@jingyi0605/codingns4dsh 0.2.1-beta.12 → 0.2.1-beta.14

package/data/build/dist/host/cli-adapters/grok-driver.js

@@ -1,5 +1,6 @@
 import { runAsyncCommand } from './process-utils.js';
 import { spawn, spawnSync } from 'node:child_process';
+import { lstatSync, readFileSync, realpathSync } from 'node:fs';
 import { randomUUID } from 'node:crypto';
 import { homedir } from 'node:os';
 import { basename, dirname, isAbsolute, join, relative, resolve, sep } from 'node:path';
@@ -9,13 +10,15 @@ import { GROK_CATALOG, isProviderDefaultModel } from './model-catalog.js';
 import { isRegularFile, probeStoredSession, resolveSessionDirectory } from './session-probe.js';
 import { firstToolText, isToolRecord, normalizeToolStatus, serializeToolValue } from './tool-observation.js';
 import { buildAcpPromptBlocks } from './attachment-utils.js';
-import { acpBridgeMcpServers } from '../cli-bridge/injections.js';
+import { acpBridgeMcpServers, bridgeSessionGuidance, subagentBridgeActive, teamBridgeToken } from '../cli-bridge/injections.js';
+import { getSubagentBridge } from '../cli-bridge/bridge-holder.js';
 import { reasoningText } from './reasoning-content.js';
 import { ACP_FORM_CLIENT_CAPABILITIES, acpElicitationResponse, readAcpElicitationRequest } from './acp-elicitation.js';
 import { readAgentQuestions } from './interaction-events.js';
 import { commandEnvironment, WINDOWS } from './process-utils.js';
 import { imageArtifactPathsFromValue, stripImageMarkdown } from '../image-artifact-store.js';
 import { advanceCodingNsSegment, createCodingNsSegmentState, decorateCodingNsSegmentEvent } from './stream-normalizer.js';
+import { GrokContextUsage, GrokPromptUsage } from './grok-usage.js';
 /** Grok Build 的 ACP stdio 驱动。ACP 会话和权限细节只在 Host 进程内处理。 */
 export class GrokBuildDriver {
     descriptor = { id: 'grok', name: 'Grok Build', protocol: 'acp', capabilities: ['models', 'skills', 'stream', 'tool-events', 'reasoning', 'usage', 'permission', 'questions'] };
@@ -24,6 +27,8 @@ export class GrokBuildDriver {
     runSpawnSync;
     runSpawn;
     sessionRoots;
+    modelCachePath;
+    now;
     cachedBinary = null;
     processes = new Set();
     sessions = new Map();
@@ -31,7 +36,9 @@ export class GrokBuildDriver {
         this.binaries = options.binaries ?? ['grok', 'grok-build'];
         this.runSpawnSync = options.spawnSync ?? spawnSync;
         this.runSpawn = options.spawn ?? spawn;
+        this.now = options.now ?? Date.now;
         this.sessionRoots = options.sessionRoots ?? [join(process.env.GROK_HOME ?? join(homedir(), '.grok'), 'sessions')];
+        this.modelCachePath = options.modelCachePath ?? join(process.env.GROK_HOME ?? join(homedir(), '.grok'), 'models_cache.json');
     }
     async detect() {
         const result = await detectBinary({ binaries: this.binaries, spawnSync: this.runSpawnSync });
@@ -43,6 +50,8 @@ export class GrokBuildDriver {
         const command = this.cachedBinary ?? (await this.detect()).command;
         if (command === null)
             return emptyCatalog();
+        const native = this.nativeModels(command);
+        let catalog = GROK_CATALOG;
         const rpc = new JsonRpcProcess({ command, args: ['agent', '--no-leader', 'stdio'], env: grokRuntimeEnvironment(), spawn: this.runSpawn });
         try {
             await rpc.request('initialize', {
@@ -55,14 +64,48 @@ export class GrokBuildDriver {
             rpc.notify('initialized', {});
             const session = await rpc.request('session/new', { cwd: process.cwd(), mcpServers: [] });
             const parsed = parseGrokCatalog(session);
-            return parsed.groups.length > 0 ? parsed : GROK_CATALOG;
+            if (parsed.groups.length > 0)
+                catalog = parsed;
         }
         catch {
-            return GROK_CATALOG;
+            // Retain the compatibility catalog when ACP discovery is unavailable.
