@jingyi0605/codingns4dsh 0.2.1-beta.8 → 0.2.1-rc.2

package/data/build/dist/host/cli-adapters/grok-driver.js

@@ -1,25 +1,34 @@
 import { runAsyncCommand } from './process-utils.js';
 import { spawn, spawnSync } from 'node:child_process';
+import { lstatSync, readFileSync, realpathSync } from 'node:fs';
+import { randomUUID } from 'node:crypto';
 import { homedir } from 'node:os';
-import { basename, join } from 'node:path';
+import { basename, dirname, isAbsolute, join, relative, resolve, sep } from 'node:path';
 import { JsonRpcProcess } from './json-rpc-process.js';
 import { detectBinary, emptyCatalog, isRecord, textValue, usageChunk } from './rpc-driver-utils.js';
 import { GROK_CATALOG, isProviderDefaultModel } from './model-catalog.js';
 import { isRegularFile, probeStoredSession, resolveSessionDirectory } from './session-probe.js';
 import { firstToolText, isToolRecord, normalizeToolStatus, serializeToolValue } from './tool-observation.js';
 import { buildAcpPromptBlocks } from './attachment-utils.js';
-import { acpBridgeMcpServers } from '../cli-bridge/injections.js';
+import { acpBridgeMcpServers, bridgeSessionGuidance, subagentBridgeActive, teamBridgeToken } from '../cli-bridge/injections.js';
+import { getSubagentBridge } from '../cli-bridge/bridge-holder.js';
 import { reasoningText } from './reasoning-content.js';
 import { ACP_FORM_CLIENT_CAPABILITIES, acpElicitationResponse, readAcpElicitationRequest } from './acp-elicitation.js';
 import { readAgentQuestions } from './interaction-events.js';
 import { commandEnvironment, WINDOWS } from './process-utils.js';
+import { imageArtifactPathsFromValue, stripImageMarkdown } from '../image-artifact-store.js';
+import { advanceCodingNsSegment, createCodingNsSegmentState, decorateCodingNsSegmentEvent } from './stream-normalizer.js';
+import { GrokContextUsage, GrokPromptUsage } from './grok-usage.js';
 /** Grok Build 的 ACP stdio 驱动。ACP 会话和权限细节只在 Host 进程内处理。 */
 export class GrokBuildDriver {
     descriptor = { id: 'grok', name: 'Grok Build', protocol: 'acp', capabilities: ['models', 'skills', 'stream', 'tool-events', 'reasoning', 'usage', 'permission', 'questions'] };
+    supportsStreamStepSplitting = true;
     binaries;
     runSpawnSync;
     runSpawn;
     sessionRoots;
+    modelCachePath;
+    now;
     cachedBinary = null;
     processes = new Set();
     sessions = new Map();
@@ -27,7 +36,9 @@ export class GrokBuildDriver {
         this.binaries = options.binaries ?? ['grok', 'grok-build'];
         this.runSpawnSync = options.spawnSync ?? spawnSync;
         this.runSpawn = options.spawn ?? spawn;
+        this.now = options.now ?? Date.now;
         this.sessionRoots = options.sessionRoots ?? [join(process.env.GROK_HOME ?? join(homedir(), '.grok'), 'sessions')];
+        this.modelCachePath = options.modelCachePath ?? join(process.env.GROK_HOME ?? join(homedir(), '.grok'), 'models_cache.json');
     }
     async detect() {
         const result = await detectBinary({ binaries: this.binaries, spawnSync: this.runSpawnSync });
@@ -39,7 +50,9 @@ export class GrokBuildDriver {
         const command = this.cachedBinary ?? (await this.detect()).command;
         if (command === null)
             return emptyCatalog();
-        const rpc = new JsonRpcProcess({ command, args: ['agent', '--no-leader', 'stdio'], spawn: this.runSpawn });
+        const native = this.nativeModels(command);
+        let catalog = GROK_CATALOG;
+        const rpc = new JsonRpcProcess({ command, args: ['agent', '--no-leader', 'stdio'], env: grokRuntimeEnvironment(), spawn: this.runSpawn });
         try {
             await rpc.request('initialize', {
                 protocolVersion: 1,
@@ -51,19 +64,53 @@ export class GrokBuildDriver {
             rpc.notify('initialized', {});
             const session = await rpc.request('session/new', { cwd: process.cwd(), mcpServers: [] });
             const parsed = parseGrokCatalog(session);
-            return parsed.groups.length > 0 ? parsed : GROK_CATALOG;
+            if (parsed.groups.length > 0)
+                catalog = parsed;
         }
         catch {
-            return GROK_CATALOG;
+            // Retain the compatibility catalog when ACP discovery is unavailable.
