installer/dist && sha256sum --check SHA256SUMS",
     "release:docker": "docker compose -f docker/personal.compose.yml build"