@dsh-enhanced/coding-subscription-provider 0.1.4 → 0.1.5

package/lib/process.js

@@ -1,4 +1,7 @@
 import { spawn as nodeSpawn } from 'node:child_process';
+import { chmod, mkdtemp, open, rmdir, unlink } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
 /** A stable, credential-free protocol failure that the adapter can map. */
 export class CliProtocolError extends Error {
     provider;
@@ -60,6 +63,18 @@ export class CliTeardownTimeoutError extends Error {
         this.name = 'CliTeardownTimeoutError';
     }
 }
+/** Prompt transport failed without embedding any request content in the error. */
+export class CliPromptInputError extends Error {
+    provider;
+    reason;
+    code = 'CLI_PROMPT_INPUT_ERROR';
+    constructor(provider, reason) {
+        super(promptInputErrorMessage(provider, reason), { cause: 'prompt-input' });
+        this.provider = provider;
+        this.reason = reason;
+        this.name = 'CliPromptInputError';
+    }
+}
 const defaults = {
     timeoutMs: 10 * 60_000,
     killGraceMs: 3_000,
@@ -97,6 +112,66 @@ export function buildSubscriptionEnv(extraEnvNames = []) {
     }
     return env;
 }
+async function preparePromptTransport(invocation) {
+    if (invocation.promptTransport === 'stdin') {
+        return { args: invocation.args, cleanup: async () => { } };
+    }
+    let directory;
+    let promptPath;
+    try {
+        directory = await mkdtemp(join(tmpdir(), 'dsh-coding-prompt-'));
+        // mkdtemp is private on supported platforms; chmod makes the contract explicit
+        // for unusual umasks and for cross-platform transport tests running on POSIX.
+        await chmod(directory, 0o700);
+        promptPath = join(directory, 'prompt.txt');
+        const handle = await open(promptPath, 'wx', 0o600);
+        try {
+            await handle.writeFile(invocation.prompt, { encoding: 'utf8' });
+        }
+        finally {
+            await handle.close();
+        }
+    }
+    catch {
+        if (promptPath !== undefined)
+            await unlink(promptPath).catch(() => { });
+        if (directory !== undefined)
+            await rmdir(directory).catch(() => { });
+        throw new CliPromptInputError(invocation.provider, 'FILE_PREPARE_FAILED');
+    }
+    let fileCleaned = false;
+    let directoryCleaned = false;
+    const cleanup = async () => {
+        if (!fileCleaned) {
+            try {
+                await unlink(promptPath);
+                fileCleaned = true;
+            }
+            catch (error) {
+                if (isNotFoundError(error))
+                    fileCleaned = true;
+                else
+                    throw new CliPromptInputError(invocation.provider, 'FILE_CLEANUP_FAILED');
+            }
+        }
+        if (!directoryCleaned) {
+            try {
+                await rmdir(directory);
+                directoryCleaned = true;
+            }
+            catch (error) {
+                if (isNotFoundError(error))
+                    directoryCleaned = true;
+                else
+                    throw new CliPromptInputError(invocation.provider, 'FILE_CLEANUP_FAILED');
+            }
+        }
+    };
+    return {
+        args: ['--prompt-file', promptPath, ...invocation.args],
+        cleanup,
+    };
+}
 /**
  * Starts one local, already-authenticated coding CLI and yields only assistant text.
  * It never reads credential files or accepts credential values in config. An explicitly
@@ -105,7 +180,7 @@ export function buildSubscriptionEnv(extraEnvNames = []) {
  */
 export async function* runCliText(invocation, options = {}) {
     const limits = { ...defaults, ...options };
-    // Pre-spawn failures never handed the prompt argv to the OS: report not-submitted and stop.
+    // Pre-spawn failures never handed prompt input to the child: report not-submitted and stop.
     const reportPreSpawn = () => {
         if (options.onSettled === undefined)
             return;
@@ -120,19 +195,47 @@ export async function* runCliText(invocation, options = {}) {
         reportPreSpawn();
         throw abortError('aborted before CLI spawn');
     }
+    let prepared;
+    try {
+        prepared = await preparePromptTransport(invocation);
+    }
+    catch (error) {
+        reportPreSpawn();
+        throw error;
+    }
+    // Creating a private Grok prompt file is asynchronous. Close the abort race
+    // before spawning and remove the file before returning control to the caller.