         }
         finally {
             rpc.dispose();
         }
+        const listed = await native;
+        if (!listed)
+            return catalog;
+        const existing = new Map(catalog.groups.flatMap(group => group.models).map(model => [model.id, model]));
+        const cached = readGrokModelMetadata(this.modelCachePath);
+        const models = listed.ids.map(id => {
+            const metadata = cached.get(id);
+            return { id, name: existing.get(id)?.name ?? metadata?.name ?? id,
+                efforts: metadata?.efforts ?? existing.get(id)?.efforts ?? [] };
+        });
+        const providerDefault = GROK_CATALOG.groups.flatMap(group => group.models).find(model => model.id === 'provider-default');
+        return { groups: [{ id: 'grok', name: 'Grok', models: [providerDefault, ...models] }], currentModel: listed.current, currentEffort: null };
+    }
+    /** The models command waits for the fetched catalog; session/new may return its bootstrap snapshot. */
+    async nativeModels(command) {
+        try {
+            const result = await runAsyncCommand(this.runSpawnSync, command, ['models'], {
+                cwd: process.cwd(), encoding: 'utf8', timeout: 10_000, maxBuffer: 1024 * 1024,
+                windowsHide: true, shell: WINDOWS, env: grokRuntimeEnvironment(command),
+            });
+            if (result.status !== 0)
+                return undefined;
+            const text = String(result.stdout).replace(/\u001b\[[0-9;]*m/gu, '');
+            const section = text.split('Available models:')[1];
+            if (!section)
+                return undefined;
+            const ids = [...new Set([...section.matchAll(/^\s*[-*]\s+([A-Za-z0-9][A-Za-z0-9._:/-]*)(?:\s+\(default\))?\s*$/gmu)].map(match => match[1]))];
+            const current = text.match(/^Default model:\s*(\S+)\s*$/mu)?.[1] ?? null;
+            return ids.length ? { ids, current: current && ids.includes(current) ? current : null } : undefined;
+        }
+        catch {
+            return undefined;
+        }
     }
     /** Grok 的原生目录同时应用信任、禁用、兼容来源和插件命名规则。 */
     async listSkills(input) {
@@ -114,27 +157,48 @@ export class GrokBuildDriver {
         const segmentState = createCodingNsSegmentState();
         let stepPhase;
         let stepStreamId;
-        const activeTools = new Set();
+        const activeTools = new Map();
+        const streamedToolInputs = new Map();
+        const permissionTools = new Map();
         try {
             if (providerSessionId === '') {
                 const session = await rpc.request('session/new', {
                     cwd: input.cwd ?? process.cwd(),
                     mcpServers: acpBridgeMcpServers(input.sessionId, this.descriptor.id),
-                    ...(!isProviderDefaultModel(input.modelId) ? { model: input.modelId } : {}),
                 }, { signal: input.signal });
                 providerSessionId = readSessionId(session) ?? input.sessionId;
+                state.contextUsage.observe(session);
                 state.providerSessionId = providerSessionId;
                 this.sessions.set(input.sessionId, state);
                 this.sessions.set(providerSessionId, state);
             }
             yield { type: 'session-binding', providerSessionId };
+            // Grok 1.0.52 ignores the model field on session/new. Apply explicit
+            // selections after both creation and restoration, including reused sessions.
