llm-cli-gateway 2.17.0 → 2.17.1

package/CHANGELOG.md

@@ -4,6 +4,15 @@ All notable changes to the llm-cli-gateway project.
 
 ## [Unreleased]
 
+## [2.17.1] - 2026-07-13
+
+### Fixed
+
+- **Upstream CLI contract refresh.** Updated installed-provider contracts for
+  Claude, Codex, Antigravity, Grok, Mistral Vibe, Devin, and Cursor Agent.
+  Vibe now emits its supported `--disabled-tools` denylist control instead of
+  silently ignoring `disallowedTools`.
+
 ## [2.17.0] - 2026-07-13
 
 ### Added

package/README.md

@@ -97,7 +97,7 @@ The next documentation focus is provider-specific skill and DAG-TOML pairs for e
 - CI runs build, lint, format, tests, package checks, and npm audit.
 - Security CI runs actionlint, zizmor, shellcheck, typos, osv-scanner, gitleaks, and lychee.
 - GitHub release installer artifacts are checksummed and signed with Sigstore keyless signing.
-- npm releases use a generated prod-only shrinkwrap and release security audit; the publish token is fetched at runtime from Azure Key Vault through GitHub OIDC to Entra.
+- npm releases use a generated prod-only shrinkwrap and release security audit; GitHub Actions Trusted Publishing exchanges the job's OIDC identity for short-lived npm publish credentials.
 - The npm package intentionally ships a generated, prod-only `npm-shrinkwrap.json` so registry installs resolve the audited release tree. Release gates regenerate it from `package-lock.json`, compare for parity, and run a registry-fidelity consumer install before publishing.
 - Socket behavioural alerts are documented in [`socket.yml`](./socket.yml) and under "Security Considerations" below. `shellAccess` and `shrinkwrap` are reviewed package capabilities/configuration for this CLI appliance, not hidden install behaviour.
 
@@ -370,12 +370,12 @@ Vibe-specific notes:
   `default | plan | accept-edits | auto-approve`; Vibe also accepts install-gated
   builtins (e.g. `lean`) and custom agents from `~/.vibe/agents`, so any name is
   passed through and Vibe validates availability. The gateway's
-  programmatic-mode default is `auto-approve`; pick a stricter mode
-  explicitly if you need approval gates.
-- **`allowedTools` is allow-list only** — the gateway emits one
-  `--enabled-tools <tool>` flag per entry. `disallowedTools` is accepted in
-  the schema for caller-side parity but is silently ignored at the CLI
-  boundary (a `logger.info` warning records the no-op).
+  programmatic-mode default is `accept-edits`; use `auto-approve` only as an
+  explicit opt-in.
+- **Tool controls use Vibe's native flags.** The gateway emits one
+  `--enabled-tools <tool>` flag per `allowedTools` entry and one
+  `--disabled-tools <tool>` flag per `disallowedTools` entry. Vibe applies
+  disabled tools after enabled-tool filtering.
 - **No self-update**: `cli_upgrade --cli mistral` detects whether you used
   pip / uv / brew and dispatches the matching upgrade command. Running
   `vibe update` is not a thing.
@@ -992,9 +992,9 @@ Run a Mistral Vibe agentic coding request. Like `grok_request` in shape, but wit
 
 - `model` (string, optional): Vibe model alias (for example `mistral-medium-3.5` or `latest`). The resolved value is injected via the `VIBE_ACTIVE_MODEL` environment variable; omit it to let the gateway discover Vibe config and avoid stale hardcoded defaults.
 - `transport` (string, optional): `"cli"` (default) runs the Vibe CLI; `"acp"` routes through Vibe's native `vibe-acp` transport when `[acp].enabled` and the provider's `runtime_enabled` are set (fails closed otherwise). Sync-only: `mistral_request_async` always runs the CLI transport and does not accept `transport`
-- `permissionMode`: the Vibe `--agent` name — builtins `default | plan | accept-edits | auto-approve`, or any install-gated/custom agent. Emitted as `--agent <name>`. Defaults to `auto-approve` in programmatic mode.
-- `allowedTools` (string[], optional): One `--enabled-tools <tool>` flag per entry (allow-list only).
-- `disallowedTools` (string[], optional): Accepted for parity with the other providers; ignored at the CLI boundary with a logged warning.
+- `permissionMode`: the Vibe `--agent` name: builtins `default | plan | accept-edits | auto-approve`, or any install-gated/custom agent. Emitted as `--agent <name>`. Defaults to `accept-edits` in programmatic mode; use `auto-approve` only as an explicit opt-in.
+- `allowedTools` (string[], optional): One `--enabled-tools <tool>` flag per entry.
+- `disallowedTools` (string[], optional): One `--disabled-tools <tool>` flag per entry, applied after the enabled-tool filter.
 - `outputFormat` (string, optional): Vibe 2.x values are `"text"`, `"json"`, or `"streaming"`; legacy aliases `"plain"` and `"stream-json"` are accepted and normalized before spawn.
 - `sessionId` / `resumeLatest` / `createNewSession`: standard session controls. Current Vibe defaults session logging to enabled; if an older config has `[session_logging] enabled = false`, `doctor --json` surfaces an actionable next-action.
 - `trust` (boolean, optional): Emit `--trust` so Vibe trusts the cwd for this invocation only (not persisted; skips the interactive trust prompt)
@@ -1023,7 +1023,7 @@ Run a Cognition Devin CLI request synchronously (headless print mode, `devin -p`
 - `model` (string, optional): Model name or alias (e.g. `opus`, `latest`)
 - `transport` (string, optional): `"cli"` (default) runs the Devin CLI; `"acp"` routes through Devin's native `devin acp` transport when `[acp].enabled` and the provider's `runtime_enabled` are set (fails closed otherwise). Sync-only: `devin_request_async` always runs the CLI transport and accepts neither `transport` nor `agentType`
 - `agentType` (string, optional): ACP agent variant for `transport: "acp"` (`devin acp --agent-type`): `"summarizer"` (no tools, text summary) or `"review"` (read-only plus shell code-review); ignored for the CLI transport
-- `permissionMode` (string, optional): Devin CLI permission mode (`--permission-mode`): `auto` (auto-approves read-only tools), `smart` (also auto-runs actions a fast model judges safe), `dangerous` (auto-approves all). Omit to use Devin's headless default
+- `permissionMode` (string, optional): Devin CLI permission mode (`--permission-mode`): `auto` (auto-approves read-only tools), `accept-edits` (also auto-approves workspace edits), `smart` (also auto-runs actions a fast model judges safe), `dangerous` (auto-approves all). Omit to use Devin's headless default
 - `promptFile` (string, optional): Load the initial prompt from a file (`--prompt-file`)
 - `sessionId` (string, optional): Devin session ID to resume (`--resume <id>`). The `gw-*` id minted for a brand-new session is not resumable via `sessionId`; continue with `resumeLatest: true`
 - `resumeLatest` (boolean, optional): Resume the most recent Devin session in cwd (`--continue`)
@@ -1653,7 +1653,7 @@ The gateway supports concurrent requests across different CLIs. Each request spa
 - **Command Execution**: Uses `spawn` with separate arguments (not shell execution)
 - **No Eval**: No dynamic code evaluation in our source (see "Socket alerts" below for the transitive `ajv` codegen case)
 - **Sandboxing**: Consider running in containers for production use
-- **npm publish control**: npm releases are gated by the generated prod-only shrinkwrap, release security audit, packed-consumer checks, and a publish token fetched at runtime from Azure Key Vault through GitHub OIDC to Entra
+- **npm publish control**: npm releases are gated by the generated prod-only shrinkwrap, release security audit, packed-consumer checks, and GitHub Actions Trusted Publishing with short-lived OIDC-derived npm publish credentials
 - **Release signing**: GitHub release installer artifacts are signed with Sigstore keyless signing; verify `SHA256SUMS.sigstore.json` before trusting the checksum file
 