+    if (options.signal?.aborted) {
+        let cleanupError;
+        try {
+            await prepared.cleanup();
+        }
+        catch (error) {
+            cleanupError = error;
+        }
+        reportPreSpawn();
+        throw cleanupError ?? abortError('aborted before CLI spawn');
+    }
     let child;
     try {
-        child = (options.spawn ?? defaultSpawn)(invocation.command, invocation.args, {
+        child = (options.spawn ?? defaultSpawn)(invocation.command, prepared.args, {
             cwd: invocation.cwd,
             shell: false,
             detached: process.platform !== 'win32',
-            stdio: ['ignore', 'pipe', 'pipe'],
+            stdio: ['pipe', 'pipe', 'pipe'],
             env: buildSubscriptionEnv(options.extraEnvNames),
         });
     }
     catch (error) {
+        let cleanupError;
+        try {
+            await prepared.cleanup();
+        }
+        catch (cleanupFailure) {
+            cleanupError = cleanupFailure;
+        }
         reportPreSpawn();
-        throw error;
+        throw cleanupError ?? error;
     }
     const queue = new TextQueue();
     let totalOutputBytes = 0;
@@ -143,7 +246,6 @@ export async function* runCliText(invocation, options = {}) {
     let sawIncrementalText = false;
     let sawAggregateText = false;
     let sawValidJson = false;
-    let sawRecognizedEvent = false;
     let sawAssistantText = false;
     let sawSuccessTerminal = false;
     let terminalReason;
@@ -154,11 +256,18 @@ export async function* runCliText(invocation, options = {}) {
     let postKillTimer;
     let resolveClosed;
     const closed = new Promise(resolve => { resolveClosed = resolve; });
+    let disposeStdin = () => { };
     let disposeStdout = () => { };
     let disposeStderr = () => { };
-    // spawn() returned after receiving prompt argv, but only a later spawn/error event
-    // can prove whether the OS accepted or rejected it.
-    let promptSubmissionState = 'unknown';
+    // Prompt input is not submitted until either the whole stdin stream flushes or
+    // the OS accepts Grok's private prompt-file path. Partial stdin writes are unknown.
+    // A temporary-file path already entered spawn argv when spawn() returned, so
+    // its state is unknown until a spawn/error event. stdin carries no prompt argv
+    // and remains provably not-submitted until the first write attempt.
+    let promptSubmissionState = invocation.promptTransport === 'secure-temporary-file'
+        ? 'unknown'
+        : 'not-submitted';
+    let promptInputStarted = false;
     let sawSpawn = false;
     let phase = 'spawn';
     // Teardown begins the moment `stop` fires and completes when ChildProcess `close` is settled.
@@ -217,6 +326,7 @@ export async function* runCliText(invocation, options = {}) {
         if (teardownState === 'not-started')
             teardownState = 'in-progress';
         stopAt ??= performance.now();
+        destroyWritable(child.stdin);
         terminateProcessTree(child, 'SIGINT');
         // An injected/embedded ChildProcess may emit close synchronously from kill().
         // Do not arm escalation after that close already settled the request.
@@ -246,6 +356,7 @@ export async function* runCliText(invocation, options = {}) {
         child.removeListener?.('spawn', onSpawn);
         child.removeListener?.('error', onError);
         child.removeListener?.('close', onClose);
+        disposeStdin();
         disposeStdout();
         disposeStderr();
     };
@@ -253,8 +364,12 @@ export async function* runCliText(invocation, options = {}) {
         if (finished) {
             // A post-deadline close only releases background tracking. The request and
             // its diagnostic callback were already settled exactly once as timed-out.
-            if (observedClose && teardownState === 'timed-out')
+            if (observedClose && teardownState === 'timed-out') {
                 cleanupChildTracking();
+                // A child may have kept the prompt file open past the teardown
+                // deadline. Retry deletion once actual process/stdio closure is observed.
