@ebrindley/build 0.0.0-stage → 1.42.1-rc28

package/dist/runner-KHDNQ5KU.js

@@ -0,0 +1,1194 @@
+import {
+  appendNativeSubagentGuidance
+} from "./chunk-7SEWU4QG.js";
+import {
+  rejectUnsupportedAttachments
+} from "./chunk-ENYRCL43.js";
+import {
+  DEFAULT_PROVIDER_CIRCUIT_BREAKER_OPTIONS,
+  RetryBudget,
+  assertWorkspaceRetryIsSafe,
+  captureGitBaseline,
+  captureWorkspaceRetryState,
+  detectGitChangedFiles,
+  executeWithResilience,
+  measurePromptRequestBytes,
+  recordInvocationTiming
+} from "./chunk-D37WY7SH.js";
+import "./chunk-Z7CDQNH3.js";
+import "./chunk-PRDHI2L5.js";
+import {
+  resolveProviderTimeoutMs
+} from "./chunk-URMSZXAD.js";
+import {
+  acquireRateLimitToken
+} from "./chunk-JVHGMURQ.js";
+import {
+  resolveGrokReasoningEffortLookupModel
+} from "./chunk-2YRG3LHZ.js";
+import {
+  reportTransportDecision,
+  selectProviderExecutor
+} from "./chunk-JYXS47FQ.js";
+import "./chunk-B7PYTV72.js";
+import "./chunk-4QKP6I4C.js";
+import {
+  clampAttemptTimeoutToDeadline,
+  resolveReadOnlyWorkingDir
+} from "./chunk-GWHGTG37.js";
+import {
+  inferProviderFailurePhase,
+  recordProviderRunFailure,
+  recordProviderRunSuccess
+} from "./chunk-CRPRVNQ4.js";
+import {
+  allowsGrokBrowserAuth,
+  capturedStdoutHasTerminalEnvelope,
+  createGrokTmuxCompletionSignal,
+  formatGrokStreamLineForDisplay,
+  grokCategoryToRetryable,
+  hasGrokHeadlessApiKey,
+  isStderrOnlyNoise,
+  parseGrokOutput
+} from "./chunk-EJIWTPSZ.js";
+import "./chunk-MYLH2S4G.js";
+import "./chunk-3P5IN5E7.js";
+import {
+  GROK_CLI_PROBE_TIMEOUT_MS,
+  GROK_DONT_ASK_MIN_VERSION,
+  GROK_READ_ONLY_ALLOW_RULES,
+  GrokCliNotFoundError,
+  buildGrokArgv,
+  createGrokCliChildEnv,
+  grokCliSupportsDontAsk,
+  grokDontAskUnsupportedDetail,
+  grokResolvedHasLockedReadOnlyPosture,
+  isInheritedOuterBoundaryActive,
+  metadata,
+  shouldEmitGrokModelArg
+} from "./chunk-2Y2IIHPI.js";
+import "./chunk-WEI3ZDZH.js";
+import "./chunk-H6MJGKAW.js";
+import {
+  resolveProviderStreamingEnabled
+} from "./chunk-67YRJPJO.js";
+import {
+  TMUX_COMPLETION_SIGNAL_GRACE_MS,
+  composeRawChunkObservers,
+  executeProviderCommand,
+  isNonEmptyRawChunk
+} from "./chunk-633XZ7UF.js";
+import "./chunk-SF6YK3JI.js";
+import {
+  providerOutputTail,
+  redactProviderArgv
+} from "./chunk-JBBB2Y47.js";
+import "./chunk-WJAL4JL3.js";
+import "./chunk-RBKLOUXA.js";
+import "./chunk-4EBSXZ73.js";
+import "./chunk-PFCXFO7A.js";
+import "./chunk-SDPIFNLD.js";
+import "./chunk-GO6DRECI.js";
+import "./chunk-XIBVFMLQ.js";
+import "./chunk-QWMQ74KD.js";
+import "./chunk-GAFJEYLK.js";
+import "./chunk-YKC75XK4.js";
+import "./chunk-T7E5JS6N.js";
+import "./chunk-ZJB6SQPA.js";
+import "./chunk-GZK62I3N.js";
+import "./chunk-GC4CRMTS.js";
+import "./chunk-P7CQGPLS.js";
+import {
+  resolveConfiguredProviderExecutionTransport
+} from "./chunk-C3DH3NCY.js";
+import "./chunk-IVZEONFC.js";
+import "./chunk-XTXYIISX.js";
+import "./chunk-MEMSY6VY.js";
+import "./chunk-VBNCKCCI.js";
+import "./chunk-33IGPPUI.js";
+import "./chunk-UPHU64NB.js";
+import "./chunk-JLS65NUQ.js";
+import "./chunk-FRBPKBFE.js";
+import "./chunk-BAWJNMWF.js";
+import "./chunk-LX4F24ZH.js";
+import "./chunk-BBPIILO2.js";
+import "./chunk-2NMNFUQA.js";
+import "./chunk-I7SCBHJN.js";
+import {
+  applyWorkspaceMode,
+  logReasoningEffortResolution,
+  resolveEffectiveMode,
+  resolveReasoningEffort
+} from "./chunk-TGXXYDL4.js";
+import "./chunk-D2M2Y5ID.js";
+import "./chunk-UJP3XM54.js";
+import "./chunk-MULMXX4V.js";
+import "./chunk-UTDEOPKV.js";
+import "./chunk-RFDVSI4N.js";
+import "./chunk-M4BUEXXF.js";
+import "./chunk-ZH4G3FU5.js";
+import "./chunk-726G6WDL.js";
+import "./chunk-EP22ZMFO.js";
+import "./chunk-5UBIFVRD.js";
+import "./chunk-O7FE75QZ.js";
+import "./chunk-Q64IR2Z2.js";
+import "./chunk-YVCMDVBB.js";
+import "./chunk-7HPCIOMA.js";
+import "./chunk-P6SSWAKY.js";
+import "./chunk-ETAD4NKD.js";
+import "./chunk-XQPEWJPI.js";
+import "./chunk-7YAOUUKK.js";
+import "./chunk-SKTFRFQ7.js";
+import "./chunk-O5X6BKAO.js";
+import "./chunk-R2CKS6WT.js";
+import "./chunk-3OPP2OZB.js";
+import "./chunk-EPRMH6HO.js";
+import "./chunk-XHOI4V62.js";
+import "./chunk-S2VQCZO4.js";
+import "./chunk-6TBEX4R4.js";
+import "./chunk-PXKERBKX.js";
+import "./chunk-QYQOVOLR.js";
+import "./chunk-QFLBRWCJ.js";