 ### Socket alerts — context for reviewers

package/dist/index.d.ts

@@ -386,7 +386,6 @@ export declare function buildMistralRetryPrep(params: Pick<MistralRequestParams,
 }, recoveryModel: string): {
     args: string[];
     env: Record<string, string>;
-    ignoredDisallowedTools: boolean;
 };
 export declare function buildCliResponse(cli: CliType, stdout: string, optimizeResponse: boolean, corrId: string, sessionId: string | undefined, prep: CliRequestPrep, durationMs: number, resumable?: boolean, outputFormat?: string, warnings?: WarningEntry[], compressResponse?: boolean): ExtendedToolResponse;
 export interface GrokApiRequestParams {
@@ -542,7 +541,7 @@ export declare function handleGrokRequestAsync(deps: AsyncHandlerDeps, params: O
 export interface DevinRequestParams {
     prompt?: string;
     model?: string;
-    permissionMode?: "auto" | "smart" | "dangerous";
+    permissionMode?: "auto" | "accept-edits" | "smart" | "dangerous";
     promptFile?: string;
     config?: string;
     sandbox?: boolean;

package/dist/index.js

@@ -2348,9 +2348,6 @@ export function prepareMistralRequest(params, runtime = resolveGatewayServerRunt
         workingDir: params.workingDir,
         addDir: params.addDir,
     });
-    if (prep.ignoredDisallowedTools) {
-        runtime.logger.info(`[${corrId}] Mistral does not support disallowedTools; ignoring (caller passed ${params.disallowedTools?.length ?? 0} entries)`);
-    }
     return {
         corrId,
         effectivePrompt,
@@ -5446,7 +5443,7 @@ export function createGatewayServer(deps = {}) {
         permissionMode: z
             .enum(CLAUDE_PERMISSION_MODES)
             .optional()
-            .describe("Claude --permission-mode: default|acceptEdits|plan|auto|dontAsk|bypassPermissions. `default` is a no-op (no flag emitted)."),
+            .describe("Claude --permission-mode: default|acceptEdits|auto|bypassPermissions|manual|dontAsk|plan. `default` is a no-op (no flag emitted)."),
         agent: z
             .string()
             .optional()
@@ -6522,9 +6519,9 @@ export function createGatewayServer(deps = {}) {
             .default("cli")
             .describe("Transport: 'cli' (default) runs the Devin CLI; 'acp' routes through `devin acp` when [acp].enabled and the provider's runtime_enabled are set (fails closed otherwise)."),
         permissionMode: z
-            .enum(["auto", "smart", "dangerous"])
+            .enum(["auto", "accept-edits", "smart", "dangerous"])
             .optional()
-            .describe("Devin CLI permission mode (--permission-mode). auto auto-approves read-only tools; smart additionally auto-runs actions a fast model judges safe; dangerous auto-approves all. When omitted, Devin uses its own headless default; pass auto or smart for unattended runs."),
+            .describe("Devin CLI permission mode (--permission-mode). auto auto-approves read-only tools; accept-edits also auto-approves workspace edits; smart additionally auto-runs actions a fast model judges safe; dangerous auto-approves all. When omitted, Devin uses its own headless default; choose an explicit mode for unattended runs."),
         promptFile: z
             .string()
             .optional()
@@ -6764,7 +6761,7 @@ export function createGatewayServer(deps = {}) {
         disallowedTools: z
             .array(z.string())
             .optional()
-            .describe("Accepted for caller parity; Vibe has no deny-list flag, so values are ignored (a warning is logged)."),
+            .describe("Denylist of built-in tools, each emitted as a separate --disabled-tools <tool> flag"),
         correlationId: z.string().optional().describe("Request trace ID (auto if omitted)"),
         optimizePrompt: z.boolean().default(false).describe("Optimize prompt before execution"),
         optimizeResponse: z.boolean().default(false).describe("Optimize response output"),
@@ -6878,7 +6875,7 @@ export function createGatewayServer(deps = {}) {
             permissionMode: z
                 .enum(CLAUDE_PERMISSION_MODES)
                 .optional()
-                .describe("Claude --permission-mode: default|acceptEdits|plan|auto|dontAsk|bypassPermissions. `default` is a no-op."),
+                .describe("Claude --permission-mode: default|acceptEdits|auto|bypassPermissions|manual|dontAsk|plan. `default` is a no-op."),
             agent: z
                 .string()
                 .optional()
@@ -7688,9 +7685,9 @@ export function createGatewayServer(deps = {}) {
                 .describe("Prompt text for Devin CLI. Required in practice; promptFile is additive (loads an initial prompt from a file)."),
             model: z.string().optional().describe("Model name or alias (e.g. opus, latest)"),
             permissionMode: z
-                .enum(["auto", "smart", "dangerous"])
+                .enum(["auto", "accept-edits", "smart", "dangerous"])
                 .optional()
-                .describe("Devin CLI permission mode (--permission-mode). auto, smart, or dangerous. When omitted, Devin uses its own headless default; pass auto or smart for unattended runs."),
+                .describe("Devin CLI permission mode (--permission-mode). auto, accept-edits, smart, or dangerous. When omitted, Devin uses its own headless default; choose an explicit mode for unattended runs."),
             promptFile: z
                 .string()
                 .optional()
@@ -7913,7 +7910,7 @@ export function createGatewayServer(deps = {}) {
             disallowedTools: z
                 .array(z.string())
                 .optional()
-                .describe("Accepted for caller parity; Vibe has no deny-list flag, so values are ignored (a warning is logged)."),
+                .describe("Denylist of built-in tools, each emitted as a separate --disabled-tools <tool> flag"),
             correlationId: z.string().optional().describe("Request trace ID (auto if omitted)"),
             optimizePrompt: z.boolean().default(false).describe("Optimize prompt before execution"),
             compressResponse: z