+            if (input.modelId && !isProviderDefaultModel(input.modelId)) {
+                const selected = await rpc.request('session/set_model', { sessionId: providerSessionId, modelId: input.modelId }, { signal: input.signal });
+                state.contextUsage.modelId = input.modelId;
+                state.contextUsage.observe(selected);
+            }
+            if (input.effortId) {
+                await rpc.request('session/set_config_option', { sessionId: providerSessionId, configId: 'reasoning_effort', value: input.effortId }, { signal: input.signal });
+            }
             // Skill 斜杠命令由 Grok 在用户输入开头解析，不能把普通提示插到命令前。
             const nativeCommand = /^\s*\/[A-Za-z0-9][A-Za-z0-9._:-]*(?:\s|$)/u.test(input.prompt);
             const prompt = [
                 ...(nativeCommand ? [] : [{ type: 'text', text: GROK_QUESTION_GUIDANCE }]),
+                ...(nativeCommand || !subagentBridgeActive(input.sessionId) ? [] : [{ type: 'text', text: bridgeSessionGuidance(input.sessionId, 'codingns__agent_subagent') }]),
                 ...await buildAcpPromptBlocks(input.prompt, input.attachments ?? []),
             ];
+            const usage = new GrokPromptUsage(promptId, state.contextUsage, this.now);
             stream = streamGrokPrompt(rpc, providerSessionId, promptId, prompt, input.signal, (notification) => {
+                usage.observe(notification);
+                const params = isRecord(notification.params) ? notification.params : {};
+                const update = isRecord(params.update) ? params.update : {};
+                const callId = firstToolText(update.toolCallId, update.tool_call_id);
+                if (callId && update.sessionUpdate === 'tool_call') {
+                    permissionTools.set(callId, { name: firstToolText(update.name, update.title) ?? '', input: update.rawInput });
+                }
                 const elicitation = readAcpElicitationRequest(notification);
                 if (elicitation !== null)
                     state.questions.set(elicitation.requestId, elicitation);
@@ -145,8 +209,12 @@ export class GrokBuildDriver {
                 // 已回答的问题被重新登记。tool_call 可以先显示问题卡并暂存用户答案。
                 const requestId = interactionRequestId(notification);
                 if (requestId !== null && notification.id !== undefined && notification.id !== null)
-                    state.requests.set(requestId, { rpcId: notification.id, ...permissionOptions(notification) });
-            });
+                    state.requests.set(requestId, {
+                        rpcId: notification.id, callId: permissionCallId(notification), ...permissionOptions(notification),
+                        autoApproved: isAdmittedGrokPermission(notification, input, state, permissionTools),
+                    });
+                return usage.takeObservation();
+            }, response => { usage.observeResponse(response); return usage.takeObservation(); });
             let finishResult;
             while (true) {
                 const item = await stream.next();
@@ -154,13 +222,26 @@ export class GrokBuildDriver {
                     finishResult = item.value;
                     break;
                 }
+                if (item.value.codingnsGrokObservation !== undefined)
+                    yield item.value.codingnsGrokObservation;
                 const streamId = grokStreamId(item.value);
-                for (const rawChunk of acpMessageToChunks(item.value)) {
-                    const resolved = rawChunk.type === 'image-artifact'
+                for (const rawChunk of grokToolInputChunks(item.value, streamedToolInputs) ?? acpMessageToChunks(item.value)) {
+                    if (rawChunk.type === 'permission-request' && state.requests.get(rawChunk.requestId)?.autoApproved)
+                        continue;
+                    // Settle native turn accounting once, after the terminal drain. Per-call
+                    // usage is retained by the RPC observer solely for timing and fallback.
+                    if (rawChunk.type === 'usage')
+                        continue;
+                    let resolved = rawChunk.type === 'image-artifact'
                         ? await resolveGrokImageArtifact(rawChunk, state, this.sessionRoots)
                         : rawChunk;
                     if (resolved === null)
                         continue;
+                    if (resolved.type === 'tool-event' && resolved.status === 'failed' && resolved.callId) {
+                        const denial = state.permissionDenials.get(resolved.callId);
+                        if (denial !== undefined)
+                            resolved = { ...resolved, error: denial, output: denial, outputMode: 'snapshot' };
+                    }
                     const chunk = decorateCodingNsSegmentEvent(resolved, input, segmentState, this.descriptor.id);
                     if (chunk.type === 'question-request' && state.grokQuestionCallIds.has(chunk.requestId)) {
                         if (state.grokQuestionEventIds.has(chunk.requestId))
@@ -189,7 +270,7 @@ export class GrokBuildDriver {
                         if (chunk.status === 'completed' || chunk.status === 'failed')
                             activeTools.delete(callId);
                         else
-                            activeTools.add(callId);
+                            activeTools.set(callId, chunk.toolName === 'tool' ? activeTools.get(callId) ?? chunk.toolName : chunk.toolName);
                     }
                     yield chunk;
                     advanceCodingNsSegment(chunk, segmentState);
@@ -197,7 +278,30 @@ export class GrokBuildDriver {
                         segmentState.segment += 1;
                 }
             }
-            reusable = finishResult.reason !== 'cancel' && !input.signal?.aborted;
+            const settledUsage = usage.finish();
+            if (settledUsage !== undefined) {
+                const { requestPerformance: _observed, ...accounting } = settledUsage;
+                yield accounting;
+            }
+            if (finishResult.failure?.code === 'PERMISSION_DENIED') {
+                const denial = [...state.permissionDenials.values()].at(-1);
+                if (denial !== undefined)
+                    finishResult = { ...finishResult, failure: { message: denial, code: 'PERMISSION_DENIED' } };
+            }
+            // A normal prompt stop does not confirm pending tool execution. Keep the
+            // observed arguments and make the unknown outcome explicit without retrying.