+import "./chunk-AEQWV746.js";
+import "./chunk-SVUNZOPG.js";
+import "./chunk-KUEWV2JH.js";
+import "./chunk-R2TIYG7U.js";
+import "./chunk-5FKHIKTS.js";
+import "./chunk-S2E632FQ.js";
+import "./chunk-XJ2E7YEJ.js";
+import {
+  isSandboxEnforcementOperational,
+  requireActivePolicyBoundary
+} from "./chunk-B7YRSULE.js";
+import "./chunk-4U6XK2DG.js";
+import "./chunk-BY6ODHNZ.js";
+import "./chunk-3H4MWYIC.js";
+import {
+  getRequiredWritePathsForProvider,
+  resolveWritePathSpec
+} from "./chunk-DP7FKP6W.js";
+import "./chunk-VIFHYTI5.js";
+import "./chunk-XGU6PBO5.js";
+import "./chunk-F55YABKV.js";
+import "./chunk-YO5BAJ55.js";
+import "./chunk-EVE3OD2W.js";
+import {
+  mkBuildTempDir
+} from "./chunk-D6WTZMZB.js";
+import "./chunk-5EQN56OZ.js";
+import "./chunk-RBBTBCHX.js";
+import "./chunk-4DJL2VXA.js";
+import "./chunk-AHU3FKPA.js";
+import "./chunk-TUQMMFEQ.js";
+import "./chunk-EPAMVGI3.js";
+import "./chunk-6CB3KJRY.js";
+import "./chunk-L2S235CU.js";
+import "./chunk-D4VJFCGZ.js";
+import "./chunk-RPIMAMV7.js";
+import "./chunk-ALDTFNZ3.js";
+import "./chunk-QOIASNEJ.js";
+import "./chunk-2VUEDIUM.js";
+import "./chunk-MJ6WNSIX.js";
+import "./chunk-5KQETTNS.js";
+import "./chunk-J2ICMYDA.js";
+import "./chunk-2VLJUXJU.js";
+import {
+  authFailureEvidence,
+  isAuthFailureError,
+  recordAuthOutcome
+} from "./chunk-PPZESPJT.js";
+import "./chunk-XCOIBNET.js";
+import "./chunk-Y733RB7T.js";
+import "./chunk-H3HGMISG.js";
+import "./chunk-FAZBRHGG.js";
+import "./chunk-CJBSZX3F.js";
+import "./chunk-C3KCMAJP.js";
+import "./chunk-FKCG7K6H.js";
+import "./chunk-AJN5Y5YZ.js";
+import "./chunk-MHLEZQQI.js";
+import "./chunk-HEP3ILP4.js";
+import "./chunk-BQJOGAWT.js";
+import "./chunk-WV3KQDPE.js";
+import "./chunk-VSWC5ZXI.js";
+import "./chunk-XV7NZL4B.js";
+import {
+  resolveProviderCliCommand
+} from "./chunk-KKQKWAMF.js";
+import "./chunk-RWQQIKIC.js";
+import "./chunk-GVJGSSKM.js";
+import "./chunk-QJ6OEH4K.js";
+import "./chunk-BD3PGW6A.js";
+import "./chunk-43OKHTW4.js";
+import "./chunk-MNOVBYFU.js";
+import "./chunk-QXBKTJT6.js";
+import "./chunk-4BTDUT2S.js";
+import "./chunk-35J4NE6S.js";
+import "./chunk-RIMARPCF.js";
+import "./chunk-HGFXODKO.js";
+import "./chunk-N5DX4JAK.js";
+import "./chunk-V2TVPO3X.js";
+import {
+  ProviderExecutionError
+} from "./chunk-RRC5BL7B.js";
+import "./chunk-352PCJLK.js";
+import "./chunk-RCP2Y6DQ.js";
+import {
+  hostTerminationMetadataFromUnknown,
+  parseHostTermination
+} from "./chunk-M6UHOC4I.js";
+import "./chunk-PSTKWHHN.js";
+import "./chunk-KTMW65UX.js";
+import "./chunk-3JKNRYEE.js";
+import "./chunk-MT2WAIR3.js";
+import "./chunk-WGQAXLNA.js";
+import "./chunk-ONHAMBN6.js";
+import "./chunk-XSJTIFUY.js";
+import "./chunk-XWIZ6B5S.js";
+import "./chunk-U4DRS6ZW.js";
+import "./chunk-I56TH7VM.js";
+import "./chunk-Z5WGNULV.js";
+import "./chunk-O26L6F7F.js";
+import "./chunk-RJ6RSNT6.js";
+import "./chunk-ZORW64QH.js";
+import "./chunk-TAJPCXSB.js";
+import "./chunk-56WPYDJH.js";
+import "./chunk-RSYTSBOO.js";
+import "./chunk-STW7OFOA.js";
+import "./chunk-CHA2HDE5.js";
+import "./chunk-JNMWYMC6.js";
+import {
+  BUILD_GROK_TRANSPORT_WATCHDOG,
+  BUILD_MINIMAL_PROMPTS,
+  debugLog,
+  readEnv,
+  readRawEnv
+} from "./chunk-7VRJHTGZ.js";
+import "./chunk-XDM65LBX.js";
+import "./chunk-CPSVQR2I.js";
+import "./chunk-PZ5AY32C.js";
+
+// src/core/providers/grok/execution/runner.ts
+import { rm, writeFile } from "fs/promises";
+import path from "path";
+
+// src/core/providers/grok/prompt-adapter.ts
+function isMinimalPromptsEnabled() {
+  return readEnv(BUILD_MINIMAL_PROMPTS).value === true;
+}
+function resolveMode(options) {
+  if (isMinimalPromptsEnabled()) return "minimal";
+  return resolveEffectiveMode(
+    options.promptMode ?? null,
+    options.globalWorkspaceMode ?? null,
+    "grok"
+  );
+}
+function appendGrokNativeSubagentGuidance(prompt, nativeSubagents) {
+  if (!nativeSubagents) {
+    return { prompt, applied: false };
+  }
+  return appendNativeSubagentGuidance(
+    prompt,
+    typeof nativeSubagents.count === "number" ? nativeSubagents.count : "advisory",
+    {
+      // Verified on grok 0.2.73: extras queue after roughly eight concurrent agents.
+      concurrencyHint: "About 8 subagents run simultaneously; if more are useful, launch them in waves rather than all at once."