package/dist/provider-admin-tools.js

@@ -122,6 +122,13 @@ export function familyBaseRisk(provider, fam) {
         return contract.risk;
     return fam.safety === "read-only" ? "read_only" : "writes_local_config";
 }
+function contractAdminProjectionCeiling(provider, commandPath) {
+    const exactContract = getCliSubcommandContract(provider, commandPath);
+    return exactContract?.adminProjection === "not_exposed" ? "not_exposed" : null;
+}
+function projectedAdminExposure(provider, commandPath, risk) {
+    return contractAdminProjectionCeiling(provider, commandPath) ?? adminRiskToExposure(risk);
+}
 function rootAdvertises(discovered, family) {
     const wanted = family.toLowerCase();
     return discovered.rootHelp.subcommands.some(s => s.name.toLowerCase() === wanted);
@@ -142,6 +149,7 @@ export function projectProviderAdminOperations(def, discovered) {
         if (adminSurfaceKind(fam) !== "cli-subcommand")
             continue;
         const baseRisk = familyBaseRisk(def.id, fam);
+        const familyExposure = projectedAdminExposure(def.id, [fam.family], baseRisk);
         if (!discovered) {
             ops.push({
                 provider: def.id,
@@ -149,8 +157,8 @@ export function projectProviderAdminOperations(def, discovered) {
                 operationId: fam.family,
                 argv: [fam.family],
                 risk: baseRisk,
-                exposure: adminRiskToExposure(baseRisk),
-                mutating: adminRiskToExposure(baseRisk) === "mcp_requires_approval",
+                exposure: familyExposure,
+                mutating: familyExposure === "mcp_requires_approval",
                 available: false,
                 discoverySource: "no-discovery",
                 summary: fam.evidence,
@@ -165,7 +173,7 @@ export function projectProviderAdminOperations(def, discovered) {
                 if (!isSafeAdminToken(sub.name))
                     continue;
                 const risk = classifyOperationRisk(sub.name, baseRisk, { isSubcommand: true });
-                const exposure = adminRiskToExposure(risk);
+                const exposure = projectedAdminExposure(def.id, [fam.family, sub.name], risk);
                 ops.push({
                     provider: def.id,
                     family: fam.family,
@@ -183,7 +191,7 @@ export function projectProviderAdminOperations(def, discovered) {
         }
         const baseExposure = adminRiskToExposure(baseRisk);
         const risk = baseExposure === "not_exposed" ? baseRisk : classifyOperationRisk(fam.family, baseRisk);
-        const exposure = adminRiskToExposure(risk);
+        const exposure = projectedAdminExposure(def.id, [fam.family], risk);
         ops.push({
             provider: def.id,
             family: fam.family,

package/dist/provider-definitions.js

@@ -5,13 +5,13 @@ export function adminSurfaceKind(family) {
 }
 export const DEVIN_ACP_AGENT_TYPES = ["summarizer", "review"];
 export const PROVIDER_TARGET_VERSIONS = {
-    claude: "claude 2.1.206",
-    codex: "codex-cli 0.144.1",
-    gemini: "agy 1.1.0",
-    grok: "grok 0.2.93 (f00f96316d)",
+    claude: "claude 2.1.207",
+    codex: "codex-cli 0.144.3",
+    gemini: "agy 1.1.1",
+    grok: "grok 0.2.99 (b1b49ccb71)",
     mistral: "vibe 2.19.1",
     devin: "devin 3000.1.27 (0d4bf12e)",
-    cursor: "cursor-agent 2026.07.09-c59fd9a",
+    cursor: "cursor-agent 2026.07.09-a3815c0",
 };
 const PROVIDER_DEFINITIONS = {
     claude: {

package/dist/provider-tool-capabilities.js

@@ -615,7 +615,7 @@ const TOOL_CONTROLS = {
     mistral: {
         providerKind: "cli",
         gatewayRequestTools: ["mistral_request", "mistral_request_async"],
-        summary: "Mistral Vibe owns its runtime tool catalog; the gateway can pass Vibe enabled-tool controls and reports local skills if present.",
+        summary: "Mistral Vibe owns its runtime tool catalog; the gateway can pass Vibe enabled- and disabled-tool controls and reports local skills if present.",
         controls: {
             allowlist: {
                 supported: true,
@@ -624,9 +624,10 @@ const TOOL_CONTROLS = {
                 behavior: "Each entry is emitted as a separate Vibe enabled-tool flag.",
             },
             denylist: {
-                supported: false,
+                supported: true,
                 requestField: "disallowedTools",
-                behavior: "Accepted for caller parity but ignored because Vibe has no deny-list flag.",
+                cliFlag: "--disabled-tools",
+                behavior: "Each entry is emitted as a separate Vibe disabled-tool flag.",
             },
             mcpServers: {
                 supported: false,
@@ -675,15 +676,11 @@ const TOOL_CONTROLS = {
             approvalAndSandboxControls: true,
             costAndLoopControls: true,
             workspaceAndWorktreeControls: true,
+            toolAllowDenyControls: true,
             enabledToolAllowlist: true,
             trustControl: true,
         }),
         unsupportedInputs: [
-            {
-                input: "disallowedTools",
-                behavior: "ignored",
-                details: "Accepted for caller parity but ignored because Vibe has no deny-list flag.",
-            },
             {
                 input: "mcpServers",
                 behavior: "approval_tracking_only",
@@ -798,7 +795,7 @@ const TOOL_CONTROLS = {
                 supported: true,
                 requestField: "permissionMode",
                 cliFlag: "--permission-mode",
-                behavior: "Maps to Devin CLI --permission-mode: auto auto-approves read-only tools; smart additionally auto-runs actions a fast model judges safe; dangerous auto-approves all.",
+                behavior: "Maps to Devin CLI --permission-mode: auto auto-approves read-only tools; accept-edits also auto-approves workspace edits; smart additionally auto-runs actions a fast model judges safe; dangerous auto-approves all.",
             },
             promptControl: {
                 supported: true,