+                void prepared.cleanup().catch(() => { });
+            }
             return;
         }
         finished = true;
@@ -284,27 +399,37 @@ export async function* runCliText(invocation, options = {}) {
                 // Diagnostics must never change model-call settlement.
             }
         }
-        reportSettled(error);
-        queue.close(error);
-        resolveClosed?.();
+        const settleAfterPromptCleanup = async () => {
+            let settledError = error;
+            try {
+                await prepared.cleanup();
+            }
+            catch (cleanupError) {
+                if (settledError === undefined) {
+                    phase = 'child-close';
+                    settledError = cleanupError;
+                }
+            }
+            reportSettled(settledError);
+            queue.close(settledError);
+            resolveClosed?.();
+        };
+        void settleAfterPromptCleanup();
     };
     const onError = (error) => {
         // Node guarantees `close` after a spawn `error`. Waiting for it also avoids
         // treating a kill-related error as proof that a live process has exited.
         // Any spawn error before both a `spawn` event and any child output (ENOENT,
-        // EACCES, and every other pre-run failure alike) proves the OS never accepted
-        // the prompt argv, so replay stays safe: mark `not-submitted`. Once the child
-        // has spawned or produced output, submission is no longer disprovable and the
-        // state is left as-is (`submitted` or the default `unknown`).
+        // EACCES, and every other pre-run failure alike) proves prompt input was never
+        // attempted, so replay stays safe. Once the child has spawned or produced
+        // output, submission is no longer disprovable.
         if (!stopping && !sawSpawn && !sawChildOutput)
             promptSubmissionState = 'not-submitted';
         if (!terminationError)
             terminationError = error;
         stopping = true;
     };
-    const onClose = (code, signal) => {
-        observedExitCode = code;
-        observedSignal = signal;
+    const settleChildClose = (code, signal) => {
         if (terminationError)
             close(terminationError);
         else if (code !== 0 || signal !== null) {
@@ -317,19 +442,95 @@ export async function* runCliText(invocation, options = {}) {
         else
             close(validateProtocolSettlement(invocation.provider, {
                 sawValidJson,
-                sawRecognizedEvent,
                 sawAssistantText,
                 sawSuccessTerminal,
                 sawCursorAuthInit,
             }));
     };
-    // A delivered `spawn` proves the OS accepted the prompt argv; before it, replay is still safe.
+    const onClose = (code, signal) => {
+        observedExitCode = code;
+        observedSignal = signal;
+        if (finished) {
+            settleChildClose(code, signal);
+            return;
+        }
+        // Writable `finish` is queued on nextTick for Node streams. Give it that one
+        // bounded turn, then fail closed if a reduced process shim closed without ever
+        // completing or explicitly failing its stdin lifecycle.
+        process.nextTick(() => {
+            if (!terminationError && invocation.promptTransport === 'stdin'
+                && promptInputStarted && promptSubmissionState !== 'submitted') {
+                phase = 'prompt';
+                close(new CliPromptInputError(invocation.provider, 'CLOSED_EARLY'));
+                return;
+            }
+            settleChildClose(code, signal);
+        });
+    };
+    const startPromptSubmission = () => {
+        if (promptInputStarted || stopping || finished)
+            return;
+        promptInputStarted = true;
+        phase = 'prompt';
+        if (invocation.promptTransport === 'secure-temporary-file') {
+            // The spawn event proves the private path was handed to the child. Keep the
+            // file until child-close so the child cannot race path opening against cleanup.
+            promptSubmissionState = 'submitted';
+            disposeStdin = closeUnusedWritable(child.stdin);
+            return;
+        }
+        const input = child.stdin;
+        if (!input) {
+            stop(new CliPromptInputError(invocation.provider, 'MISSING_STDIN'));
+            return;
+        }
+        promptSubmissionState = 'unknown';
+        let inputSettled = false;
+        const onInputFinish = () => {
+            if (inputSettled)
+                return;
+            inputSettled = true;
+            promptSubmissionState = 'submitted';
+        };
+        const onInputError = () => {
+            if (inputSettled)
+                return;
+            inputSettled = true;
+            if (stopping || finished)
+                return;
+            stop(new CliPromptInputError(invocation.provider, 'WRITE_FAILED'));
+        };
+        const onInputClose = () => {
+            if (inputSettled)
+                return;
+            inputSettled = true;
+            if (stopping || finished)
+                return;
+            stop(new CliPromptInputError(invocation.provider, 'CLOSED_EARLY'));
+        };
+        input.once('finish', onInputFinish);
+        // Keep absorbing any follow-up stream errors until child-close cleanup.