+    }
+  );
+}
+function adaptPromptForGrok(prompt, options = {}) {
+  const mode = resolveMode(options);
+  const subagentResult = appendGrokNativeSubagentGuidance(prompt, options.nativeSubagents);
+  const result = applyWorkspaceMode(subagentResult.prompt, {
+    mode,
+    provider: "GROK",
+    executionIntent: options.executionIntent ?? "code",
+    targetFiles: options.files,
+    projectRoot: options.projectRoot
+  });
+  const operations = [...result.operations];
+  if (subagentResult.applied) {
+    operations.push("Injected Grok native subagent request");
+  }
+  return {
+    original: prompt,
+    adapted: result.adapted,
+    mode: result.mode,
+    adaptations: operations,
+    promptFingerprint: result.adaptedHash,
+    finalPromptLength: result.lengths.adapted,
+    completionSignalVariant: result.completionSignalVariant
+  };
+}
+
+// src/core/providers/grok/sandbox-denial-hint.ts
+function grokSandboxDenialHint(env) {
+  const specs = getRequiredWritePathsForProvider("grok", { env, includeSharedPaths: false });
+  const granted = [];
+  const rejected = [];
+  for (const spec of specs) {
+    const resolved = resolveWritePathSpec(spec, env.HOME);
+    if (resolved) (spec.rejected ? rejected : granted).push(resolved);
+  }
+  const parts = [
+    `Build's sandbox may have denied this write. Grok did not report which path was denied. Grok state paths Build's sandbox allows: ${granted.join(", ") || "none"}.`
+  ];
+  if (rejected.length > 0) {
+    parts.push(
+      `GROK_HOME (${rejected.join(", ")}) is outside the directories the sandbox may grant; unset it or point it under ~/.grok or the temp directory.`
+    );
+  }
+  return parts.join(" ");
+}
+
+// src/core/providers/grok/transport-death-watchdog.ts
+import { StringDecoder } from "string_decoder";
+var TRANSPORT_CLOSE_PATTERN = /Transport channel closed, when Auth\(AuthorizationRequired\)/i;
+var TOOL_OUTPUT_ERROR_PATTERN = /tool[_\s-]?output[_\s-]?error/i;
+var DEFAULT_GROK_SPIRAL_TOOL_ERROR_THRESHOLD = 3;
+var DEFAULT_GROK_SPIRAL_POST_CLOSE_LINE_WINDOW = 15;
+function createGrokTransportDeathWatchdog(options) {
+  const threshold = Math.max(
+    1,
+    options.toolErrorThreshold ?? DEFAULT_GROK_SPIRAL_TOOL_ERROR_THRESHOLD
+  );
+  const postCloseLineWindow = Math.max(
+    threshold,
+    options.postCloseLineWindow ?? DEFAULT_GROK_SPIRAL_POST_CLOSE_LINE_WINDOW
+  );
+  let transportCloseCount = 0;
+  let postTransportToolErrorCount = 0;
+  let linesSinceTransportClose = 0;
+  let armed = false;
+  let tripped = false;
+  let pendingPartialLine = "";
+  let decoder = new StringDecoder("utf8");
+  const snapshot = () => ({
+    transportCloseCount,
+    postTransportToolErrorCount,
+    threshold
+  });
+  const observeLine = (line) => {
+    if (TRANSPORT_CLOSE_PATTERN.test(line)) {
+      transportCloseCount += 1;
+      armed = true;
+      postTransportToolErrorCount = 0;
+      linesSinceTransportClose = 0;
+      return;
+    }
+    if (!armed) return;
+    linesSinceTransportClose += 1;
+    if (TOOL_OUTPUT_ERROR_PATTERN.test(line)) {
+      postTransportToolErrorCount += 1;
+      if (postTransportToolErrorCount >= threshold) {
+        tripped = true;
+        options.onSpiralDetected(snapshot());
+        return;
+      }
+    }
+    if (linesSinceTransportClose >= postCloseLineWindow) {
+      armed = false;
+    }
+  };
+  const observeText = (text) => {
+    if (tripped || !text) return;
+    const segments = (pendingPartialLine + text).split(/\r?\n/);
+    pendingPartialLine = segments.pop() ?? "";
+    for (const segment of segments) {
+      const line = segment.trim();
+      if (!line) continue;
+      observeLine(line);
+      if (tripped) return;
+    }
+    const partial = pendingPartialLine.trim();
+    if (partial && (TRANSPORT_CLOSE_PATTERN.test(partial) || TOOL_OUTPUT_ERROR_PATTERN.test(partial))) {
+      pendingPartialLine = "";
+      observeLine(partial);
+    }
+  };
+  const observe = (chunk) => {
+    if (tripped || !isNonEmptyRawChunk(chunk)) return;
+    if (typeof chunk === "string") {
+      const held = decoder.end();
+      decoder = new StringDecoder("utf8");
+      observeText(held + chunk);
+      return;
+    }
+    const text = decoder.write(Buffer.from(chunk));
+    observeText(text);
+  };
+  return {
+    observe,
+    hasTripped: () => tripped,
+    snapshot
+  };
+}
+
+// src/core/providers/grok/version-probe.ts
+async function probeGrokCliVersionRaw(env) {
+  const { execa } = await import("execa");
+  const { command, prefixArgs } = resolveProviderCliCommand(metadata.id);
+  const result = await execa(command, [...prefixArgs, "--version"], {
+    reject: false,
+    timeout: GROK_CLI_PROBE_TIMEOUT_MS,
+    stdio: "pipe",
+    env: createGrokCliChildEnv(env),
+    extendEnv: false
+  });
+  if (result.code === "ENOENT") throw new GrokCliNotFoundError();
+  if (result.exitCode !== 0) {
+    throw new Error(`grok --version exited ${result.exitCode}`);
+  }
+  return result.stdout ?? "";
+}
+async function probeGrokDontAskSupport(env) {
+  try {
+    return await grokCliSupportsDontAsk(() => probeGrokCliVersionRaw(env));
+  } catch (error) {
+    if (!(error instanceof GrokCliNotFoundError)) throw error;
+    throw new ProviderExecutionError(
+      "[Grok] Grok CLI not found. Install grok or set the Grok CLI path.",
+      { providerName: metadata.id, retryable: false, reason: "cli_not_found" }
+    );
+  }
+}
+
+// src/core/providers/grok/execution/runner.ts
+function shouldStreamGrokOutput(outputFormat, env) {
+  if (outputFormat !== "streaming-json") return false;
+  return resolveProviderStreamingEnabled(env);
+}
+var GROK_AUTHORITATIVE_STDOUT_CEILING_BYTES = 32 * 1024 * 1024;
+function grokEditIntentRequiresMutation(options) {
+  if (options.allowEmptyResults === true) return false;
+  if (resolveReadOnlyWorkingDir(options)) return false;
+  return true;
+}
+function readGrokBuilderEnvString(env, key) {
+  const source = env ?? process.env;
+  const value = source[key];
+  if (typeof value !== "string") return void 0;
+  const trimmed = value.trim();
+  return trimmed.length > 0 ? trimmed : void 0;
+}
+function grokDontAskUnsupportedForEditMessage(source) {
+  const fix = source === "caller options" ? "omit permissionMode from the caller options" : "unset BUILD_GROK_PERMISSION_MODE";
+  return [
+    `[Grok] permissionMode=dontAsk is not supported for edit/mixed execution (set by ${source}).`,
+    "ProviderRunOptions has no allowRules channel for a bounded edit allowlist;",
+    "applying read-only allows would deny Edit and fail mid-run.",
+    "Use readOnlyWorkingDir or executionIntent=analysis for auto dontAsk inspect/search,",
+    `or ${fix} for headless edit (default --always-approve),`,
+    "or set permissionMode=bypassPermissions when policy permits."