package/dist/request-helpers.d.ts

@@ -52,10 +52,9 @@ export interface PrepareMistralRequestInput {
 export interface PrepareMistralRequestResult {
     args: string[];
     env: Record<string, string>;
-    ignoredDisallowedTools: boolean;
 }
 export declare function prepareMistralRequest(input: PrepareMistralRequestInput): PrepareMistralRequestResult;
-export declare const CLAUDE_PERMISSION_MODES: readonly ["default", "acceptEdits", "plan", "auto", "dontAsk", "bypassPermissions"];
+export declare const CLAUDE_PERMISSION_MODES: readonly ["default", "acceptEdits", "auto", "bypassPermissions", "manual", "dontAsk", "plan"];
 export type ClaudePermissionMode = (typeof CLAUDE_PERMISSION_MODES)[number];
 export interface ClaudePermissionFlagsInput {
     permissionMode?: ClaudePermissionMode;

package/dist/request-helpers.js

@@ -3,6 +3,7 @@ import { tmpdir } from "os";
 import { join, isAbsolute } from "path";
 import { randomUUID } from "crypto";
 import { z } from "zod/v3";
+import { CLAUDE_WIRE_PERMISSION_MODES } from "./upstream-contracts.js";
 export const GATEWAY_SESSION_PREFIX = "gw-";
 export function validateSessionId(sessionId) {
     if (sessionId.startsWith(GATEWAY_SESSION_PREFIX)) {
@@ -117,6 +118,12 @@ export function prepareMistralRequest(input) {
             args.push("--enabled-tools", tool);
         }
     }
+    if (input.disallowedTools && input.disallowedTools.length > 0) {
+        sanitizeCliArgValues(input.disallowedTools, "disallowedTools");
+        for (const tool of input.disallowedTools) {
+            args.push("--disabled-tools", tool);
+        }
+    }
     if (input.trust) {
         args.push("--trust");
     }
@@ -137,8 +144,7 @@ export function prepareMistralRequest(input) {
             args.push("--add-dir", dir);
         }
     }
-    const ignoredDisallowedTools = Boolean(input.disallowedTools && input.disallowedTools.length > 0);
-    return { args, env, ignoredDisallowedTools };
+    return { args, env };
 }
 function normalizeMistralOutputFormat(format) {
     if (format === "plain")
@@ -147,14 +153,7 @@ function normalizeMistralOutputFormat(format) {
         return "streaming";
     return format;
 }
-export const CLAUDE_PERMISSION_MODES = [
-    "default",
-    "acceptEdits",
-    "plan",
-    "auto",
-    "dontAsk",
-    "bypassPermissions",
-];
+export const CLAUDE_PERMISSION_MODES = ["default", ...CLAUDE_WIRE_PERMISSION_MODES];
 export function resolveClaudePermissionFlags(input) {
     const { permissionMode, dangerouslySkipPermissions } = input;
     let warning;

package/dist/upstream-contracts.d.ts

@@ -1,5 +1,6 @@
 import { type CliType } from "./provider-definitions.js";
 export type CliFlagArity = "none" | "one" | "optional" | "variadic";
+export type CliPositionalLimit = number | "variadic";
 export interface CliFlagContract {
     arity: CliFlagArity;
     values?: readonly string[];
@@ -52,12 +53,13 @@ export interface CliSubcommandContract {
     commandPath: readonly string[];
     helpArgs: readonly string[][];
     flags: Record<string, CliFlagContract>;
-    maxPositionals: number;
+    maxPositionals: CliPositionalLimit;
     acknowledgedUpstreamFlags?: readonly string[];
     aliases?: readonly string[];
     children?: Record<string, CliSubcommandContract>;
     risk: CliSubcommandRisk;
     exposure: CliSubcommandExposure;
+    adminProjection?: "not_exposed";
     tier: CliSubcommandTier;
     tokenCost: CliSubcommandTokenCost;
     summary: string;
@@ -122,6 +124,7 @@ export interface AcpEntrypointContract {
     docsRef: string;
 }
 export declare const ACP_ENTRYPOINT_CONTRACTS: Record<CliType, AcpEntrypointContract>;
+export declare const CLAUDE_WIRE_PERMISSION_MODES: readonly ["acceptEdits", "auto", "bypassPermissions", "manual", "dontAsk", "plan"];
 export declare const UPSTREAM_CLI_CONTRACTS: Record<CliType, CliContract>;
 export declare function validateUpstreamCliArgs(cli: CliType, args: readonly string[]): ContractValidationResult;
 export declare function assertUpstreamCliArgs(cli: CliType, args: readonly string[]): void;