+        input.on('error', onInputError);
+        input.once('close', onInputClose);
+        disposeStdin = () => {
+            input.removeListener('finish', onInputFinish);
+            input.removeListener('error', onInputError);
+            input.removeListener('close', onInputClose);
+        };
+        try {
+            input.end(invocation.prompt);
+        }
+        catch {
+            onInputError();
+        }
+    };
+    // A delivered `spawn` is the first point at which prompt transport may begin.
     const onSpawn = () => {
         sawSpawn = true;
         spawnedAt ??= performance.now();
-        promptSubmissionState = 'submitted';
         if (phase === 'spawn')
             phase = 'initialize';
+        startPromptSubmission();
     };
     child.once('spawn', onSpawn);
     child.once('error', onError);
@@ -339,26 +540,36 @@ export async function* runCliText(invocation, options = {}) {
     disposeStdout = consumeLines(child.stdout, limits.maxLineBytes, line => {
         if (stopping || finished)
             return;
-        // Child output proves the process ran. On its own it never proves the prompt was
-        // submitted, so the state stays at its default `unknown` (never demoted to
-        // `not-submitted`): `onError` only sets `not-submitted` while `!sawChildOutput`, so
-        // any spawn error after this point leaves submission `unknown`, not `not-submitted`.
+        // Real ChildProcess always emits `spawn` before output. Starting here as a
+        // defensive fallback also supports embedders that provide a reduced process shim.
+        startPromptSubmission();
+        // Child output proves the process ran. Without a full stdin finish or accepted
+        // prompt-file path, replay safety is unknown.
         sawChildOutput = true;
+        if (promptSubmissionState === 'not-submitted')
+            promptSubmissionState = 'unknown';
         const decoded = decodeJsonLine(line);
         if (decoded.kind === 'empty')
             return;
+        if (sawSuccessTerminal) {
+            stop(new CliProtocolError(invocation.provider, 'EVENT_AFTER_TERMINAL'));
+            return;
+        }
         sawStdoutOutput = true;
         if (decoded.kind === 'malformed') {
             stop(new CliProtocolError(invocation.provider, 'MALFORMED_JSON'));
             return;
         }
         sawValidJson = true;
-        if (!decoded.event)
+        if (!decoded.event) {
+            stop(new CliProtocolError(invocation.provider, 'UNKNOWN_EVENT'));
             return;
+        }
         const parsed = parseProviderEvent(invocation.provider, decoded.event);
-        if (!parsed)
+        if (!parsed) {
+            stop(new CliProtocolError(invocation.provider, 'UNKNOWN_EVENT'));
             return;
-        sawRecognizedEvent = true;
+        }
         firstEventAt ??= performance.now();
         if (phase === 'spawn' || phase === 'initialize')
             phase = 'prompt';
@@ -368,6 +579,12 @@ export async function* runCliText(invocation, options = {}) {
             stop(new CliSubscriptionAuthError('cursor', 'UNEXPECTED_AUTH_SOURCE'));
             return;
         }
+        if (parsed.nativeTool) {
+            terminalReason = 'native-tool-event';
+            phase = 'terminal';
+            stop(new CliProtocolError(invocation.provider, 'NATIVE_TOOL_EVENT'));
+            return;
+        }
         if (parsed.outcome === 'failure') {
             terminalReason = 'reported-failure';
             phase = 'terminal';
@@ -408,7 +625,10 @@ export async function* runCliText(invocation, options = {}) {
     disposeStderr = consumeLines(child.stderr, limits.maxLineBytes, line => {
         if (stopping || finished)
             return;
+        startPromptSubmission();
         sawChildOutput = true;
+        if (promptSubmissionState === 'not-submitted')
+            promptSubmissionState = 'unknown';
         // Stderr is diagnostic only; never expose it as model output or retain it unbounded.