         }
         finally {
             rpc.dispose();
         }
+        const listed = await native;
+        if (!listed)
+            return catalog;
+        const existing = new Map(catalog.groups.flatMap(group => group.models).map(model => [model.id, model]));
+        const cached = readGrokModelMetadata(this.modelCachePath);
+        const models = listed.ids.map(id => {
+            const metadata = cached.get(id);
+            return { id, name: existing.get(id)?.name ?? metadata?.name ?? id,
+                efforts: metadata?.efforts ?? existing.get(id)?.efforts ?? [] };
+        });
+        const providerDefault = GROK_CATALOG.groups.flatMap(group => group.models).find(model => model.id === 'provider-default');
+        return { groups: [{ id: 'grok', name: 'Grok', models: [providerDefault, ...models] }], currentModel: listed.current, currentEffort: null };
+    }
+    /** The models command waits for the fetched catalog; session/new may return its bootstrap snapshot. */
+    async nativeModels(command) {
+        try {
+            const result = await runAsyncCommand(this.runSpawnSync, command, ['models'], {
+                cwd: process.cwd(), encoding: 'utf8', timeout: 10_000, maxBuffer: 1024 * 1024,
+                windowsHide: true, shell: WINDOWS, env: grokRuntimeEnvironment(command),
+            });
+            if (result.status !== 0)
+                return undefined;
+            const text = String(result.stdout).replace(/\u001b\[[0-9;]*m/gu, '');
+            const section = text.split('Available models:')[1];
+            if (!section)
+                return undefined;
+            const ids = [...new Set([...section.matchAll(/^\s*[-*]\s+([A-Za-z0-9][A-Za-z0-9._:/-]*)(?:\s+\(default\))?\s*$/gmu)].map(match => match[1]))];
+            const current = text.match(/^Default model:\s*(\S+)\s*$/mu)?.[1] ?? null;
+            return ids.length ? { ids, current: current && ids.includes(current) ? current : null } : undefined;
+        }
+        catch {
+            return undefined;
+        }
     }
     /** Grok 的原生目录同时应用信任、禁用、兼容来源和插件命名规则。 */
     async listSkills(input) {
         if (input.signal?.aborted)
-            throw new Error('Skill 目录读取已取消');
+            throw new Error('Skill catalog loading was canceled');
         const cwd = input.cwd?.trim() || process.cwd();
         const command = this.cachedBinary ?? (await this.detect()).command;
         if (command !== null) {
@@ -75,7 +122,7 @@ export class GrokBuildDriver {
                     maxBuffer: 8 * 1024 * 1024,
                     windowsHide: true,
                     shell: WINDOWS,
-                    env: commandEnvironment(command),
+                    env: grokRuntimeEnvironment(command),
                 });
                 if (result.status === 0) {
                     const catalog = parseGrokSkillCatalog(`${result.stdout ?? ''}`);
@@ -100,31 +147,58 @@ export class GrokBuildDriver {
     async *executeTurn(input) {
         const command = this.cachedBinary ?? (await this.detect()).command;
         if (command === null)
-            throw new Error('Grok Build 未安装');
+            throw new Error('Grok Build is not installed');
         const state = await this.getSession(input, command);
         const rpc = state.rpc;
         let providerSessionId = state.providerSessionId;
         let stream;
+        let reusable = false;
+        const promptId = randomUUID();
+        const segmentState = createCodingNsSegmentState();
+        let stepPhase;
+        let stepStreamId;
+        const activeTools = new Map();
+        const streamedToolInputs = new Map();
+        const permissionTools = new Map();
         try {
             if (providerSessionId === '') {
                 const session = await rpc.request('session/new', {
                     cwd: input.cwd ?? process.cwd(),
                     mcpServers: acpBridgeMcpServers(input.sessionId, this.descriptor.id),
-                    ...(!isProviderDefaultModel(input.modelId) ? { model: input.modelId } : {}),
                 }, { signal: input.signal });
                 providerSessionId = readSessionId(session) ?? input.sessionId;
+                state.contextUsage.observe(session);
                 state.providerSessionId = providerSessionId;
                 this.sessions.set(input.sessionId, state);
                 this.sessions.set(providerSessionId, state);
             }
             yield { type: 'session-binding', providerSessionId };
+            // Grok 1.0.52 ignores the model field on session/new. Apply explicit
+            // selections after both creation and restoration, including reused sessions.