package/dist/upstream-contracts.js

@@ -67,7 +67,7 @@ export const ACP_ENTRYPOINT_CONTRACTS = {
         executable: "devin",
         entrypointArgs: ["acp"],
         targetVersion: PROVIDER_TARGET_VERSIONS.devin,
-        probeArgs: [["--version"]],
+        probeArgs: [["acp", "--help"]],
         evidence: 'Native ACP entrypoint `devin acp` (stdio JSON-RPC). Slice D1 manual initialize + session/new smoke passed (protocolVersion 1, agent "Affogato", session created). Third native runtime pilot; routing stays config-gated.',
         docsRef: "docs/plans/first-class-acp-gateway-extension.dag.toml#provider_matrix.devin",
     },
@@ -83,13 +83,21 @@ export const ACP_ENTRYPOINT_CONTRACTS = {
         docsRef: "docs/plans/first-class-acp-gateway-extension.dag.toml#provider_matrix.cursor",
     },
 };
-const PERMISSION_MODES = [
-    "default",
+export const CLAUDE_WIRE_PERMISSION_MODES = [
     "acceptEdits",
+    "auto",
+    "bypassPermissions",
+    "manual",
+    "dontAsk",
     "plan",
+];
+const GROK_PERMISSION_MODES = [
+    "default",
+    "acceptEdits",
     "auto",
     "dontAsk",
     "bypassPermissions",
+    "plan",
 ];
 const EFFORT_LEVELS = ["low", "medium", "high", "xhigh", "max"];
 function scFlag(name, arity = "optional") {
@@ -114,6 +122,7 @@ function subcommand(commandPath, summary, risk, flags = [], options = {}) {
         children: options.children ?? {},
         risk,
         exposure: options.exposure ?? "tracked_only",
+        ...(options.adminProjection ? { adminProjection: options.adminProjection } : {}),
         tier: options.tier ?? "catalog",
         tokenCost: options.tokenCost ?? "small",
         summary,
@@ -150,6 +159,10 @@ export const UPSTREAM_CLI_CONTRACTS = {
             doctor: subcommand(["doctor"], "Run Claude Code diagnostic checks.", "read_only", [], {
                 tier: "diagnostic",
             }),
+            gateway: subcommand(["gateway"], "Run Claude enterprise auth and telemetry gateway mode.", "starts_server", ["--config"], {
+                exposure: "not_exposed",
+                flagArities: { "--config": "one" },
+            }),
             mcp: subcommand(["mcp"], "Manage Claude MCP server configuration.", "writes_local_config"),
             plugin: subcommand(["plugin"], "Manage Claude plugins.", "writes_local_config", [], {
                 aliases: ["plugins"],
@@ -244,7 +257,7 @@ export const UPSTREAM_CLI_CONTRACTS = {
             },
             "--output-format": {
                 arity: "one",
-                values: ["json", "stream-json"],
+                values: ["text", "json", "stream-json"],
                 description: "Machine-readable output format",
             },
             "--include-partial-messages": {
@@ -259,7 +272,7 @@ export const UPSTREAM_CLI_CONTRACTS = {
             "--disallowed-tools": { arity: "variadic", description: "Disallowed tool names/patterns" },
             "--permission-mode": {
                 arity: "one",
-                values: PERMISSION_MODES,
+                values: CLAUDE_WIRE_PERMISSION_MODES,
                 description: "Claude permission mode",
             },
             "--mcp-config": { arity: "one", description: "MCP config path" },
@@ -392,6 +405,18 @@ export const UPSTREAM_CLI_CONTRACTS = {
                 args: ["-p", "hello"],
                 expect: "pass",
             },
+            {
+                id: "claude-permission-mode-manual",
+                description: "Claude 2.1.207 accepts the manual permission mode literal",
+                args: ["-p", "hello", "--permission-mode", "manual"],
+                expect: "pass",
+            },
+            {
+                id: "claude-permission-mode-default-gateway-only",
+                description: "Gateway default is represented by omitting the upstream flag",
+                args: ["-p", "hello", "--permission-mode", "default"],
+                expect: "fail",
+            },
             {
                 id: "claude-unsupported-flag",
                 description: "Unsupported flag is rejected before spawn",
@@ -404,6 +429,12 @@ export const UPSTREAM_CLI_CONTRACTS = {
                 args: ["-p", "hello", "--fallback-model", "claude-haiku-4-5-20251001"],
                 expect: "pass",
             },
+            {
+                id: "claude-output-format-text",
+                description: "Claude 2.1.207 accepts explicit text output format",
+                args: ["-p", "hello", "--output-format", "text"],
+                expect: "pass",
+            },
             {
                 id: "claude-json-schema",
                 description: "Phase 4 slice η: --json-schema accepts inline JSON literal",
@@ -508,8 +539,8 @@ export const UPSTREAM_CLI_CONTRACTS = {
         upstream: "OpenAI Codex CLI",
         upstreamMetadata: {
             sourceUrls: [
-                "https://github.com/openai/codex/releases",
-                "https://developers.openai.com/codex/changelog",
+                "https://api.github.com/repos/openai/codex/releases/latest",
+                "https://learn.chatgpt.com/docs/changelog/rss.xml",
             ],
             packageName: "@openai/codex",
             repo: "https://github.com/openai/codex",
@@ -668,6 +699,76 @@ export const UPSTREAM_CLI_CONTRACTS = {
             ], { exposure: "not_exposed" }),
             debug: subcommand(["debug"], "Run Codex debugging utilities.", "read_only", ["--config", "--disable", "--enable"], { tier: "diagnostic" }),
             apply: subcommand(["apply"], "Apply a Codex patch to the workspace.", "destructive", ["--config", "--disable", "--enable"], { exposure: "not_exposed" }),
+            resume: subcommand(["resume"], "Resume a saved interactive Codex session.", "executes_agent", [
+                "--add-dir",
+                "--all",
+                "--ask-for-approval",
+                "--cd",
+                "--config",
+                "--dangerously-bypass-approvals-and-sandbox",
+                "--dangerously-bypass-hook-trust",
+                "--disable",
+                "--enable",
+                "--image",
+                "--include-non-interactive",
+                "--last",
+                "--local-provider",
+                "--model",
+                "--no-alt-screen",
+                "--oss",
+                "--profile",
+                "--remote",
+                "--remote-auth-token-env",
+                "--sandbox",
+                "--search",
+                "--strict-config",
+                "--version",
+            ], {
+                exposure: "not_exposed",
+                maxPositionals: 2,
+                flagArities: {
+                    "--all": "none",
+                    "--dangerously-bypass-approvals-and-sandbox": "none",
+                    "--dangerously-bypass-hook-trust": "none",
+                    "--include-non-interactive": "none",