         stderr = appendBounded(stderr, line, limits.maxStderrBytes);
     }, error => stop(error));
@@ -450,6 +670,8 @@ const providerDecoders = {
 };
 function decodeCodexEvent(event) {
     const item = object(event.item);
+    if (isCodexItemEvent(event.type) && isCodexNativeToolItem(item))
+        return nativeTool();
     if (event.type === 'item.completed' && item?.type === 'agent_message')
         return parsed(textOf(item.content) ?? textOf(item.text), false);
     if (event.type === 'agent_message')
@@ -465,19 +687,22 @@ function decodeCodexEvent(event) {
 }
 function decodeClaudeEvent(event) {
     const inner = object(event.event);
-    if (event.type === 'stream_event' && inner?.type === 'content_block_delta')
-        return parsed(textOf(object(inner.delta)?.text), false);
+    if (isClaudeNativeToolEvent(event, inner))
+        return nativeTool();
     if (event.type === 'stream_event')
-        return known();
+        return decodeAnthropicStreamEvent(inner);
     if (event.type === 'assistant')
         return parsed(textOf(event.message) ?? textOf(event.content), true);
     if (event.type === 'result')
         return parsed(textOf(event.result), true, resultOutcome(event));
-    if (knownType(event, ['system', 'user', 'tool_progress', 'tool_use_summary', 'auth_status', 'rate_limit_event']))
+    if (knownType(event, ['system', 'user', 'auth_status', 'rate_limit_event']))
         return known();
     return undefined;
 }
 function decodeCursorEvent(event) {
+    if (isToolLifecycle(event.type) || containsNativeToolBlock(event.message) || containsNativeToolBlock(event.content)) {
+        return nativeTool();
+    }
     if (event.type === 'system' && event.subtype === 'init') {
         return known({ auth: event.apiKeySource === 'login' ? 'subscription' : 'other' });
     }
@@ -487,56 +712,182 @@ function decodeCursorEvent(event) {
         return parsed(textOf(event.message) ?? textOf(event.content) ?? textOf(event.text), false);
     if (event.type === 'result')
         return parsed(textOf(event.result) ?? textOf(event.message), true, resultOutcome(event));
-    if (knownType(event, ['user', 'tool_call', 'tool_result']))
+    if (event.type === 'user')
         return known();
     return undefined;
 }
 function decodeGrokEvent(event) {
+    const update = object(event.update);
+    const paramsUpdate = object(object(event.params)?.update);
+    const anthropic = object(event.event);
+    if (isGrokNativeToolEvent(event, update, paramsUpdate, anthropic))
+        return nativeTool();
     if (event.type === 'text') {
         return typeof event.data === 'string' ? parsed(event.data, false) : undefined;
     }
     if (event.type === 'error')
         return known({ outcome: 'failure' });
     if (event.type === 'end') {
-        return typeof event.stopReason === 'string' && event.stopReason.length > 0
-            ? known({ outcome: 'success' })
-            : known({ outcome: 'invalid' });
+        if (event.stopReason === 'end_turn')
+            return known({ outcome: 'success' });
+        if (event.stopReason === 'tool_use')
+            return nativeTool();
+        if (isKnownGrokFailureStopReason(event.stopReason))
+            return known({ outcome: 'failure' });
+        return known({ outcome: 'invalid' });
+    }
+    if (event.type === 'available_commands') {
+        if (!Array.isArray(event.tools) || (event.commands !== undefined && !Array.isArray(event.commands)))
+            return undefined;
+        return event.tools.length === 0 ? known() : nativeTool();
+    }
+    if (event.type === 'usage') {
+        if (event.stopReason === undefined || event.stopReason === 'end_turn')
+            return known();
+        if (event.stopReason === 'tool_use')
+            return nativeTool();
+        if (isKnownGrokFailureStopReason(event.stopReason))
+            return known({ outcome: 'failure' });
+        return known({ outcome: 'invalid' });
     }
     if (event.type === 'streaming-messages-json' || event.type === 'message' || event.type === 'update') {
-        return parsed(textOf(event.text) ?? textOf(event.content) ?? textOf(object(event.delta)?.text) ?? textOf(event.message), false);
+        const text = textOf(event.text) ?? textOf(event.content) ?? textOf(object(event.delta)?.text) ?? textOf(event.message);