+            if (input.modelId && !isProviderDefaultModel(input.modelId)) {
+                const selected = await rpc.request('session/set_model', { sessionId: providerSessionId, modelId: input.modelId }, { signal: input.signal });
+                state.contextUsage.modelId = input.modelId;
+                state.contextUsage.observe(selected);
+            }
+            if (input.effortId) {
+                await rpc.request('session/set_config_option', { sessionId: providerSessionId, configId: 'reasoning_effort', value: input.effortId }, { signal: input.signal });
+            }
             // Skill 斜杠命令由 Grok 在用户输入开头解析，不能把普通提示插到命令前。
             const nativeCommand = /^\s*\/[A-Za-z0-9][A-Za-z0-9._:-]*(?:\s|$)/u.test(input.prompt);
             const prompt = [
                 ...(nativeCommand ? [] : [{ type: 'text', text: GROK_QUESTION_GUIDANCE }]),
+                ...(nativeCommand || !subagentBridgeActive(input.sessionId) ? [] : [{ type: 'text', text: bridgeSessionGuidance(input.sessionId, 'codingns__agent_subagent') }]),
                 ...await buildAcpPromptBlocks(input.prompt, input.attachments ?? []),
             ];
-            stream = streamGrokPrompt(rpc, providerSessionId, prompt, input.signal, (notification) => {
+            const usage = new GrokPromptUsage(promptId, state.contextUsage, this.now);
+            stream = streamGrokPrompt(rpc, providerSessionId, promptId, prompt, input.signal, (notification) => {
+                usage.observe(notification);
+                const params = isRecord(notification.params) ? notification.params : {};
+                const update = isRecord(params.update) ? params.update : {};
+                const callId = firstToolText(update.toolCallId, update.tool_call_id);
+                if (callId && update.sessionUpdate === 'tool_call') {
+                    permissionTools.set(callId, { name: firstToolText(update.name, update.title) ?? '', input: update.rawInput });
+                }
                 const elicitation = readAcpElicitationRequest(notification);
                 if (elicitation !== null)
                     state.questions.set(elicitation.requestId, elicitation);
@@ -135,8 +209,12 @@ export class GrokBuildDriver {
                 // 已回答的问题被重新登记。tool_call 可以先显示问题卡并暂存用户答案。
                 const requestId = interactionRequestId(notification);
                 if (requestId !== null && notification.id !== undefined && notification.id !== null)
-                    state.requests.set(requestId, { rpcId: notification.id, ...permissionOptions(notification) });
-            });
+                    state.requests.set(requestId, {
+                        rpcId: notification.id, callId: permissionCallId(notification), ...permissionOptions(notification),
+                        autoApproved: isAdmittedGrokPermission(notification, input, state, permissionTools),
+                    });
+                return usage.takeObservation();
+            }, response => { usage.observeResponse(response); return usage.takeObservation(); });
             let finishResult;
             while (true) {
                 const item = await stream.next();
@@ -144,26 +222,86 @@ export class GrokBuildDriver {
                     finishResult = item.value;
                     break;
                 }
-                const chunk = acpMessageToChunk(item.value);
-                if (chunk === null)
-                    continue;
-                if (chunk.type === 'question-request' && state.grokQuestionCallIds.has(chunk.requestId)) {
-                    if (state.grokQuestionEventIds.has(chunk.requestId))
+                if (item.value.codingnsGrokObservation !== undefined)
+                    yield item.value.codingnsGrokObservation;
+                const streamId = grokStreamId(item.value);
+                for (const rawChunk of grokToolInputChunks(item.value, streamedToolInputs) ?? acpMessageToChunks(item.value)) {
+                    if (rawChunk.type === 'permission-request' && state.requests.get(rawChunk.requestId)?.autoApproved)
                         continue;
-                    state.grokQuestionEventIds.add(chunk.requestId);
+                    // Settle native turn accounting once, after the terminal drain. Per-call
+                    // usage is retained by the RPC observer solely for timing and fallback.
+                    if (rawChunk.type === 'usage')
+                        continue;
+                    let resolved = rawChunk.type === 'image-artifact'
+                        ? await resolveGrokImageArtifact(rawChunk, state, this.sessionRoots)
+                        : rawChunk;
+                    if (resolved === null)
+                        continue;
+                    if (resolved.type === 'tool-event' && resolved.status === 'failed' && resolved.callId) {
+                        const denial = state.permissionDenials.get(resolved.callId);
+                        if (denial !== undefined)
+                            resolved = { ...resolved, error: denial, output: denial, outputMode: 'snapshot' };
+                    }
+                    const chunk = decorateCodingNsSegmentEvent(resolved, input, segmentState, this.descriptor.id);
+                    if (chunk.type === 'question-request' && state.grokQuestionCallIds.has(chunk.requestId)) {
+                        if (state.grokQuestionEventIds.has(chunk.requestId))
+                            continue;
+                        state.grokQuestionEventIds.add(chunk.requestId);
+                    }
+                    // 问题的 tool_call_update 只是同一次交互的生命周期回声，不能再生成普通
+                    // 工具记录，否则历史里会重新出现空参数或重复的问题调用。
+                    if (chunk.type === 'tool-event' && chunk.callId !== undefined && state.grokQuestionCallIds.has(chunk.callId))
+                        continue;
+                    const phase = grokStepPhase(chunk);
+                    if (phase !== undefined) {
+                        // DSH persists assistant content only at step settlement. End the content
+                        // step before native tools are appended, and keep unfinished parallel calls
+                        // together so their results cannot be finalized by an intermediate step.