+                    "--last": "none",
+                    "--no-alt-screen": "none",
+                    "--oss": "none",
+                    "--search": "none",
+                    "--strict-config": "none",
+                    "--version": "none",
+                },
+            }),
+            delete: subcommand(["delete"], "Permanently delete a saved Codex session.", "destructive", [
+                "--add-dir",
+                "--cd",
+                "--config",
+                "--dangerously-bypass-approvals-and-sandbox",
+                "--dangerously-bypass-hook-trust",
+                "--disable",
+                "--enable",
+                "--force",
+                "--image",
+                "--local-provider",
+                "--model",
+                "--oss",
+                "--profile",
+                "--remote",
+                "--remote-auth-token-env",
+                "--sandbox",
+                "--strict-config",
+            ], {
+                exposure: "not_exposed",
+                adminProjection: "not_exposed",
+                maxPositionals: 1,
+                flagArities: {
+                    "--dangerously-bypass-approvals-and-sandbox": "none",
+                    "--dangerously-bypass-hook-trust": "none",
+                    "--force": "none",
+                    "--oss": "none",
+                    "--strict-config": "none",
+                },
+            }),
             archive: subcommand(["archive"], "Archive Codex session state.", "writes_local_config", [
                 "--add-dir",
                 "--cd",
@@ -960,7 +1061,7 @@ export const UPSTREAM_CLI_CONTRACTS = {
         upstreamMetadata: {
             sourceUrls: [
                 "https://antigravity.google/docs/cli-overview",
-                "https://github.com/google-antigravity/antigravity-cli/releases",
+                "https://api.github.com/repos/google-antigravity/antigravity-cli/releases/latest",
             ],
             repo: "https://github.com/google-antigravity/antigravity-cli",
             installDocsUrl: "https://antigravity.google/docs/cli-getting-started",
@@ -969,6 +1070,11 @@ export const UPSTREAM_CLI_CONTRACTS = {
         },
         helpArgs: [["--help"]],
         subcommands: {
+            agent: subcommand(["agent"], "List available Antigravity agents.", "read_only", [], {
+                aliases: ["agents"],
+                tier: "inspect",
+                tokenCost: "tiny",
+            }),
             changelog: subcommand(["changelog"], "Show Antigravity CLI changelog and release notes.", "read_only", [], { tokenCost: "small" }),
             install: subcommand(["install"], "Configure Antigravity CLI environment paths and shell settings.", "writes_local_config", ["--dir", "--skip-aliases", "--skip-path"], {
                 flagArities: { "--dir": "one", "--skip-aliases": "none", "--skip-path": "none" },
@@ -1033,7 +1139,7 @@ export const UPSTREAM_CLI_CONTRACTS = {
                 description: "Print-mode wait timeout as a Go duration string (e.g. 5m0s)",
             },
         },
-        acknowledgedUpstreamFlags: ["--log-file", "--mode", "--prompt-interactive"],
+        acknowledgedUpstreamFlags: ["--agent", "--log-file", "--mode", "--prompt-interactive"],
         env: {},
         conformanceFixtures: [
             {
@@ -1048,6 +1154,12 @@ export const UPSTREAM_CLI_CONTRACTS = {
                 args: ["--print", "hello", "--not-a-gemini-flag"],
                 expect: "fail",
             },
+            {
+                id: "gemini-agent-selection-acknowledged-not-emitted",
+                description: "Antigravity 1.1.1 advertises --agent, but gateway request argv stays closed until its security model is explicitly wired",
+                args: ["--print", "hello", "--agent", "reviewer"],
+                expect: "fail",
+            },
             {
                 id: "gemini-antigravity-workspace-flags",
                 description: "Antigravity workspace and sandbox flags are accepted",
@@ -1181,49 +1293,9 @@ export const UPSTREAM_CLI_CONTRACTS = {
             sessions: subcommand(["sessions"], "Inspect Grok sessions.", "read_only", ["--leader-socket"], {
                 tier: "inspect",
             }),
-            setup: subcommand(["setup"], "Configure Grok CLI local setup.", "writes_local_config", ["--leader-socket"], { exposure: "not_exposed" }),
-            ssh: subcommand(["ssh"], "Manage Grok SSH integration.", "network", ["--leader-socket"], {
-                acknowledgedUpstreamFlags: [
-                    "--agent",
-                    "--agents",
-                    "--allow",
-                    "--always-approve",
-                    "--best-of-n",
-                    "--check",
-                    "--continue",
-                    "--cwd",
-                    "--deny",
-                    "--disable-web-search",
-                    "--disallowed-tools",
-                    "--experimental-memory",
-                    "--fork-session",
-                    "--json-schema",
-                    "--max-turns",
-                    "--minimal",
-                    "--model",
-                    "--no-alt-screen",
-                    "--no-memory",
-                    "--no-plan",
-                    "--no-subagents",
-                    "--oauth",
-                    "--output-format",
-                    "--permission-mode",
-                    "--prompt-file",
-                    "--prompt-json",
-                    "--reasoning-effort",
-                    "--restore-code",
-                    "--resume",
-                    "--rules",
-                    "--sandbox",
-                    "--session-id",
-                    "--single",
-                    "--system-prompt-override",
-                    "--tools",
-                    "--verbatim",
-                    "--version",
-                    "--worktree",
-                    "--worktree-ref",
-                ],
+            setup: subcommand(["setup"], "Configure Grok CLI local setup.", "writes_local_config", ["--json", "--leader-socket"], {
+                exposure: "not_exposed",
+                flagArities: { "--json": "none", "--leader-socket": "one" },
             }),
             trace: subcommand(["trace"], "Inspect Grok trace data.", "read_only", ["--json", "--leader-socket", "--local", "--output"], { tier: "diagnostic" }),
             update: subcommand(["update"], "Update the Grok CLI binary.", "updates_binary", [
@@ -1237,9 +1309,20 @@ export const UPSTREAM_CLI_CONTRACTS = {
             ], { exposure: "not_exposed" }),
             version: subcommand(["version"], "Print Grok version information.", "read_only", ["--json", "--leader-socket"], { tier: "diagnostic" }),
             worktree: subcommand(["worktree"], "Manage Grok worktree sessions.", "writes_local_config", ["--leader-socket"]),