+            if (activeTools.size > 0) {
+                for (const [callId, toolName] of activeTools) {
+                    const error = 'Grok ended the turn without reporting a final result for this tool; its outcome is unconfirmed.';
+                    yield decorateCodingNsSegmentEvent({ type: 'tool-event', callId, toolName, status: 'failed', error, output: error, outputMode: 'snapshot' }, input, segmentState, this.descriptor.id);
+                }
+                if (finishResult.reason === 'stop')
+                    finishResult = {
+                        reason: 'error',
+                        failure: { message: 'Grok ended the turn before all tool results were confirmed.', code: 'INCOMPLETE_TOOL_RESULT' },
+                    };
+            }
+            reusable = finishResult.reason === 'stop' && !input.signal?.aborted;
             yield { type: 'finish', reason: finishResult.reason, ...(finishResult.failure === undefined ? {} : { failure: finishResult.failure }) };
         }
         finally {
@@ -213,7 +317,8 @@ export class GrokBuildDriver {
             state.grokQuestionEventIds.clear();
             state.questions.clear();
             state.requests.clear();
-            if (stream !== undefined && !reusable) {
+            state.permissionDenials.clear();
+            if (!reusable) {
                 // An abandoned prompt can keep producing updates without prompt metadata.
                 // Reload its persisted session on a fresh transport before accepting new input.
                 await rpc.disposeAndWait();
@@ -230,7 +335,10 @@ export class GrokBuildDriver {
             throw new Error('The Grok permission request does not exist');
         state.requests.delete(response.requestId);
         const optionId = response.approved ? pending.allowOptionId : pending.rejectOptionId;
-        state.rpc.respond(pending.rpcId, { outcome: { outcome: 'selected', optionId } });
+        if (!response.approved || optionId === undefined) {
+            state.permissionDenials.set(pending.callId ?? response.requestId, response.reason ?? (response.approved ? 'Grok did not offer a one-time approval option.' : 'Grok tool execution was denied.'));
+        }
+        state.rpc.respond(pending.rpcId, { outcome: optionId === undefined ? { outcome: 'cancelled' } : { outcome: 'selected', optionId } });
     }
     respondQuestion(sessionId, response) {
         const state = this.sessions.get(sessionId);
@@ -252,33 +360,53 @@ export class GrokBuildDriver {
     dispose() { for (const process of this.processes)
         process.dispose(); this.processes.clear(); this.sessions.clear(); this.cachedBinary = null; }
     async getSession(input, command) {
+        const alwaysApprove = input.permission?.sandboxMode === 'danger-full-access' && input.permission.approvalPolicy === 'never';
         const previous = this.sessions.get(input.sessionId);
-        if (previous !== undefined && previous.cwd === input.cwd && !previous.rpc.isClosed)
+        const teamToken = teamBridgeToken(input.sessionId);
+        const bridgeToken = getSubagentBridge()?.token;
+        if (previous !== undefined && previous.cwd === input.cwd && previous.alwaysApprove === alwaysApprove && previous.teamToken === teamToken && previous.bridgeToken === bridgeToken && !previous.rpc.isClosed)
             return previous;
         if (previous !== undefined) {
             await previous.rpc.disposeAndWait();
             this.processes.delete(previous.rpc);
         }
         const resumeId = input.providerSessionId ?? (previous?.cwd === input.cwd ? previous?.providerSessionId : undefined);
-        const rpc = new JsonRpcProcess({ command, args: ['agent', '--no-leader', 'stdio'], cwd: input.cwd, env: grokRuntimeEnvironment(), spawn: this.runSpawn });
+        const rpc = new JsonRpcProcess({ command, args: ['agent', '--no-leader', ...(alwaysApprove ? ['--always-approve'] : []), 'stdio'], cwd: input.cwd, env: grokRuntimeEnvironment(), spawn: this.runSpawn });
         this.processes.add(rpc);
-        const state = { rpc, cwd: input.cwd, rawStoreRef: input.rawStoreRef, providerSessionId: '', requests: new Map(), questions: new Map(), grokQuestions: new Map(), grokQuestionCallIds: new Set(), grokQuestionEventIds: new Set() };
-        await rpc.request('initialize', {
+        const state = { teamToken, bridgeToken, rpc, contextUsage: new GrokContextUsage(), cwd: input.cwd, rawStoreRef: input.rawStoreRef, alwaysApprove, providerSessionId: '', requests: new Map(), permissionDenials: new Map(), questions: new Map(), grokQuestions: new Map(), grokQuestionCallIds: new Set(), grokQuestionEventIds: new Set() };
+        rpc.addNotificationListener(message => {
+            const params = isRecord(message.params) ? message.params : {};
+            const owner = state.providerSessionId || resumeId;