+                        if (input.splitToolSteps && stepPhase !== undefined && activeTools.size === 0
+                            && (phase !== stepPhase || (streamId !== undefined && stepStreamId !== undefined && streamId !== stepStreamId))) {
+                            yield { type: 'step-boundary' };
+                        }
+                        stepPhase = phase;
+                        if (streamId !== undefined)
+                            stepStreamId = streamId;
+                    }
+                    if (chunk.type === 'tool-event') {
+                        const callId = chunk.callId ?? chunk.toolName;
+                        if (chunk.status === 'completed' || chunk.status === 'failed')
+                            activeTools.delete(callId);
+                        else
+                            activeTools.set(callId, chunk.toolName === 'tool' ? activeTools.get(callId) ?? chunk.toolName : chunk.toolName);
+                    }
+                    yield chunk;
+                    advanceCodingNsSegment(chunk, segmentState);
+                    if (chunk.type === 'question-request')
+                        segmentState.segment += 1;
                 }
-                // 问题的 tool_call_update 只是同一次交互的生命周期回声，不能再生成普通
-                // 工具记录，否则历史里会重新出现空参数或重复的问题调用。
-                if (chunk.type === 'tool-event' && chunk.callId !== undefined && state.grokQuestionCallIds.has(chunk.callId))
-                    continue;
-                yield chunk;
             }
-            if (finishResult.reason === 'cancel') {
-                try {
-                    await rpc.request('session/cancel', { sessionId: providerSessionId }, { killOnAbort: false });
+            const settledUsage = usage.finish();
+            if (settledUsage !== undefined) {
+                const { requestPerformance: _observed, ...accounting } = settledUsage;
+                yield accounting;
+            }
+            if (finishResult.failure?.code === 'PERMISSION_DENIED') {
+                const denial = [...state.permissionDenials.values()].at(-1);
+                if (denial !== undefined)
+                    finishResult = { ...finishResult, failure: { message: denial, code: 'PERMISSION_DENIED' } };
+            }
+            // A normal prompt stop does not confirm pending tool execution. Keep the
+            // observed arguments and make the unknown outcome explicit without retrying.
+            if (activeTools.size > 0) {
+                for (const [callId, toolName] of activeTools) {
+                    const error = 'Grok ended the turn without reporting a final result for this tool; its outcome is unconfirmed.';
+                    yield decorateCodingNsSegmentEvent({ type: 'tool-event', callId, toolName, status: 'failed', error, output: error, outputMode: 'snapshot' }, input, segmentState, this.descriptor.id);
                 }
-                catch { /* 不同 ACP 版本的取消方法可能不同，请求级取消已经先行发出。 */ }
+                if (finishResult.reason === 'stop')
+                    finishResult = {
+                        reason: 'error',
+                        failure: { message: 'Grok ended the turn before all tool results were confirmed.', code: 'INCOMPLETE_TOOL_RESULT' },
+                    };
             }
+            reusable = finishResult.reason === 'stop' && !input.signal?.aborted;
             yield { type: 'finish', reason: finishResult.reason, ...(finishResult.failure === undefined ? {} : { failure: finishResult.failure }) };
         }
         finally {
@@ -177,19 +315,30 @@ export class GrokBuildDriver {
             state.grokQuestions.clear();
             state.grokQuestionCallIds.clear();
             state.grokQuestionEventIds.clear();
-            // ACP 进程和会话跨轮复用，统一由 dispose() 回收。
+            state.questions.clear();
+            state.requests.clear();
+            state.permissionDenials.clear();
+            if (!reusable) {
+                // An abandoned prompt can keep producing updates without prompt metadata.
+                // Reload its persisted session on a fresh transport before accepting new input.