+            wrap: subcommand(["wrap"], "Run an arbitrary command inside a local clipboard-forwarding PTY.", "destructive", ["--leader-socket"], {
+                exposure: "not_exposed",
+                tier: "execute_candidate",
+                maxPositionals: "variadic",
+                flagArities: { "--leader-socket": "one" },
+            }),
         }, GROK_DEBUG_HELP_FLAGS),
         maxPositionals: 0,
-        acknowledgedUpstreamFlags: [...GROK_DEBUG_HELP_FLAGS, "--minimal", "--session-id"],
+        acknowledgedUpstreamFlags: [
+            ...GROK_DEBUG_HELP_FLAGS,
+            "--fullscreen",
+            "--minimal",
+            "--session-id",
+        ],
         mcpTools: ["grok_request", "grok_request_async"],
         mcpParameters: [
             "prompt",
@@ -1299,7 +1382,7 @@ export const UPSTREAM_CLI_CONTRACTS = {
             "--always-approve": { arity: "none", description: "Approve tool use automatically" },
             "--permission-mode": {
                 arity: "one",
-                values: PERMISSION_MODES,
+                values: GROK_PERMISSION_MODES,
                 description: "Permission mode",
             },
             "--effort": { arity: "one", values: EFFORT_LEVELS, description: "Reasoning effort" },
@@ -1648,6 +1731,7 @@ export const UPSTREAM_CLI_CONTRACTS = {
                 description: "Agent/permission mode (builtin, install-gated, or custom agent name)",
             },
             "--enabled-tools": { arity: "one", description: "Enabled tool" },
+            "--disabled-tools": { arity: "one", description: "Disabled tool" },
             "--resume": {
                 arity: "optional",
                 description: "Resume session by ID, or interactive picker when omitted",
@@ -1681,13 +1765,7 @@ export const UPSTREAM_CLI_CONTRACTS = {
                 description: "Additional writable workspace directory (Phase 4 slice ζ; repeat once per directory)",
             },
         },
-        acknowledgedUpstreamFlags: [
-            "--auto-approve",
-            "--check-upgrade",
-            "--disabled-tools",
-            "--worktree",
-            "--yolo",
-        ],
+        acknowledgedUpstreamFlags: ["--auto-approve", "--check-upgrade", "--worktree", "--yolo"],
         env: {
             VIBE_ACTIVE_MODEL: {
                 arity: "one",
@@ -1813,11 +1891,11 @@ export const UPSTREAM_CLI_CONTRACTS = {
                 expect: "fail",
             },
             {
-                id: "mistral-disabled-tools-rejected",
-                description: "Vibe 2.19.1 adds --disabled-tools (denylist counterpart to --enabled-tools); the gateway does not emit it (disallowedTools is accepted but ignored) and rejects raw --disabled-tools as caller argv",
+                id: "mistral-disabled-tools",
+                description: "Vibe 2.19.1 --disabled-tools denylist is accepted once per tool",
                 args: ["-p", "hello", "--disabled-tools", "shell"],
                 env: { VIBE_ACTIVE_MODEL: "mistral-medium-3.5" },
-                expect: "fail",
+                expect: "pass",
             },
             {
                 id: "mistral-resume-bare",
@@ -1833,14 +1911,63 @@ export const UPSTREAM_CLI_CONTRACTS = {
         executable: "devin",
         upstream: "Cognition Devin CLI",
         upstreamMetadata: {
-            sourceUrls: ["https://cli.devin.ai/docs/reference/commands", "https://docs.devin.ai/cli"],
+            sourceUrls: [
+                "https://cli.devin.ai/docs/reference/commands",
+                "https://docs.devin.ai/cli",
+                "https://docs.devin.ai/cli/changelog/stable",
+            ],
             packageName: "devin",
             installDocsUrl: "https://docs.devin.ai/cli",
             releaseChannel: "vendor",
             watchCategories: ["flags", "subcommands", "permission-modes", "acp-entrypoint"],
         },
         helpArgs: [["--help"]],
-        subcommands: {},
+        subcommands: {
+            acp: subcommand(["acp"], "Run the Devin Agent Client Protocol server over stdio.", "starts_server", ["--agent-type"], {
+                exposure: "not_exposed",
+                flagArities: { "--agent-type": "one" },
+            }),
+            auth: subcommand(["auth"], "Manage Devin authentication state.", "auth", [], {
+                exposure: "not_exposed",
+                maxPositionals: "variadic",
+            }),
+            cloud: subcommand(["cloud"], "Manage Devin Cloud environments, sandboxes, and builds.", "network", [], { exposure: "not_exposed", maxPositionals: "variadic" }),
+            list: subcommand(["list"], "List Devin sessions in the current directory.", "read_only", ["--format"], {
+                aliases: ["ls"],
+                tier: "inspect",
+                flagArities: { "--format": "one" },
+            }),
+            mcp: subcommand(["mcp"], "Manage Devin MCP server connections.", "writes_local_config", [], {
+                exposure: "not_exposed",
+                maxPositionals: "variadic",
+            }),
+            plugins: subcommand(["plugins"], "Manage Devin plugins.", "writes_local_config", [], {
+                exposure: "not_exposed",
+                maxPositionals: "variadic",
+            }),
+            rules: subcommand(["rules"], "Manage Devin always-on agent rules.", "writes_local_config", [], { exposure: "not_exposed", maxPositionals: "variadic" }),
+            sandbox: subcommand(["sandbox"], "Manage Devin process sandboxing.", "writes_local_config", [], { exposure: "not_exposed", maxPositionals: "variadic" }),
+            setup: subcommand(["setup"], "Run Devin interactive setup.", "writes_local_config", ["--force-manual-token-flow"], {
+                exposure: "not_exposed",
+                flagArities: { "--force-manual-token-flow": "none" },
+            }),
+            shell: subcommand(["shell"], "Integrate Devin with the local shell.", "writes_local_config", [], { exposure: "not_exposed", maxPositionals: "variadic" }),
+            skills: subcommand(["skills"], "Manage Devin skills.", "writes_local_config", [], {
+                exposure: "not_exposed",
+                maxPositionals: "variadic",
+            }),
+            uninstall: subcommand(["uninstall"], "Uninstall Devin and remove local data.", "destructive", ["--clean", "--force"], {
+                exposure: "not_exposed",
+                flagArities: { "--clean": "none", "--force": "none" },
+            }),
+            update: subcommand(["update"], "Check for or install Devin CLI updates.", "updates_binary", ["--force"], {
+                exposure: "not_exposed",
+                flagArities: { "--force": "none" },
+            }),
+            version: subcommand(["version"], "Print Devin version information.", "read_only", [], {
+                tier: "diagnostic",
+            }),
+        },