+            if (owner && typeof params.sessionId === 'string' && params.sessionId !== owner)
+                return;
+            state.contextUsage.observe(message);
+        });
+        const initialized = await rpc.request('initialize', {
             protocolVersion: 1,
             clientInfo: { name: 'codingns4dsh', version: '0.1.1' },
             // 旧版 Grok 读取 capabilities；标准 ACP 读取 clientCapabilities。
             capabilities: ACP_FORM_CLIENT_CAPABILITIES,
             clientCapabilities: ACP_FORM_CLIENT_CAPABILITIES,
         });
+        state.contextUsage.observe(initialized);
         rpc.notify('initialized', {});
         if (resumeId) {
             try {
                 const loaded = await rpc.request('session/load', { sessionId: resumeId, cwd: input.cwd ?? process.cwd(), mcpServers: acpBridgeMcpServers(input.sessionId, this.descriptor.id) });
+                state.contextUsage.observe(loaded);
                 state.providerSessionId = readSessionId(loaded) ?? resumeId;
             }
-            catch { /* 旧版 ACP 没有 load，下一轮在同一进程创建新会话 */ }
+            catch (error) {
+                if (teamToken) {
+                    rpc.dispose();
+                    this.processes.delete(rpc);
+                    throw error;
+                }
+                // Ordinary legacy ACP sessions keep their existing new-session fallback.
+            }
         }
-        // ACP 权限是 Grok 发起的 server request，先挂起响应，待标准权限入口明确回复原始 id。
+        // Admitted file/bridge requests retain existing authority. Other requests
+        // wait for native approval using the original RPC id.
         rpc.setServerRequestHandler((message) => {
             const elicitation = readAcpElicitationRequest(message);
             if (elicitation !== null) {
@@ -303,7 +431,11 @@ export class GrokBuildDriver {
             const requestId = interactionRequestId(message);
             if (requestId === null || message.id === undefined || message.id === null)
                 return { outcome: { outcome: 'cancelled' } };
-            state.requests.set(requestId, { rpcId: message.id, ...permissionOptions(message) });
+            const pending = state.requests.get(requestId);
+            if (pending?.autoApproved && pending.allowOptionId !== undefined) {
+                return { outcome: { outcome: 'selected', optionId: pending.allowOptionId } };
+            }
+            state.requests.set(requestId, { rpcId: message.id, callId: permissionCallId(message), ...permissionOptions(message) });
             return new Promise(() => undefined);
         });
         this.sessions.set(input.sessionId, state);
@@ -326,6 +458,7 @@ const GROK_QUESTION_GUIDANCE = [
     '<codingns_host_capabilities>',
     'The DSH host provides Grok Build\'s built-in ask_user_question tool. It displays a native question card and returns the user\'s structured answer.',
     'ask_user_question is a grok_build built-in tool and does not depend on an MCP server. MCP connection notices only describe the MCP servers listed in the prompt.',
+    'Use the built-in read/read_file tool to inspect files. Shell commands may require approval even when workspace file writes are already allowed; do not replace a file read with a shell command.',
     'When the user explicitly asks to use a question component, or when a question card is needed to collect a choice, call ask_user_question directly, wait for the user\'s answer, and then continue.',
     '</codingns_host_capabilities>',
 ].join('\n');
@@ -333,7 +466,7 @@ const GROK_QUESTION_GUIDANCE = [
  * Grok 可能先返回 prompt 响应，再补发最后一批 session/update。
  * 响应或终态任一先到都会启动固定排空窗口，窗口内的文本和错误仍会被消费。
  */
-async function* streamGrokPrompt(rpc, sessionId, promptId, prompt, signal, onNotification) {
+async function* streamGrokPrompt(rpc, sessionId, promptId, prompt, signal, onNotification, onResponse) {
     const queue = [];
     const requestController = new AbortController();
     let wake;
@@ -350,8 +483,8 @@ async function* streamGrokPrompt(rpc, sessionId, promptId, prompt, signal, onNot
     const listener = (message) => {
         if (!isGrokPromptMessage(message, sessionId, promptId))
             return;
-        queue.push(message);
-        onNotification(message);
+        const observation = onNotification(message);
+        queue.push(observation === undefined ? message : { ...message, codingnsGrokObservation: observation });
         const notificationReason = grokNotificationReason(message);
         if (notificationReason === null) {
             notify();
@@ -383,9 +516,15 @@ async function* streamGrokPrompt(rpc, sessionId, promptId, prompt, signal, onNot
             prompt,
             _meta: { promptId },
         }, { signal: requestController.signal, killOnAbort: false }).then((response) => {
+            if (signal?.aborted)
+                return;
+            const observation = onResponse(response);
+            if (observation !== undefined)