+                await rpc.disposeAndWait();
+                this.processes.delete(rpc);
+            }
         }
     }
     respondPermission(sessionId, response) {
         const state = this.sessions.get(sessionId);
         if (state === undefined)
-            throw new Error('Grok 权限请求已结束');
+            throw new Error('The Grok permission request has ended');
         const pending = state.requests.get(response.requestId);
         if (pending === undefined)
-            throw new Error('Grok 权限请求不存在');
+            throw new Error('The Grok permission request does not exist');
         state.requests.delete(response.requestId);
         const optionId = response.approved ? pending.allowOptionId : pending.rejectOptionId;
-        state.rpc.respond(pending.rpcId, { outcome: { outcome: 'selected', optionId } });
+        if (!response.approved || optionId === undefined) {
+            state.permissionDenials.set(pending.callId ?? response.requestId, response.reason ?? (response.approved ? 'Grok did not offer a one-time approval option.' : 'Grok tool execution was denied.'));
+        }
+        state.rpc.respond(pending.rpcId, { outcome: optionId === undefined ? { outcome: 'cancelled' } : { outcome: 'selected', optionId } });
     }
     respondQuestion(sessionId, response) {
         const state = this.sessions.get(sessionId);
@@ -204,36 +353,60 @@ export class GrokBuildDriver {
         }
         const elicitation = state?.questions.get(response.requestId);
         if (state === undefined || elicitation === undefined)
-            throw new Error('Grok 问题请求不存在');
+            throw new Error('The Grok question request does not exist');
         state.questions.delete(response.requestId);
         state.rpc.respond(elicitation.rpcId, acpElicitationResponse(elicitation, response));
     }
     dispose() { for (const process of this.processes)
         process.dispose(); this.processes.clear(); this.sessions.clear(); this.cachedBinary = null; }
     async getSession(input, command) {
+        const alwaysApprove = input.permission?.sandboxMode === 'danger-full-access' && input.permission.approvalPolicy === 'never';
         const previous = this.sessions.get(input.sessionId);
-        if (previous !== undefined && previous.cwd === input.cwd)
+        const teamToken = teamBridgeToken(input.sessionId);
+        const bridgeToken = getSubagentBridge()?.token;
+        if (previous !== undefined && previous.cwd === input.cwd && previous.alwaysApprove === alwaysApprove && previous.teamToken === teamToken && previous.bridgeToken === bridgeToken && !previous.rpc.isClosed)
             return previous;
-        previous?.rpc.dispose();
-        const rpc = new JsonRpcProcess({ command, args: ['agent', '--no-leader', 'stdio'], cwd: input.cwd, spawn: this.runSpawn });
+        if (previous !== undefined) {
+            await previous.rpc.disposeAndWait();
+            this.processes.delete(previous.rpc);
+        }
+        const resumeId = input.providerSessionId ?? (previous?.cwd === input.cwd ? previous?.providerSessionId : undefined);
+        const rpc = new JsonRpcProcess({ command, args: ['agent', '--no-leader', ...(alwaysApprove ? ['--always-approve'] : []), 'stdio'], cwd: input.cwd, env: grokRuntimeEnvironment(), spawn: this.runSpawn });
         this.processes.add(rpc);
-        const state = { rpc, cwd: input.cwd, providerSessionId: '', requests: new Map(), questions: new Map(), grokQuestions: new Map(), grokQuestionCallIds: new Set(), grokQuestionEventIds: new Set() };
-        await rpc.request('initialize', {
+        const state = { teamToken, bridgeToken, rpc, contextUsage: new GrokContextUsage(), cwd: input.cwd, rawStoreRef: input.rawStoreRef, alwaysApprove, providerSessionId: '', requests: new Map(), permissionDenials: new Map(), questions: new Map(), grokQuestions: new Map(), grokQuestionCallIds: new Set(), grokQuestionEventIds: new Set() };
+        rpc.addNotificationListener(message => {
+            const params = isRecord(message.params) ? message.params : {};
+            const owner = state.providerSessionId || resumeId;
+            if (owner && typeof params.sessionId === 'string' && params.sessionId !== owner)
+                return;
+            state.contextUsage.observe(message);
+        });
+        const initialized = await rpc.request('initialize', {
             protocolVersion: 1,
             clientInfo: { name: 'codingns4dsh', version: '0.1.1' },
             // 旧版 Grok 读取 capabilities；标准 ACP 读取 clientCapabilities。
             capabilities: ACP_FORM_CLIENT_CAPABILITIES,
             clientCapabilities: ACP_FORM_CLIENT_CAPABILITIES,
         });
+        state.contextUsage.observe(initialized);
         rpc.notify('initialized', {});
-        if (input.providerSessionId) {
+        if (resumeId) {
             try {
-                const loaded = await rpc.request('session/load', { sessionId: input.providerSessionId, cwd: input.cwd ?? process.cwd(), mcpServers: acpBridgeMcpServers(input.sessionId, this.descriptor.id) });
-                state.providerSessionId = readSessionId(loaded) ?? input.providerSessionId;
+                const loaded = await rpc.request('session/load', { sessionId: resumeId, cwd: input.cwd ?? process.cwd(), mcpServers: acpBridgeMcpServers(input.sessionId, this.descriptor.id) });
+                state.contextUsage.observe(loaded);
+                state.providerSessionId = readSessionId(loaded) ?? resumeId;
+            }
+            catch (error) {
+                if (teamToken) {
+                    rpc.dispose();
+                    this.processes.delete(rpc);
+                    throw error;
+                }
+                // Ordinary legacy ACP sessions keep their existing new-session fallback.