+  ].join(" ");
+}
+function assertGrokReadOnlyModeAllowedInHostSandbox(permissionMode) {
+  if (!isInheritedOuterBoundaryActive(metadata.name, metadata.id)) return;
+  throw new ProviderExecutionError(
+    `[Grok] permissionMode=${permissionMode} is not supported for a read-only run inside the host's sandbox: only the locked dontAsk posture keeps the shell and edit tools off there. Omit permissionMode (read-only runs select dontAsk automatically) or run Build outside the host sandbox.`,
+    {
+      providerName: metadata.id,
+      retryable: false,
+      reason: "unsupported_permission_mode"
+    }
+  );
+}
+function throwGrokDontAskUnsupportedForEdit(source) {
+  throw new ProviderExecutionError(grokDontAskUnsupportedForEditMessage(source), {
+    providerName: metadata.id,
+    retryable: false,
+    reason: "unsupported_permission_mode"
+  });
+}
+function throwGrokUnsupportedLockedReadOnlyPosture(source) {
+  const sourceNote = source === "explicit-dontAsk" ? "permissionMode=dontAsk" : "semantic auto-readonly / analysis (readOnlyWorkingDir or executionIntent=analysis)";
+  throw new ProviderExecutionError(
+    [
+      `[Grok] ${sourceNote} requires Grok CLI >= ${GROK_DONT_ASK_MIN_VERSION}`,
+      "for the locked native read-only permission posture",
+      "(dontAsk + inspect/search allows + --tools/--disallowed-tools/--deny).",
+      grokDontAskUnsupportedDetail() ?? "The installed CLI version does not support this posture; upgrade grok.",
+      source === "auto-readonly" ? "Build will not fall back to default permissions + --always-approve for semantic auto-readonly runs." : "Upgrade grok or omit permissionMode."
+    ].join(" "),
+    {
+      providerName: metadata.id,
+      retryable: false,
+      reason: "unsupported_permission_mode"
+    }
+  );
+}
+function resolveGrokPermissionArgvInput(options) {
+  const lockPermissionMode = options.isReadOnlyRun;
+  const explicit = options.permissionMode;
+  if (explicit === "dontAsk" && !options.isReadOnlyRun) {
+    throwGrokDontAskUnsupportedForEdit("caller options");
+  }
+  if (explicit && explicit !== "dontAsk" && options.isReadOnlyRun) {
+    assertGrokReadOnlyModeAllowedInHostSandbox(explicit);
+  }
+  if (explicit) {
+    if (explicit === "dontAsk") {
+      if (!options.supportsDontAsk) {
+        throwGrokUnsupportedLockedReadOnlyPosture("explicit-dontAsk");
+      }
+      return {
+        permissionMode: "dontAsk",
+        allowRules: GROK_READ_ONLY_ALLOW_RULES,
+        lockPermissionMode: true,
+        lockReadOnlyPosture: true
+      };
+    }
+    return {
+      permissionMode: explicit,
+      lockPermissionMode
+    };
+  }
+  if (options.isReadOnlyRun) {
+    if (!options.supportsDontAsk) {
+      throwGrokUnsupportedLockedReadOnlyPosture("auto-readonly");
+    }
+    return {
+      permissionMode: "dontAsk",
+      allowRules: GROK_READ_ONLY_ALLOW_RULES,
+      lockPermissionMode: true,
+      lockReadOnlyPosture: true
+    };
+  }
+  return { lockPermissionMode };
+}
+function isTerminationReason(reason) {
+  if (!reason) return false;
+  return reason === "hard_timeout" || reason === "idle_timeout" || reason === "timeout" || reason === "abort" || reason === "signal" || reason.startsWith("signal_") || reason.startsWith("plm_");
+}
+function isTimeoutTerminationReason(reason) {
+  if (!reason) return false;
+  return reason === "hard_timeout" || reason === "idle_timeout" || reason === "timeout" || reason === "plm_timeout";
+}
+function grokCategoryToReason(category) {
+  switch (category) {
+    case "auth":
+      return "auth";
+    case "fs_permission_denied":
+      return "fs_permission_denied";
+    case "model_rejection":
+      return "model_rejection";
+    case "max_turns_exceeded":
+      return "max_turns_exceeded";
+    case "provider_transport_failure":
+      return "provider_transport_failure";
+    case "cancelled_incomplete":
+      return "cancelled_incomplete";
+    case "rate_limit":
+      return "rate_limit";
+    case "capacity":
+      return "capacity";
+    case "network":
+      return "network";
+    case "runtime":
+      return "runtime";
+    default:
+      return "unknown";
+  }
+}
+function trySalvageCompletedGrokOutput(error, outputFormatIsJson) {
+  if (!outputFormatIsJson || !(error instanceof ProviderExecutionError)) {
+    return void 0;
+  }
+  if (typeof error.stdout !== "string" || error.stdout.trim().length === 0) {
+    return void 0;
+  }
+  if (!capturedStdoutHasTerminalEnvelope(error.stdout)) {
+    return void 0;
+  }
+  if (parseGrokOutput(error.stdout, error.stderr ?? "", 0).type !== "success") {
+    return void 0;
+  }
+  return {
+    stdout: error.stdout,
+    stderr: error.stderr ?? "",
+    exitCode: 0
+  };
+}
+async function recordRunTiming(options) {
+  await recordInvocationTiming({
+    providerId: metadata.id,
+    // Grok is first-party: the vendor itself serves the run and discloses no other route.
+    backend: metadata.id,
+    requestSizeBytes: options.requestSizeBytes,
+    modelId: options.resolvedModel ?? options.model ?? metadata.defaultModel ?? "default",
+    requestedModelId: options.model ?? null,
+    executionModelId: shouldEmitGrokModelArg(options.model) ? options.model.trim() : null,
+    reportedModelId: options.reportedModel ?? null,
+    timeRequestSentMs: options.startMs,
+    timeFirstTokenMs: options.firstOutputMs ?? null,
+    timeLastTokenMs: options.endMs,
+    tokensIn: options.tokensIn ?? null,
+    tokensOut: options.tokensOut ?? null,
+    // Grok reports cache reads beside the uncached input, never inside it (a
+    // run's cache reads can exceed its input).