+                queue.push({ method: 'codingns/grok-observation', codingnsGrokObservation: observation });
             const responseReason = grokPromptReason(response);
             if (responseReason !== null)
                 terminalReason = mergeGrokReason(terminalReason, responseReason);
+            failure ??= grokPermissionFailure(response);
             beginDrain();
         }, () => {
             if (requestController.signal.aborted)
@@ -436,9 +575,43 @@ function isGrokPromptMessage(message, sessionId, promptId) {
         return false;
     const update = isRecord(params.update) ? params.update : params;
     const meta = isRecord(params._meta) ? params._meta : {};
+    if (meta.isReplay === true)
+        return false;
     const owner = firstToolText(update.prompt_id, update.promptId, meta.promptId);
     return owner === undefined || owner === promptId;
 }
+function grokToolInputChunks(message, inputs) {
+    const params = isRecord(message.params) ? message.params : message;
+    const update = isRecord(params.update) ? params.update : params;
+    if (update.sessionUpdate !== 'tool_call_delta_chunk' || !Number.isInteger(update.tool_index))
+        return null;
+    const index = update.tool_index;
+    const callId = firstToolText(update.tool_call_id, update.toolCallId);
+    // Argument fragments omit the call id; a new id resets a reused model-call index.
+    let pending = inputs.get(index);
+    const started = callId !== undefined && pending?.callId !== callId;
+    if (started) {
+        pending = { callId, toolName: firstToolText(update.name, update.title) ?? 'tool', arguments: '' };
+        inputs.set(index, pending);
+    }
+    if (pending === undefined)
+        return [];
+    if (typeof update.arguments_delta === 'string')
+        pending.arguments += update.arguments_delta;
+    let input;
+    try {
+        const parsed = JSON.parse(pending.arguments);
+        if (isRecord(parsed))
+            input = JSON.stringify(parsed);
+    }
+    catch { /* Do not persist incomplete JSON as a tool's final arguments. */ }
+    if (!started && input === undefined)
+        return [];
+    return [{
+            type: 'tool-event', callId: pending.callId, toolName: pending.toolName, status: 'running',
+            ...(input === undefined ? {} : { input }),
+        }];
+}
 function grokPromptReason(value) {
     if (!isRecord(value))
         return null;
@@ -446,9 +619,15 @@ function grokPromptReason(value) {
     if (reason === undefined)
         return null;
     if (reason === 'cancelled' || reason === 'canceled')
-        return 'cancel';
+        return grokPermissionFailure(value) === undefined ? 'cancel' : 'error';
     return reason === 'error' || reason === 'failed' ? 'error' : 'stop';
 }
+function grokPermissionFailure(value) {
+    if (!isRecord(value) || !isRecord(value._meta) || value._meta.cancellationCategory !== 'PermissionRejected')
+        return undefined;
+    const context = isRecord(value._meta.cancellationContext) ? value._meta.cancellationContext : {};
+    return { message: firstToolText(context.reason) ?? 'Grok tool execution was denied.', code: 'PERMISSION_DENIED' };
+}
 function mergeGrokReason(current, next) {
     if (current === 'error' || next === 'error')
         return 'error';
@@ -466,13 +645,18 @@ function grokNotificationReason(message) {
             : '';
     if (['turn_error', 'turn_failed', 'error', 'failed'].includes(type))
         return 'error';
-    if (['turn_completed', 'turn_complete', 'prompt_complete', 'completed', 'done'].includes(type))
-        return grokPromptReason(update) ?? 'stop';
+    if (['turn_completed', 'turn_complete', 'prompt_complete', 'completed', 'done'].includes(type)) {
+        const reason = grokPromptReason(update) ?? 'stop';
+        return reason === 'cancel' && grokPermissionFailure(params) !== undefined ? 'error' : reason;
+    }
     return null;
 }
 function grokFailure(message) {
     const params = isRecord(message.params) ? message.params : message;
     const update = isRecord(params.update) ? params.update : params;
+    const permissionFailure = grokPermissionFailure(update) ?? grokPermissionFailure(params);
+    if (permissionFailure !== undefined)
+        return permissionFailure;
     const error = isRecord(update.error) ? update.error : update;
     const detail = firstToolText(error.message, error.errorMessage, error.error_message, error.detail, error.reason);
     if (detail === undefined)
@@ -622,13 +806,19 @@ function acpMessageToChunks(message) {
         if (!name && !callId)
             return [];
         const input = serializeToolValue(tool.rawInput ?? tool.input ?? tool.arguments ?? tool.args ?? update.rawInput);
-        const output = serializeToolValue(tool.rawOutput ?? tool.output ?? tool.result ?? update.rawOutput);
+        // ACP tool results can contain nested text blocks without a rawOutput field.