             }
-            catch { /* 旧版 ACP 没有 load，下一轮在同一进程创建新会话 */ }
         }
-        // ACP 权限是 Grok 发起的 server request，先挂起响应，待标准权限入口明确回复原始 id。
+        // Admitted file/bridge requests retain existing authority. Other requests
+        // wait for native approval using the original RPC id.
         rpc.setServerRequestHandler((message) => {
             const elicitation = readAcpElicitationRequest(message);
             if (elicitation !== null) {
@@ -258,7 +431,11 @@ export class GrokBuildDriver {
             const requestId = interactionRequestId(message);
             if (requestId === null || message.id === undefined || message.id === null)
                 return { outcome: { outcome: 'cancelled' } };
-            state.requests.set(requestId, { rpcId: message.id, ...permissionOptions(message) });
+            const pending = state.requests.get(requestId);
+            if (pending?.autoApproved && pending.allowOptionId !== undefined) {
+                return { outcome: { outcome: 'selected', optionId: pending.allowOptionId } };
+            }
+            state.requests.set(requestId, { rpcId: message.id, callId: permissionCallId(message), ...permissionOptions(message) });
             return new Promise(() => undefined);
         });
         this.sessions.set(input.sessionId, state);
@@ -268,25 +445,35 @@ export class GrokBuildDriver {
     }
 }
 const GROK_DRAIN_WAIT_MS = 250;
+/**
+ * Grok 会默认兼容加载 `~/.claude/Claude.md`。CodingNS 已经有自己的会话规则，
+ * 外部 Agent 不应继承 Claude 的全局语言偏好或其他宿主专属指令。
+ */
+function grokRuntimeEnvironment(command) {
+    const base = command === undefined ? process.env : commandEnvironment(command);
+    return { ...base, GROK_CLAUDE_AGENTS_ENABLED: '0' };
+}
 /** 内建提问与 MCP 的连接状态无关，宿主能力说明必须随每轮请求一起传递。 */
 const GROK_QUESTION_GUIDANCE = [
     '<codingns_host_capabilities>',
-    'DSH 宿主支持 Grok Build 内建 ask_user_question 工具，会显示原生问题卡并回传用户的结构化回答。',
-    'ask_user_question 属于 grok_build 内建工具，不依赖 MCP 服务器；MCP 正在连接的提示只影响提示中列出的 MCP 服务器。',
-    '当用户明确要求使用提问组件，或需要通过问题卡收集用户选择时，请直接调用 ask_user_question 并等待用户回答，再继续验证或处理答案。',
+    'The DSH host provides Grok Build\'s built-in ask_user_question tool. It displays a native question card and returns the user\'s structured answer.',
+    'ask_user_question is a grok_build built-in tool and does not depend on an MCP server. MCP connection notices only describe the MCP servers listed in the prompt.',
+    'Use the built-in read/read_file tool to inspect files. Shell commands may require approval even when workspace file writes are already allowed; do not replace a file read with a shell command.',
+    'When the user explicitly asks to use a question component, or when a question card is needed to collect a choice, call ask_user_question directly, wait for the user\'s answer, and then continue.',
     '</codingns_host_capabilities>',
 ].join('\n');
 /**
  * Grok 可能先返回 prompt 响应，再补发最后一批 session/update。
  * 响应或终态任一先到都会启动固定排空窗口，窗口内的文本和错误仍会被消费。
  */
-async function* streamGrokPrompt(rpc, sessionId, prompt, signal, onNotification) {
+async function* streamGrokPrompt(rpc, sessionId, promptId, prompt, signal, onNotification, onResponse) {
     const queue = [];
     const requestController = new AbortController();
     let wake;
     let drainDeadline = null;
     let terminalReason = null;
     let failure;
+    let completed = false;
     const notify = () => { wake?.(); wake = undefined; };
     const beginDrain = () => {
         if (drainDeadline === null)
@@ -294,8 +481,10 @@ async function* streamGrokPrompt(rpc, sessionId, prompt, signal, onNotification)
         notify();
     };
     const listener = (message) => {
-        queue.push(message);
-        onNotification(message);
+        if (!isGrokPromptMessage(message, sessionId, promptId))
+            return;
+        const observation = onNotification(message);
+        queue.push(observation === undefined ? message : { ...message, codingnsGrokObservation: observation });
         const notificationReason = grokNotificationReason(message);
         if (notificationReason === null) {
             notify();