+    tokenUsage: options.tokenUsage?.cachedInputTokens !== void 0 ? { ...options.tokenUsage, cacheReadTokensIncludedInInput: false } : options.tokenUsage,
+    providerReportedCostUsd: options.providerReportedCostUsd,
+    status: options.status,
+    errorCode: options.errorCode ?? null,
+    failure: options.failure,
+    agentRole: options.env?.BUILD_AGENT_ROLE || null,
+    env: options.env
+  });
+}
+function isGrokTransportWatchdogDisabled(env) {
+  const raw = env ? env.BUILD_GROK_TRANSPORT_WATCHDOG : readRawEnv(BUILD_GROK_TRANSPORT_WATCHDOG);
+  return typeof raw === "string" && raw.trim() === "0";
+}
+function combineAbortSignals(outer, inner) {
+  if (!outer) return inner;
+  if (!inner) return outer;
+  const anyFn = AbortSignal.any;
+  if (typeof anyFn === "function") {
+    return anyFn([outer, inner]);
+  }
+  const controller = new AbortController();
+  const onAbort = () => controller.abort();
+  if (outer.aborted || inner.aborted) {
+    controller.abort();
+  } else {
+    outer.addEventListener("abort", onAbort, { once: true });
+    inner.addEventListener("abort", onAbort, { once: true });
+  }
+  return controller.signal;
+}
+function recordGrokAuthOutcomeBestEffort(result, evidence, env) {
+  void recordAuthOutcome(metadata.id, result, evidence, { env }).catch(() => {
+  });
+}
+function attachGrokDiagnosticsToParsedError(parsedError, grokDiagnostics) {
+  if (parsedError && typeof parsedError === "object" && !Array.isArray(parsedError)) {
+    return {
+      ...parsedError,
+      grokDiagnostics
+    };
+  }
+  return {
+    type: "grok_automation_diagnostics",
+    grokDiagnostics
+  };
+}
+function withGrokDiagnosticsForExecutionError(error, grokDiagnostics) {
+  const hostParsed = parseHostTermination(
+    hostTerminationMetadataFromUnknown(error),
+    error.stderr || error.message,
+    error.exitCode
+  );
+  const parsedError = hostParsed ?? error.parsedError;
+  return new ProviderExecutionError(error.message, {
+    providerName: metadata.id,
+    retryable: hostParsed ? false : error.retryable,
+    exitCode: error.exitCode,
+    statusCode: error.statusCode,
+    reason: error.reason,
+    idleTerminated: error.idleTerminated,
+    signal: error.signal,
+    terminationSource: error.terminationSource,
+    stdout: error.stdout,
+    stderr: error.stderr,
+    // Public fields may be truncated; never re-derive a size from them.
+    streamBytes: { stdout: error.stdoutBytes, stderr: error.stderrBytes },
+    cause: error.cause,
+    prelaunch: error.prelaunch,
+    parsedError: attachGrokDiagnosticsToParsedError(parsedError, {
+      ...grokDiagnostics,
+      failureStage: grokDiagnostics.failureStage ?? "task_execution"
+    })
+  });
+}
+async function writePromptToTempFile(prompt) {
+  const dir = await mkBuildTempDir("grok");
+  const file = path.join(dir, "prompt.txt");
+  await writeFile(file, prompt, "utf8");
+  const cleanup = async () => {
+    try {
+      await rm(dir, { recursive: true, force: true });
+    } catch {
+    }
+  };
+  return { file, cleanup };
+}
+async function runGrokNative(options) {
+  rejectUnsupportedAttachments("grok", options.attachments);
+  const resolvedTimeoutMs = resolveProviderTimeoutMs(metadata.id, options.timeout);
+  await acquireRateLimitToken(metadata.id, options.model);
+  const { command, prefixArgs } = resolveProviderCliCommand(metadata.id);
+  const effectiveEnv = createGrokCliChildEnv(options.env);
+  const hasHeadlessApiKey = hasGrokHeadlessApiKey(effectiveEnv);
+  const allowsBrowserAuth = allowsGrokBrowserAuth(effectiveEnv);
+  const grokDiagnostics = {
+    hasHeadlessApiKey,
+    allowsBrowserAuth,
+    authCache: "not_checked",
+    authPath: hasHeadlessApiKey ? "api_key" : void 0
+  };
+  grokDiagnostics.authPath = hasHeadlessApiKey ? "api_key" : allowsBrowserAuth ? "browser_auth_probe" : "cli_auth_file_probe";
+  const effortLookupModel = options.modelReasoningEffort ? await resolveGrokReasoningEffortLookupModel(options.model, effectiveEnv) : options.model;
+  const reasoningResolution = options.modelReasoningEffort ? resolveReasoningEffort(metadata.id, options.modelReasoningEffort, true, effortLookupModel) : void 0;
+  if (reasoningResolution) {
+    logReasoningEffortResolution(reasoningResolution, metadata.id);
+  }
+  const workspaceModeRequested = options.workspaceMode ?? options.promptMode;
+  const adaptation = adaptPromptForGrok(options.prompt, {
+    executionIntent: options.executionIntent,
+    files: options.files,
+    promptMode: workspaceModeRequested,
+    nativeSubagents: options.nativeSubagents,
+    projectRoot: options.workingDir
+  });
+  const workspaceModeApplied = adaptation.mode;
+  const baselineSnapshot = await captureGitBaseline(options.workingDir).catch(() => null);
+  const { file: promptFile, cleanup } = await writePromptToTempFile(adaptation.adapted);
+  let executionStartMs;
+  let firstOutputMs;
+  let mutationPolicyBoundary;
+  try {
+    const isReadOnlyRun = resolveReadOnlyWorkingDir(options);
+    const envPermissionMode = readGrokBuilderEnvString(options.env, "BUILD_GROK_PERMISSION_MODE");
+    const mayUseDontAsk = options.permissionMode === "dontAsk" || envPermissionMode === "dontAsk" || isReadOnlyRun;
+    const supportsDontAsk = mayUseDontAsk ? await probeGrokDontAskSupport(options.env) : false;
+    const permissionInput = resolveGrokPermissionArgvInput({
+      permissionMode: options.permissionMode,
+      isReadOnlyRun,
+      supportsDontAsk
+    });
+    const grokReasoningEffort = reasoningResolution?.nativeParam === "max" ? void 0 : reasoningResolution?.nativeParam;
+    const { args, redactedValues, resolved } = buildGrokArgv({
+      promptFile,
+      model: options.model,
+      modelReasoningEffort: grokReasoningEffort,
+      env: options.env,
+      resumeSessionId: options.resumeSessionId,
+      // Version-gate only when dontAsk is in play; omit otherwise so non-dontAsk
+      // modes are unaffected by probe failures.