+        const content = tool.content ?? update.content;
+        const contentText = Array.isArray(content)
+            ? content.flatMap((block) => isRecord(block) ? textValue(block.content ?? block) ?? [] : []).join('\n') || undefined
+            : undefined;
+        const rawOutput = serializeToolValue(tool.rawOutput ?? tool.output ?? tool.result ?? update.rawOutput);
+        const output = rawOutput ?? contentText;
         const error = serializeToolValue(tool.error ?? update.error);
         const agentId = firstToolText(tool.agentId, tool.agent_id, update.agentId, update.agent_id);
         const detail = serializeToolValue(tool.detail ?? update.detail ?? update.content);
         const fallback = error !== undefined || type.includes('error') || type.includes('fail')
             ? 'failed'
-            : output !== undefined || type.includes('result') || type.includes('complete')
+            : rawOutput !== undefined || type.includes('result') || type.includes('complete')
                 ? 'completed'
                 : 'running';
         return [...imageEvents, {
@@ -675,6 +865,99 @@ function containedPath(root, child) {
     const outside = relative(base, candidate);
     return outside === '' || outside === '..' || outside.startsWith(`..${sep}`) || isAbsolute(outside) ? [] : [candidate];
 }
+/** Admit existing file/bridge authority; shells and unknown requests retain native approval. */
+function isAdmittedGrokPermission(message, input, state, tools) {
+    if (message.method !== 'session/request_permission' || input.plan === true)
+        return false;
+    const mode = input.permission?.sandboxMode;
+    if (mode !== 'workspace-write' && mode !== 'danger-full-access')
+        return false;
+    const params = isRecord(message.params) ? message.params : {};
+    const tool = isToolRecord(params.toolCall) ? params.toolCall : {};
+    const metadata = isRecord(params._meta) ? params._meta : {};
+    if (metadata.risk !== undefined || tool.risk !== undefined)
+        return false;
+    // Never substitute a persistent grant or invent an option absent from the request.
+    if (!Array.isArray(params.options) || !params.options.some(option => isRecord(option)
+        && firstToolText(option.kind, option.type)?.toLowerCase() === 'allow_once'
+        && firstToolText(option.optionId, option.option_id, option.id) !== undefined))
+        return false;
+    const observed = tools.get(permissionCallId(message) ?? '');
+    // Titles become human-readable labels such as "Write `/path`". Keep the
+    // canonical identity from the matching call, while MCP wrappers name their
+    // inner bridge tool in the permission request itself.
+    const title = firstToolText(tool.title);
+    const bridgeTitle = title === 'codingns__agent_team' || title === 'codingns__agent_subagent' ? title : undefined;
+    const name = firstToolText(tool.name, tool.toolName, tool.tool_name) ?? bridgeTitle ?? observed?.name ?? title;
+    if (name === 'codingns__agent_team')
+        return Boolean(state.teamToken && teamBridgeToken(input.sessionId) === state.teamToken);
+    if (name === 'codingns__agent_subagent')
+        return Boolean(!state.teamToken && state.bridgeToken && getSubagentBridge()?.token === state.bridgeToken);
+    if (name !== 'write' && name !== 'edit')
+        return false;
+    if (observed && observed.name !== name)
+        return false;
+    const raw = tool.rawInput ?? observed?.input;
+    if (!isRecord(raw))
+        return false;
+    const paths = ['file_path', 'target_file', 'path'].flatMap(key => raw[key] === undefined ? [] : [raw[key]]);
+    if (!paths.length || paths.some(path => typeof path !== 'string' || !path.trim() || path.includes('\0')))
+        return false;
+    if (!input.cwd || !isAbsolute(input.cwd))
+        return false;
+    const root = canonicalGrokPath(input.cwd);
+    if (!root)
+        return false;
+    return paths.every(path => {
+        // Keep dot segments until realpath resolves existing symlink ancestors.