+        return text === undefined ? undefined : parsed(text, false);
     }
-    const anthropic = object(event.event);
-    if (event.type === 'stream_event' && anthropic?.type === 'content_block_delta')
-        return parsed(textOf(object(anthropic.delta)?.text), false);
     if (event.type === 'stream_event')
-        return known();
+        return decodeAnthropicStreamEvent(anthropic);
     if (event.type === 'content_block_delta')
-        return parsed(textOf(object(event.delta)?.text), false);
-    const update = object(event.update);
-    if (event.sessionUpdate === 'agent_message_chunk')
-        return parsed(textOf(event.content) ?? textOf(update?.text) ?? textOf(update?.content), false);
-    if (typeof event.sessionUpdate === 'string')
-        return known();
-    if (update?.sessionUpdate === 'agent_message_chunk')
-        return parsed(textOf(update.content), false);
+        return decodeAnthropicContentBlockDelta(object(event.delta));
+    if (typeof event.sessionUpdate === 'string') {
+        return decodeGrokSessionUpdate(event.sessionUpdate, event.content ?? update?.content);
+    }
     if (typeof update?.sessionUpdate === 'string')
-        return known();
-    const paramsUpdate = object(object(event.params)?.update);
-    if (event.method === 'session/update' && paramsUpdate?.sessionUpdate === 'agent_message_chunk') {
-        return parsed(textOf(paramsUpdate.content), false);
+        return decodeGrokSessionUpdate(update.sessionUpdate, update.content);
+    if (event.method === 'session/update' && typeof paramsUpdate?.sessionUpdate === 'string') {
+        return decodeGrokSessionUpdate(paramsUpdate.sessionUpdate, paramsUpdate.content);
     }
-    if (event.method === 'session/update')
-        return known();
     if (event.type === 'result') {
         const outcome = resultOutcome(event);
         return parsed(textOf(event.result) ?? textOf(event.text), true, outcome === 'success' ? undefined : outcome);
     }
     if (event.type === 'assistant')
         return parsed(textOf(event.message) ?? textOf(event.content) ?? textOf(event.text), false);
-    if (knownType(event, ['system', 'user', 'tool_call', 'tool_result']))
+    if (knownType(event, ['system', 'user']))
+        return known();
+    return undefined;
+}
+function isCodexItemEvent(type) {
+    return type === 'item.started' || type === 'item.updated' || type === 'item.completed';
+}
+function decodeAnthropicStreamEvent(inner) {
+    if (inner?.type === 'content_block_delta')
+        return decodeAnthropicContentBlockDelta(object(inner.delta));
+    if (inner?.type === 'content_block_start') {
+        const block = object(inner.content_block);
+        if (!knownValue(block?.type, ['text', 'thinking', 'redacted_thinking']))
+            return undefined;
+        return parsed(textOf(block?.text), false);
+    }
+    if (inner?.type === 'error')
+        return known({ outcome: 'failure' });
+    if (knownValue(inner?.type, ['message_start', 'content_block_stop', 'message_delta', 'message_stop', 'ping']))
         return known();
     return undefined;
 }
+function decodeAnthropicContentBlockDelta(delta) {
+    if (delta?.type === undefined && typeof delta?.text === 'string')
+        return parsed(delta.text, false);
+    if (delta?.type === 'text_delta' && typeof delta.text === 'string')
+        return parsed(delta.text, false);
+    if (knownValue(delta?.type, ['thinking_delta', 'signature_delta', 'citations_delta']))
+        return known();
+    return undefined;
+}
+const passiveGrokSessionUpdates = [
+    'user_message_chunk',
+    'agent_thought_chunk',
+    'plan',
+    'plan_update',
+    'plan_removed',
+    'available_commands_update',
+    'current_mode_update',
+    'config_option_update',
+    'session_info_update',
+    'usage_update',
+];
+function decodeGrokSessionUpdate(type, content) {
+    if (type === 'agent_message_chunk') {
+        const text = textOf(content);
+        return text === undefined ? undefined : parsed(text, false);
+    }
+    return knownValue(type, passiveGrokSessionUpdates) ? known() : undefined;
+}
+/** Codex exec JSONL currently has only three passive item kinds; every other
+ * item kind represents a built-in/dynamic tool or another active capability.