@@ -307,8 +496,6 @@ async function* streamGrokPrompt(rpc, sessionId, prompt, signal, onNotification)
             if (detail !== undefined)
                 failure = detail;
         }
-        // 部分 Grok 版本只发终态通知而不回复 prompt，主动取消可清理待处理请求。
-        requestController.abort();
         beginDrain();
     };
     const removeListener = rpc.addNotificationListener(listener);
@@ -323,19 +510,29 @@ async function* streamGrokPrompt(rpc, sessionId, prompt, signal, onNotification)
         onAbort();
     else
         signal?.addEventListener('abort', onAbort, { once: true });
-    void rpc.request('session/prompt', {
-        sessionId,
-        prompt,
-    }, { signal: requestController.signal, killOnAbort: false }).then((response) => {
-        const responseReason = grokPromptReason(response);
-        if (responseReason !== null)
-            terminalReason = mergeGrokReason(terminalReason, responseReason);
-        beginDrain();
-    }, () => {
-        if (terminalReason === null)
-            terminalReason = signal?.aborted ? 'cancel' : 'error';
-        beginDrain();
-    });
+    if (!signal?.aborted)
+        void rpc.request('session/prompt', {
+            sessionId,
+            prompt,
+            _meta: { promptId },
+        }, { signal: requestController.signal, killOnAbort: false }).then((response) => {
+            if (signal?.aborted)
+                return;
+            const observation = onResponse(response);
+            if (observation !== undefined)
+                queue.push({ method: 'codingns/grok-observation', codingnsGrokObservation: observation });
+            const responseReason = grokPromptReason(response);
+            if (responseReason !== null)
+                terminalReason = mergeGrokReason(terminalReason, responseReason);
+            failure ??= grokPermissionFailure(response);
+            beginDrain();
+        }, () => {
+            if (requestController.signal.aborted)
+                return;
+            if (terminalReason === null)
+                terminalReason = signal?.aborted ? 'cancel' : 'error';
+            beginDrain();
+        });
     try {
         while (true) {
             if (queue.length > 0) {
@@ -355,18 +552,81 @@ async function* streamGrokPrompt(rpc, sessionId, prompt, signal, onNotification)
             ]);
             wake = undefined;
         }
+        completed = true;
         return { reason: terminalReason ?? 'stop', ...(failure === undefined ? {} : { failure }) };
     }
     finally {
         signal?.removeEventListener('abort', onAbort);
         removeListener();
+        if (!completed || signal?.aborted) {
+            // ACP cancellation is a notification; waiting for an RPC response can hang.
+            try {
+                rpc.notify('session/cancel', { sessionId });
+            }
+            catch { /* The process may already have exited. */ }
+        }
+        // Terminal-only providers and consumers that close the iterator both need cleanup.
+        requestController.abort();
     }
 }
+function isGrokPromptMessage(message, sessionId, promptId) {
+    const params = isRecord(message.params) ? message.params : message;
+    if (typeof params.sessionId === 'string' && params.sessionId !== sessionId)
+        return false;
+    const update = isRecord(params.update) ? params.update : params;
+    const meta = isRecord(params._meta) ? params._meta : {};
+    if (meta.isReplay === true)
+        return false;
+    const owner = firstToolText(update.prompt_id, update.promptId, meta.promptId);
+    return owner === undefined || owner === promptId;
+}
+function grokToolInputChunks(message, inputs) {
+    const params = isRecord(message.params) ? message.params : message;
+    const update = isRecord(params.update) ? params.update : params;
+    if (update.sessionUpdate !== 'tool_call_delta_chunk' || !Number.isInteger(update.tool_index))
+        return null;
+    const index = update.tool_index;
+    const callId = firstToolText(update.tool_call_id, update.toolCallId);
+    // Argument fragments omit the call id; a new id resets a reused model-call index.