+        const target = canonicalGrokPath(isAbsolute(path) ? path : `${input.cwd}${sep}${path}`);
+        if (!target)
+            return false;
+        const outside = relative(root, target);
+        return mode === 'danger-full-access' || outside !== '' && outside !== '..' && !outside.startsWith(`..${sep}`) && !isAbsolute(outside);
+    });
+}
+/** Resolve existing ancestors, rejecting broken links and non-missing filesystem errors. */
+function canonicalGrokPath(path) {
+    const suffix = [];
+    let current = path;
+    for (;;) {
+        try {
+            lstatSync(current);
+        }
+        catch (error) {
+            if (error.code !== 'ENOENT' || dirname(current) === current)
+                return undefined;
+            suffix.unshift(basename(current));
+            current = dirname(current);
+            continue;
+        }
+        try {
+            return resolve(realpathSync.native(current), ...suffix);
+        }
+        catch {
+            return undefined;
+        }
+    }
+}
+/** Cache metadata enriches only IDs admitted by the native CLI's filtered list. */
+function readGrokModelMetadata(path) {
+    const result = new Map();
+    try {
+        const value = JSON.parse(readFileSync(path, 'utf8'));
+        if (!isRecord(value) || !isRecord(value.models))
+            return result;
+        for (const entry of Object.values(value.models)) {
+            if (!isRecord(entry) || !isRecord(entry.info) || typeof entry.info.id !== 'string')
+                continue;
+            const info = entry.info;
+            const efforts = Array.isArray(info.reasoning_efforts) ? info.reasoning_efforts.flatMap(effort => typeof effort === 'string' ? [effort] : isRecord(effort) && typeof effort.id === 'string' ? [effort.id] : []) : [];
+            result.set(info.id, { name: typeof info.name === 'string' ? info.name : info.id, efforts });
+        }
+    }
+    catch { /* Metadata is optional and never adds selectable model IDs. */ }
+    return result;
+}
 function permissionRequestId(message) {
     const params = isRecord(message.params) ? message.params : message;
     const update = isRecord(params.update) ? params.update : params;
@@ -687,6 +970,12 @@ function permissionRequestId(message) {
 function interactionRequestId(message) {
     return permissionRequestId(message);
 }
+function permissionCallId(message) {
+    const params = isRecord(message.params) ? message.params : message;
+    const update = isRecord(params.update) ? params.update : params;
+    const tool = isRecord(update.toolCall) ? update.toolCall : isRecord(update.tool_call) ? update.tool_call : update;
+    return firstToolText(tool.toolCallId, tool.tool_call_id, tool.callId, tool.call_id);
+}
 function permissionOptions(message) {
     const params = isRecord(message.params) ? message.params : {};
     const options = Array.isArray(params.options) ? params.options : [];
@@ -698,9 +987,17 @@ function permissionOptions(message) {
             return [];
         return [{ id, kind: firstToolText(option.kind, option.type)?.toLowerCase() ?? '' }];
     });
+    if (ids.length === 0)
+        return { allowOptionId: 'allow-once', rejectOptionId: 'reject-once' };
+    // Grok lists allow_always before allow_once. A DSH one-time approval must
+    // never become a persistent grant merely because of provider option order.
     return {
-        allowOptionId: ids.find((option) => /allow|approve|accept/u.test(option.kind))?.id ?? ids[0]?.id ?? 'allow-once',
-        rejectOptionId: ids.find((option) => /reject|deny|decline|cancel/u.test(option.kind))?.id ?? ids[1]?.id ?? 'reject-once',
+        allowOptionId: ids.find((option) => option.kind === 'allow_once')?.id
+            ?? ids.find((option) => /^(allow|approve|accept)$/u.test(option.kind))?.id
+            ?? (ids[0]?.kind === '' ? ids[0].id : undefined),
+        rejectOptionId: ids.find((option) => option.kind === 'reject_once')?.id
+            ?? ids.find((option) => /^(reject|deny|decline|cancel)$/u.test(option.kind))?.id
+            ?? (ids[1]?.kind === '' ? ids[1].id : undefined),
     };
 }
 function readSessionId(value) {