+      ...mayUseDontAsk ? { supportsDontAsk } : {},
+      ...permissionInput
+    });
+    const grokPlainOutputForcesHeadless = resolved.outputFormat === "plain" ? "grok plain output has no JSON terminal envelope for tmux-exec completion; using headless" : void 0;
+    if (!isReadOnlyRun && resolved.permissionMode === "dontAsk") {
+      throwGrokDontAskUnsupportedForEdit(
+        options.permissionMode === "dontAsk" ? "caller options" : "BUILD_GROK_PERMISSION_MODE env var"
+      );
+    }
+    if (grokEditIntentRequiresMutation(options) && !resolved.alwaysApprove && resolved.permissionMode === "default") {
+      throw new ProviderExecutionError(
+        [
+          "[Grok] Edit run cannot proceed with auto-approve disabled.",
+          "Headless edit tool use requires --always-approve (default) or --permission-mode bypassPermissions.",
+          "Unset BUILD_GROK_AUTO_APPROVE / BUILD_GROK_ALWAYS_APPROVE, or set an explicit safe permission mode."
+        ].join(" "),
+        {
+          providerName: metadata.id,
+          retryable: false,
+          reason: "auto_approve_disabled",
+          parsedError: attachGrokDiagnosticsToParsedError(
+            {
+              type: "grok_auto_approve_disabled",
+              message: "Edit run with auto-approve disabled",
+              permissionMode: resolved.permissionMode
+            },
+            { ...grokDiagnostics, failureStage: "pre_execution_probe" }
+          )
+        }
+      );
+    }
+    if (resolved.alwaysApprove) {
+      mutationPolicyBoundary = requireActivePolicyBoundary(
+        "Grok",
+        "Grok automation bypass (--always-approve)",
+        metadata.id,
+        { env: options.env }
+      );
+    }
+    const hasLockedNativeReadOnlyPosture = grokResolvedHasLockedReadOnlyPosture(resolved);
+    if (resolved.permissionMode === "bypassPermissions" || resolved.permissionMode === "acceptEdits" || resolved.permissionMode === "auto" || resolved.permissionMode === "dontAsk" && !hasLockedNativeReadOnlyPosture) {
+      mutationPolicyBoundary = requireActivePolicyBoundary(
+        "Grok",
+        `Grok permission bypass (--permission-mode ${resolved.permissionMode})`,
+        metadata.id,
+        { env: options.env }
+      );
+    }
+    const finalArgs = [...prefixArgs, ...args];
+    const argvRedacted = redactProviderArgv(finalArgs, { promptValues: redactedValues });
+    const grokStreamOutput = shouldStreamGrokOutput(resolved.outputFormat, options.env);
+    const watchdogEnabled = !isGrokTransportWatchdogDisabled(options.env);
+    const requestedExecutionTransport = options.executionTransport ?? (options.nativeSubagents ? "tmux-exec" : void 0);
+    const { execute: executeGrokCommand } = await selectProviderExecutor({
+      provider: metadata.id,
+      requested: requestedExecutionTransport,
+      configured: resolveConfiguredProviderExecutionTransport(metadata.id, options.workingDir).value,
+      env: options.env,
+      executionIntent: options.executionIntent,
+      readOnlyWorkingDir: options.readOnlyWorkingDir,
+      forceHeadlessReason: grokPlainOutputForcesHeadless,
+      headless: executeProviderCommand,
+      onDecision: (decision) => reportTransportDecision(metadata.id, decision, debugLog)
+    });
+    const outputFormatIsJson = resolved.outputFormat === "json" || resolved.outputFormat === "streaming-json";
+    const wantsCompletionSignal = outputFormatIsJson;
+    executionStartMs = Date.now();
+    const retryBudget = options.retryBudget ?? new RetryBudget({ maxTotalAttempts: 6 });
+    const retryResult = await executeWithResilience(
+      async () => {
+        const attemptStartState = await captureWorkspaceRetryState(options.workingDir);
+        const executionTimeoutMs = clampAttemptTimeoutToDeadline(
+          resolvedTimeoutMs,
+          options.deadlineMs,
+          () => new ProviderExecutionError("Grok deadline exceeded before attempt start.", {
+            providerName: metadata.id,
+            retryable: false,
+            reason: "deadline_exhausted"
+          })
+        );
+        firstOutputMs = void 0;
+        let spiralDiagnostics;
+        const watchdogController = new AbortController();
+        const watchdog = watchdogEnabled ? createGrokTransportDeathWatchdog({
+          onSpiralDetected: (diagnostics) => {
+            spiralDiagnostics = diagnostics;
+            watchdogController.abort();
+          }
+        }) : void 0;
+        const combinedAbortSignal = combineAbortSignals(
+          options.abortSignal,
+          watchdog ? watchdogController.signal : void 0
+        );
+        const completionSignal = wantsCompletionSignal ? createGrokTmuxCompletionSignal() : void 0;
+        const authoritativeStdoutParts = [];
+        let authoritativeStdoutBytes = 0;
+        let authoritativeStdoutOverflow = false;
+        const onStdoutChunk = (chunk) => {
+          if (authoritativeStdoutOverflow || !chunk) return;
+          const part = typeof chunk === "string" ? chunk.length === 0 ? Buffer.alloc(0) : Buffer.from(chunk, "utf8") : chunk.byteLength === 0 ? Buffer.alloc(0) : Buffer.from(chunk);
+          if (part.length === 0) return;
+          if (authoritativeStdoutBytes + part.length > GROK_AUTHORITATIVE_STDOUT_CEILING_BYTES) {
+            authoritativeStdoutOverflow = true;
+            return;
+          }
+          authoritativeStdoutParts.push(part);
+          authoritativeStdoutBytes += part.length;
+        };
+        let childResult;
+        try {
+          childResult = await executeGrokCommand({
+            command,
+            args: finalArgs,
+            workingDir: options.workingDir,
+            env: effectiveEnv,
+            timeout: executionTimeoutMs,
+            readOnlyWorkingDir: options.readOnlyWorkingDir,
+            abortSignal: combinedAbortSignal,
+            onData: options.onData,
+            onErrorData: options.onErrorData,
+            onFirstOutput: (timestampMs) => {
+              firstOutputMs ??= timestampMs;
+            },
+            // Compose invoke capture with Grok's authoritative stdout collector.
+            // Watchdog.observe accepts RawChunk and statefully decodes for
+            // pattern matching only; authoritative spool observers still get
+            // exact Buffer bytes via the same compose chain.