+ * Keeping this as a passive allowlist makes new native executors fail closed. */
+function isCodexNativeToolItem(item) {
+    if (typeof item?.type !== 'string')
+        return true;
+    return item.type !== 'agent_message' && item.type !== 'reasoning' && item.type !== 'error';
+}
+function isClaudeNativeToolEvent(event, inner) {
+    if (isToolLifecycle(event.type) || event.type === 'tool_progress')
+        return true;
+    if (event.stop_reason === 'tool_use' || object(event.message)?.stop_reason === 'tool_use')
+        return true;
+    if (object(inner?.delta)?.stop_reason === 'tool_use')
+        return true;
+    if (event.type === 'system' && Array.isArray(event.tools) && event.tools.length > 0)
+        return true;
+    if (containsNativeToolBlock(event.message) || containsNativeToolBlock(event.content)
+        || containsNativeToolBlock(event.delta))
+        return true;
+    return event.type === 'stream_event'
+        && (containsNativeToolBlock(inner?.message) || containsNativeToolBlock(inner?.content_block)
+            || containsNativeToolBlock(inner?.delta));
+}
+function isGrokNativeToolEvent(event, update, paramsUpdate, anthropic) {
+    if (isToolLifecycle(event.type) || isToolLifecycle(event.sessionUpdate)
+        || isToolLifecycle(update?.sessionUpdate) || isToolLifecycle(paramsUpdate?.sessionUpdate))
+        return true;
+    if (event.type === 'available_commands' && Array.isArray(event.tools) && event.tools.length > 0)
+        return true;
+    if (event.method === 'session/request_permission' || event.method === 'session/requestPermission')
+        return true;
+    if (containsNativeToolBlock(event.message) || containsNativeToolBlock(event.content)
+        || containsNativeToolBlock(event.delta))
+        return true;
+    return event.type === 'stream_event'
+        && (containsNativeToolBlock(anthropic?.message) || containsNativeToolBlock(anthropic?.content_block)
+            || containsNativeToolBlock(anthropic?.delta));
+}
+function isToolLifecycle(value) {
+    if (typeof value !== 'string')
+        return false;
+    return value === 'tool_call' || value === 'tool_result' || value === 'tool_use'
+        || value.startsWith('tool_call_') || value.startsWith('tool_use_')
+        || value === 'hook_execution' || value === 'pending_interaction' || value === 'interaction_resolved';
+}
+function containsNativeToolBlock(value, depth = 0) {
+    if (depth > 8)
+        return false;
+    if (Array.isArray(value))
+        return value.some(item => containsNativeToolBlock(item, depth + 1));
+    const record = object(value);
+    if (record === undefined)
+        return false;
+    const type = record.type;
+    if (isToolLifecycle(type) || type === 'server_tool_use' || type === 'input_json_delta'
+        || (typeof type === 'string' && type.endsWith('_tool_result')))
+        return true;
+    return containsNativeToolBlock(record.content, depth + 1)
+        || containsNativeToolBlock(record.message, depth + 1)
+        || containsNativeToolBlock(record.content_block, depth + 1)
+        || containsNativeToolBlock(record.delta, depth + 1);
+}
+function nativeTool() {
+    return { terminal: false, nativeTool: true };
+}
 export function parseAssistantText(provider, line) {
     return parseAssistantEvent(provider, line)?.text;
 }
@@ -549,6 +900,12 @@ function known(fields = {}) {
 function knownType(event, types) {
     return typeof event.type === 'string' && types.includes(event.type);
 }
+function knownValue(value, values) {
+    return typeof value === 'string' && values.includes(value);
+}
+function isKnownGrokFailureStopReason(value) {
+    return knownValue(value, ['cancelled', 'canceled', 'max_tokens', 'max_turn_requests']);
+}
 function resultOutcome(event) {
     const subtype = typeof event.subtype === 'string' ? event.subtype.toLowerCase() : '';