         maxPositionals: 0,
         mcpTools: ["devin_request", "devin_request_async"],
         mcpParameters: [
@@ -1865,8 +1992,8 @@ export const UPSTREAM_CLI_CONTRACTS = {
             "--model": { arity: "one", description: "AI model for this session" },
             "--permission-mode": {
                 arity: "one",
-                values: ["auto", "smart", "dangerous"],
-                description: "Permission mode (auto = read-only auto-approve; smart = additionally auto-runs safe actions per fast model; dangerous = approve all)",
+                values: ["auto", "accept-edits", "smart", "dangerous"],
+                description: "Permission mode (auto = read-only auto-approve; accept-edits = also auto-approve workspace edits; smart = additionally auto-runs safe actions per fast model; dangerous = approve all)",
             },
             "--prompt-file": { arity: "one", description: "Load the initial prompt from a file" },
             "--config": { arity: "one", description: "Config file path" },
@@ -1917,6 +2044,12 @@ export const UPSTREAM_CLI_CONTRACTS = {
                 args: ["-p", "hello", "--permission-mode", "auto"],
                 expect: "pass",
             },
+            {
+                id: "devin-permission-mode-accept-edits",
+                description: "Valid --permission-mode 'accept-edits' accepted",
+                args: ["-p", "hello", "--permission-mode", "accept-edits"],
+                expect: "pass",
+            },
             {
                 id: "devin-permission-mode-smart",
                 description: "Valid --permission-mode 'smart' accepted",
@@ -2007,7 +2140,57 @@ export const UPSTREAM_CLI_CONTRACTS = {
             ],
         },
         helpArgs: [["--help"]],
-        subcommands: {},
+        subcommands: {
+            about: subcommand(["about"], "Display Cursor Agent version, system, and account information.", "read_only", ["--format"], { tier: "diagnostic", flagArities: { "--format": "one" } }),
+            agent: subcommand(["agent"], "Start an interactive Cursor Agent session.", "executes_agent", [], { exposure: "not_exposed", maxPositionals: "variadic" }),
+            "create-chat": subcommand(["create-chat"], "Create a new Cursor chat and return its ID.", "network", [], { exposure: "not_exposed" }),
+            "generate-rule": subcommand(["generate-rule"], "Generate a Cursor rule through interactive prompts.", "writes_local_config", [], { aliases: ["rule"], exposure: "not_exposed", maxPositionals: "variadic" }),
+            "install-shell-integration": subcommand(["install-shell-integration"], "Install Cursor shell integration.", "writes_local_config", [], { exposure: "not_exposed" }),
+            login: subcommand(["login"], "Authenticate with Cursor.", "auth", [], {
+                exposure: "not_exposed",
+            }),
+            logout: subcommand(["logout"], "Clear Cursor authentication state.", "auth", [], {
+                exposure: "not_exposed",
+            }),
+            ls: subcommand(["ls"], "Resume a Cursor chat session.", "executes_agent", [], {
+                exposure: "not_exposed",
+                maxPositionals: "variadic",
+            }),
+            mcp: subcommand(["mcp"], "Manage Cursor MCP server configuration.", "writes_local_config", [], { exposure: "not_exposed", maxPositionals: "variadic" }),
+            models: subcommand(["models"], "List Cursor account models.", "read_only", [], {
+                tier: "inspect",
+            }),
+            resume: subcommand(["resume"], "Resume the latest Cursor chat.", "executes_agent", [], {
+                exposure: "not_exposed",
+                maxPositionals: "variadic",
+            }),
+            status: subcommand(["status"], "View Cursor authentication status.", "read_only", ["--format"], {
+                aliases: ["whoami"],
+                tier: "inspect",
+                flagArities: { "--format": "one" },
+            }),
+            "uninstall-shell-integration": subcommand(["uninstall-shell-integration"], "Remove Cursor shell integration.", "writes_local_config", [], { exposure: "not_exposed" }),
+            update: subcommand(["update"], "Update Cursor Agent.", "updates_binary", [], {
+                exposure: "not_exposed",
+            }),
+            worker: subcommand(["worker"], "Start a private Cursor cloud worker for local agent runs.", "starts_server", [
+                "--auth-token-file",
+                "--data-dir",
+                "--debug",
+                "--idle-release-timeout",
+                "--label",
+                "--labels-file",
+                "--management-addr",
+                "--name",
+                "--pool",
+                "--pool-name",
+                "--single-use",
+                "--worker-dir",
+            ], {
+                exposure: "not_exposed",
+                flagArities: { "--debug": "none", "--single-use": "none" },
+            }),
+        },
         maxPositionals: 1,
         mcpTools: ["cursor_request", "cursor_request_async"],
         mcpParameters: [
@@ -2297,6 +2480,7 @@ export function serializeCliSubcommandContract(cli, contract) {
         })),
         risk: contract.risk,
         exposure: contract.exposure,
+        adminProjection: contract.adminProjection ?? null,
         tier: contract.tier,
         tokenCost: contract.tokenCost,
         summary: contract.summary,
@@ -2441,7 +2625,7 @@ export function validateUpstreamCliSubcommandArgs(cli, commandPath, args) {
             });
         }
     }
-    if (positionals.length > contract.maxPositionals) {
+    if (contract.maxPositionals !== "variadic" && positionals.length > contract.maxPositionals) {
         violations.push({
             cli,
             message: `${cli} subcommand "${subcommandKey(commandPath)}" has ${positionals.length} positional values; upstream subcommand contract allows ${contract.maxPositionals}`,

package/npm-shrinkwrap.json

@@ -1,12 +1,12 @@
 {
   "name": "llm-cli-gateway",
-  "version": "2.17.0",
+  "version": "2.17.1",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "llm-cli-gateway",
-      "version": "2.17.0",
+      "version": "2.17.1",
       "license": "MIT",
       "dependencies": {
         "@modelcontextprotocol/sdk": "^1.29.0",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "llm-cli-gateway",
-  "version": "2.17.0",
+  "version": "2.17.1",
   "mcpName": "io.github.verivus-oss/llm-cli-gateway",
   "description": "Secure local control plane for AI coding agents across supported MCP clients, with workspace-scoped remote access, approval gates, durable jobs, sessions, and audit receipts.",
   "license": "MIT",
@@ -151,5 +151,9 @@
   "directories": {
     "doc": "docs"
   },
-  "types": "./dist/index.d.ts"
+  "types": "./dist/index.d.ts",
+  "allowScripts": {
+    "better-sqlite3@12.11.1": true,
+    "fsevents": false
+  }
 }