+            onStdoutChunk: composeRawChunkObservers(onStdoutChunk, options.onStdoutChunk),
+            onStderrChunk: composeRawChunkObservers(
+              watchdog ? watchdog.observe : void 0,
+              options.onStderrChunk
+            ),
+            ...completionSignal ? {
+              completionSignal,
+              completionSignalGraceMs: TMUX_COMPLETION_SIGNAL_GRACE_MS
+            } : {},
+            idleWarnMs: options.idleWarnMs,
+            idleKillMs: options.idleKillMs,
+            onActivity: options.onActivity,
+            metadata: {
+              id: metadata.id,
+              name: metadata.name,
+              installCommand: metadata.installCommand,
+              authHint: metadata.authHint,
+              docsPath: metadata.docsPath,
+              docsAnchor: metadata.docsAnchor
+            },
+            variantLabel: options.model,
+            ...grokStreamOutput ? {
+              streamOutput: true,
+              formatLine: (line) => formatGrokStreamLineForDisplay(line)
+            } : {}
+          });
+        } catch (error) {
+          if (spiralDiagnostics) {
+            const salvaged = trySalvageCompletedGrokOutput(error, outputFormatIsJson);
+            if (salvaged) {
+              childResult = salvaged;
+            } else {
+              const underlying = error instanceof ProviderExecutionError ? error : void 0;
+              const failureDiagnostics = {
+                ...grokDiagnostics,
+                failureStage: "task_transport_watchdog",
+                probeCategory: "provider_transport_failure",
+                transportCloseCount: spiralDiagnostics.transportCloseCount,
+                postTransportToolErrorCount: spiralDiagnostics.postTransportToolErrorCount
+              };
+              throw new ProviderExecutionError(
+                `[Grok] Worker transport died (Auth(AuthorizationRequired)) and the agent spiraled on ${spiralDiagnostics.postTransportToolErrorCount} tool-output errors; aborted before the turn cap.`,
+                {
+                  providerName: metadata.id,
+                  retryable: false,
+                  reason: "provider_transport_failure",
+                  stdout: underlying?.stdout,
+                  stderr: underlying?.stderr,
+                  exitCode: underlying?.exitCode,
+                  parsedError: attachGrokDiagnosticsToParsedError(void 0, failureDiagnostics)
+                }
+              );
+            }
+          } else {
+            const salvaged = trySalvageCompletedGrokOutput(error, outputFormatIsJson);
+            if (outputFormatIsJson && error instanceof ProviderExecutionError && isTimeoutTerminationReason(error.reason) && salvaged) {
+              childResult = salvaged;
+            } else if (error instanceof ProviderExecutionError && !isTerminationReason(error.reason) && error.terminationSource === void 0 && (error.stdout !== void 0 || error.stderr !== void 0)) {
+              childResult = {
+                stdout: error.stdout ?? "",
+                stderr: error.stderr ?? "",
+                exitCode: error.exitCode ?? 1
+              };
+            } else {
+              if (error instanceof ProviderExecutionError) {
+                const enriched = withGrokDiagnosticsForExecutionError(error, grokDiagnostics);
+                await assertWorkspaceRetryIsSafe({
+                  providerId: metadata.id,
+                  providerName: metadata.name,
+                  workingDir: options.workingDir,
+                  attemptStartState,
+                  originalError: enriched,
+                  retryable: enriched.retryable === true
+                });
+                throw enriched;
+              }
+              await assertWorkspaceRetryIsSafe({
+                providerId: metadata.id,
+                providerName: metadata.name,
+                workingDir: options.workingDir,
+                attemptStartState,
+                originalError: error,
+                retryable: error instanceof ProviderExecutionError && error.retryable === true
+              });
+              throw error;
+            }
+          }
+        }
+        if (authoritativeStdoutOverflow) {
+          const partial = authoritativeStdoutParts.length > 0 ? Buffer.concat(authoritativeStdoutParts).toString("utf8") : "";
+          const displayStdout = childResult.stdout ?? "";
+          throw new ProviderExecutionError(
+            `[Grok] Authoritative stdout capture exceeded ${GROK_AUTHORITATIVE_STDOUT_CEILING_BYTES} bytes; refusing to parse a truncated display tail as success.`,
+            {
+              providerName: metadata.id,
+              retryable: false,
+              reason: "output_truncated",
+              exitCode: typeof childResult.exitCode === "number" ? childResult.exitCode : 1,
+              stdout: partial.length > 0 ? partial : displayStdout,
+              stderr: childResult.stderr ?? "",
+              parsedError: attachGrokDiagnosticsToParsedError(
+                {
+                  type: "grok_output_truncated",
+                  ceilingBytes: GROK_AUTHORITATIVE_STDOUT_CEILING_BYTES
+                },
+                { ...grokDiagnostics, failureStage: "task_execution" }
+              )
+            }
+          );
+        }
+        const authoritativeStdout = authoritativeStdoutParts.length > 0 ? Buffer.concat(authoritativeStdoutParts).toString("utf8") : "";
+        const stdout2 = authoritativeStdout.length > 0 ? authoritativeStdout : childResult.stdout ?? "";
+        const stderr2 = childResult.stderr ?? "";
+        const exitCode2 = typeof childResult.exitCode === "number" ? childResult.exitCode : 1;
+        if (resolved.outputFormat === "plain") {
+          return { stdout: stdout2, stderr: stderr2, exitCode: exitCode2, parsed: void 0 };
+        }
+        const parsed2 = parseGrokOutput(stdout2, stderr2, exitCode2);
+        if (parsed2.type === "error") {
+          const failureDiagnostics = {
+            ...grokDiagnostics,
+            failureStage: "task_execution",
+            probeCategory: parsed2.category
+          };
+          const sandboxHint = parsed2.category === "fs_permission_denied" && isSandboxEnforcementOperational(metadata.name, metadata.id) ? `
+${grokSandboxDenialHint(effectiveEnv)}` : "";
+          const parsedError = new ProviderExecutionError(`[Grok] ${parsed2.message}${sandboxHint}`, {
+            providerName: metadata.id,
+            retryable: grokCategoryToRetryable(parsed2.category),
+            exitCode: exitCode2,
+            statusCode: parsed2.inner?.httpStatus,
+            reason: grokCategoryToReason(parsed2.category),
+            stdout: stdout2,
+            stderr: stderr2,
+            parsedError: attachGrokDiagnosticsToParsedError(parsed2, failureDiagnostics)
+          });
+          await assertWorkspaceRetryIsSafe({
+            providerId: metadata.id,
+            providerName: metadata.name,
+            workingDir: options.workingDir,
+            attemptStartState,
+            originalError: parsedError,
+            retryable: parsedError.retryable === true
+          });
+          throw parsedError;
+        }
+        return { stdout: stdout2, stderr: stderr2, exitCode: exitCode2, parsed: parsed2 };
+      },
+      {
+        providerName: metadata.name,
+        providerId: metadata.id,
+        operation: "execute_prompt",
+        maxAttempts: 3,
+        abortSignal: options.abortSignal,
+        retryBudget,
+        circuitBreakerOptions: DEFAULT_PROVIDER_CIRCUIT_BREAKER_OPTIONS,
+        fastRetryMode: process.env.NODE_ENV === "test" || process.env.VITEST === "true",
+        deadlineMs: options.deadlineMs ?? Date.now() + resolvedTimeoutMs,
+        minimumAttemptTimeMs: Math.min(resolvedTimeoutMs, 3e4),
+        retryWorktreeDir: options.workingDir
+      }
+    );
+    const { stdout, stderr, exitCode, parsed } = retryResult.result;
+    const effectiveExitCode = exitCode ?? 0;
+    const filesModified = await detectGitChangedFiles(options.workingDir, {
+      baselineSnapshot
+    }).catch(() => void 0);
+    await recordRunTiming({
+      model: options.model,
+      requestSizeBytes: measurePromptRequestBytes(adaptation.adapted),
+      resolvedModel: parsed?.type === "success" ? parsed.resolvedModel : void 0,
+      reportedModel: parsed?.type === "success" ? parsed.reportedModel : void 0,
+      startMs: executionStartMs,
+      firstOutputMs,
+      endMs: Date.now(),
+      status: effectiveExitCode === 0 ? "success" : "error",
+      errorCode: effectiveExitCode === 0 ? void 0 : `exit_${effectiveExitCode}`,
+      tokensIn: parsed?.type === "success" ? parsed.tokenUsage?.inputTokens : void 0,
+      tokensOut: parsed?.type === "success" ? parsed.tokenUsage?.outputTokens : void 0,
+      tokenUsage: parsed?.type === "success" ? parsed.tokenUsage : void 0,
+      providerReportedCostUsd: parsed?.type === "success" ? parsed.providerReportedCostUsd : void 0,
+      // The env the CLI was spawned with: attribution ids are resolved from it, and
+      // the caller's map can be a partial one that lacks them.