     if (subtype === 'success' && event.is_error === false)
@@ -579,8 +936,6 @@ function validateProtocolSettlement(provider, state) {
     }
     if (!state.sawValidJson)
         return new CliProtocolError(provider, 'NO_JSON_EVENTS');
-    if (!state.sawRecognizedEvent)
-        return new CliProtocolError(provider, 'UNRECOGNIZED_EVENTS');
     if (!state.sawAssistantText)
         return new CliProtocolError(provider, 'NO_ASSISTANT_TEXT');
     if ((provider === 'codex' || provider === 'claude' || provider === 'cursor' || provider === 'grok') && !state.sawSuccessTerminal) {
@@ -592,14 +947,26 @@ function protocolErrorMessage(provider, reason) {
     const descriptions = {
         MALFORMED_JSON: 'emitted malformed NDJSON',
         NO_JSON_EVENTS: 'closed without any JSON events',
-        UNRECOGNIZED_EVENTS: 'emitted no recognized protocol events',
+        UNKNOWN_EVENT: 'emitted an event outside the supported protocol allowlist',
+        EVENT_AFTER_TERMINAL: 'emitted an event after its successful terminal event',
         NO_ASSISTANT_TEXT: 'closed without assistant text',
         MISSING_SUCCESS_TERMINAL: 'closed without a successful terminal event',
         INVALID_TERMINAL: 'emitted an unrecognized terminal result',
+        NATIVE_TOOL_EVENT: 'emitted a forbidden native tool event',
         REPORTED_FAILURE: 'reported a failed model turn',
     };
     return `${provider} CLI ${descriptions[reason]}`;
 }
+function promptInputErrorMessage(provider, reason) {
+    const descriptions = {
+        MISSING_STDIN: 'did not expose a writable stdin pipe',
+        WRITE_FAILED: 'failed while receiving prompt input',
+        CLOSED_EARLY: 'closed before prompt input completed',
+        FILE_PREPARE_FAILED: 'could not prepare its private prompt file',
+        FILE_CLEANUP_FAILED: 'could not remove its private prompt file',
+    };
+    return `${provider} CLI ${descriptions[reason]}`;
+}
 function exitDescription(code, signal) {
     const parts = [`code=${code === null ? 'null' : String(code)}`];
     if (signal !== null)
@@ -608,7 +975,11 @@ function exitDescription(code, signal) {
 }
 function isCodexWorkingDirectoryRejection(diagnostic) {
     const expected = 'Not inside a trusted directory and --skip-git-repo-check was not specified.';
-    const allowed = new Set([expected, 'Reading additional input from stdin...']);
+    const allowed = new Set([
+        expected,
+        'Reading additional input from stdin...',
+        'Reading prompt from stdin...',
+    ]);
     const lines = diagnostic.split(/\r?\n/).map(line => line.trim()).filter(Boolean);
     return lines.includes(expected) && lines.every(line => allowed.has(line));
 }
@@ -630,6 +1001,32 @@ function appendBounded(value, addition, limit) {
     return bytes.byteLength <= limit ? next : bytes.subarray(bytes.byteLength - limit).toString('utf8');
 }
 function byteLength(value) { return Buffer.byteLength(value, 'utf8'); }
+function isNotFoundError(error) {
+    return error !== null && typeof error === 'object' && 'code' in error && error.code === 'ENOENT';
+}
+function closeUnusedWritable(stream) {
+    if (!stream)
+        return () => { };
+    const onError = () => { };
+    stream.on('error', onError);
+    try {
+        stream.end();
+    }
+    catch {
+        // The prompt lives in the private file; failure to close an unused stdin pipe
+        // neither loses nor exposes it. Keep absorbing a later stream error.
+    }
+    return () => { stream.removeListener('error', onError); };
+}
+function destroyWritable(stream) {
+    try {
+        const destroyable = stream;
+        destroyable?.destroy?.();
+    }
+    catch {
+        // Process-tree termination remains the authoritative teardown path.
+    }
+}
 function consumeLines(stream, maxLineBytes, onLine, onError) {
     if (!stream)
         return () => { };