+      env: effectiveEnv
+    });
+    if (effectiveExitCode === 0) {
+      recordProviderRunSuccess(metadata.id);
+      recordGrokAuthOutcomeBestEffort(
+        "ok",
+        { source: "provider-call", message: "Provider call succeeded" },
+        options.env
+      );
+    } else {
+      recordProviderRunFailure(metadata.id, {
+        severity: "normal",
+        phase: inferProviderFailurePhase({ exitCode: effectiveExitCode, stderr, stdout })
+      });
+    }
+    if (!parsed) {
+      return {
+        stdout,
+        stderr,
+        rawStdout: stdout,
+        rawStderr: stderr,
+        commandPath: command,
+        argvRedacted,
+        stdoutTail: providerOutputTail(stdout),
+        stderrTail: providerOutputTail(stderr),
+        exitCode,
+        requestedReasoningEffort: reasoningResolution?.requestedLevel,
+        effectiveReasoningEffort: reasoningResolution?.resolvedLevel,
+        reasoningEffortOutcome: reasoningResolution?.outcome,
+        workspaceMode: workspaceModeApplied,
+        workspaceModeRequested,
+        promptMode: workspaceModeApplied,
+        promptModeRequested: workspaceModeRequested,
+        promptFingerprint: adaptation.promptFingerprint,
+        finalPromptLength: adaptation.finalPromptLength,
+        completionSignalVariant: adaptation.completionSignalVariant,
+        filesModified,
+        grokDiagnostics,
+        sandboxProvenance: mutationPolicyBoundary?.attestation.provenance,
+        sandboxEvidence: mutationPolicyBoundary?.attestation.evidence
+      };
+    }
+    const stderrWasAuthNoise = parsed.type === "success" && stderr.trim() && isStderrOnlyNoise(stderr);
+    const visibleStdout = parsed.type === "success" ? parsed.text : stdout;
+    const visibleStderr = stderrWasAuthNoise ? "" : stderr;
+    return {
+      stdout: visibleStdout,
+      stderr: visibleStderr,
+      rawStdout: stdout,
+      rawStderr: stderr,
+      commandPath: command,
+      argvRedacted,
+      stdoutTail: providerOutputTail(stdout),
+      stderrTail: providerOutputTail(stderr),
+      sessionId: parsed.type === "success" ? parsed.sessionId : void 0,
+      resolvedModel: parsed.type === "success" ? parsed.resolvedModel : void 0,
+      exitCode,
+      requestedReasoningEffort: reasoningResolution?.requestedLevel,
+      effectiveReasoningEffort: reasoningResolution?.resolvedLevel,
+      reasoningEffortOutcome: reasoningResolution?.outcome,
+      workspaceMode: workspaceModeApplied,
+      workspaceModeRequested,
+      promptMode: workspaceModeApplied,
+      promptModeRequested: workspaceModeRequested,
+      promptFingerprint: adaptation.promptFingerprint,
+      finalPromptLength: adaptation.finalPromptLength,
+      completionSignalVariant: adaptation.completionSignalVariant,
+      tokenUsage: parsed.tokenUsage,
+      ...parsed.type === "success" && parsed.providerReportedCostUsd !== void 0 ? {
+        totalCostUsd: parsed.providerReportedCostUsd,
+        providerReportedCostUsd: parsed.providerReportedCostUsd
+      } : {},
+      servedRoute: metadata.id,
+      filesModified,
+      grokDiagnostics,
+      sandboxProvenance: mutationPolicyBoundary?.attestation.provenance,
+      sandboxEvidence: mutationPolicyBoundary?.attestation.evidence
+    };
+  } catch (error) {
+    if (executionStartMs !== void 0) {
+      await recordRunTiming({
+        model: options.model,
+        requestSizeBytes: measurePromptRequestBytes(adaptation.adapted),
+        startMs: executionStartMs,
+        firstOutputMs,
+        endMs: Date.now(),
+        status: "error",
+        failure: error,
+        env: effectiveEnv
+      });
+    }
+    const reason = error?.reason;
+    if (reason === "auth" || isAuthFailureError(error)) {
+      recordGrokAuthOutcomeBestEffort("failed", authFailureEvidence(error), options.env);
+    }
+    const providerError = error instanceof ProviderExecutionError ? error : void 0;
+    recordProviderRunFailure(metadata.id, {
+      error,
+      severity: reason === "auth" || isAuthFailureError(error) ? "hard" : "normal",
+      phase: inferProviderFailurePhase({
+        error,
+        exitCode: providerError?.exitCode,
+        stderr: providerError?.stderr,
+        stdout: providerError?.stdout
+      })
+    });
+    throw error;
+  } finally {
+    await cleanup();
+  }
+}
+export {
+  resolveGrokPermissionArgvInput,
+  runGrokNative,
+  shouldStreamGrokOutput
+};
+//# sourceMappingURL=runner-KHDNQ5KU.js.map