+    let pending = inputs.get(index);
+    const started = callId !== undefined && pending?.callId !== callId;
+    if (started) {
+        pending = { callId, toolName: firstToolText(update.name, update.title) ?? 'tool', arguments: '' };
+        inputs.set(index, pending);
+    }
+    if (pending === undefined)
+        return [];
+    if (typeof update.arguments_delta === 'string')
+        pending.arguments += update.arguments_delta;
+    let input;
+    try {
+        const parsed = JSON.parse(pending.arguments);
+        if (isRecord(parsed))
+            input = JSON.stringify(parsed);
+    }
+    catch { /* Do not persist incomplete JSON as a tool's final arguments. */ }
+    if (!started && input === undefined)
+        return [];
+    return [{
+            type: 'tool-event', callId: pending.callId, toolName: pending.toolName, status: 'running',
+            ...(input === undefined ? {} : { input }),
+        }];
+}
 function grokPromptReason(value) {
-    if (!isRecord(value) || typeof value.stopReason !== 'string')
+    if (!isRecord(value))
+        return null;
+    const reason = firstToolText(value.stopReason, value.stop_reason)?.toLowerCase();
+    if (reason === undefined)
         return null;
-    const reason = value.stopReason.toLowerCase();
-    return reason === 'cancelled' || reason === 'error' || reason === 'failed' ? 'error' : 'stop';
+    if (reason === 'cancelled' || reason === 'canceled')
+        return grokPermissionFailure(value) === undefined ? 'cancel' : 'error';
+    return reason === 'error' || reason === 'failed' ? 'error' : 'stop';
+}
+function grokPermissionFailure(value) {
+    if (!isRecord(value) || !isRecord(value._meta) || value._meta.cancellationCategory !== 'PermissionRejected')
+        return undefined;
+    const context = isRecord(value._meta.cancellationContext) ? value._meta.cancellationContext : {};
+    return { message: firstToolText(context.reason) ?? 'Grok tool execution was denied.', code: 'PERMISSION_DENIED' };
 }
 function mergeGrokReason(current, next) {
     if (current === 'error' || next === 'error')
@@ -383,15 +643,20 @@ function grokNotificationReason(message) {
         : typeof update.type === 'string'
             ? update.type.toLowerCase()
             : '';
-    if (type.includes('error') || type.includes('failed'))
+    if (['turn_error', 'turn_failed', 'error', 'failed'].includes(type))
         return 'error';
-    if (type.includes('turn_completed') || type.includes('turn_complete') || type === 'completed' || type === 'done')
-        return 'stop';
+    if (['turn_completed', 'turn_complete', 'prompt_complete', 'completed', 'done'].includes(type)) {
+        const reason = grokPromptReason(update) ?? 'stop';
+        return reason === 'cancel' && grokPermissionFailure(params) !== undefined ? 'error' : reason;
+    }
     return null;
 }
 function grokFailure(message) {
     const params = isRecord(message.params) ? message.params : message;
     const update = isRecord(params.update) ? params.update : params;
+    const permissionFailure = grokPermissionFailure(update) ?? grokPermissionFailure(params);
+    if (permissionFailure !== undefined)
+        return permissionFailure;
     const error = isRecord(update.error) ? update.error : update;
     const detail = firstToolText(error.message, error.errorMessage, error.error_message, error.detail, error.reason);
     if (detail === undefined)
@@ -468,63 +733,244 @@ function grokQuestionResponse(pending, response) {
         ...(Object.keys(annotations).length === 0 ? {} : { annotations }),
     };
 }
-function acpMessageToChunk(message) {
+function grokStreamId(message) {
+    const params = isRecord(message.params) ? message.params : message;
+    const meta = isRecord(params._meta) ? params._meta : {};
+    return typeof meta.streamStartMs === 'number' && Number.isFinite(meta.streamStartMs)
+        ? `grok-stream-${meta.streamStartMs}` : undefined;
+}
+function grokStepPhase(event) {
+    switch (event.type) {
+        case 'text-delta':
+        case 'reasoning-delta': return event.text.length > 0 ? 'message' : undefined;
+        case 'image-artifact': return 'message';
+        case 'tool-event':
+        case 'question-request':
+        case 'permission-request': return 'tools';
+        default: return undefined;
+    }
+}
+function acpMessageToChunks(message) {
     const params = isRecord(message.params) ? message.params : message;
     const update = isRecord(params.update) ? params.update : params;
     const type = (typeof update.sessionUpdate === 'string' ? update.sessionUpdate : typeof update.type === 'string' ? update.type : typeof message.method === 'string' ? message.method : '').toLowerCase();
     const elicitation = readAcpElicitationRequest(message);
     if (elicitation !== null)
-        return { type: 'question-request', requestId: elicitation.requestId, questions: elicitation.questions };
+        return [{ type: 'question-request', requestId: elicitation.requestId, questions: elicitation.questions }];
     const grokQuestion = readGrokQuestionTool(message) ?? readGrokQuestionRequest(message);
     if (grokQuestion !== null)
-        return { type: 'question-request', requestId: grokQuestion.callId, callId: grokQuestion.callId, questions: grokQuestion.questions };
+        return [{ type: 'question-request', requestId: grokQuestion.callId, callId: grokQuestion.callId, questions: grokQuestion.questions }];
+    const text = textValue(update.delta ?? update.text ?? update.content ?? update.message ?? update.detail);
+    const artifactPaths = [
+        update.rawOutput,
+        update.raw_output,
+        update.output,
+        update.result,
+        update.image,
+        update.images,
+        update.content,
+        update.file,
+        update.files,
+    ].flatMap((value) => imageArtifactPathsFromValue(value));
+    const markdownPaths = imageArtifactPathsFromValue(text ?? '');
+    const imagePaths = [...new Set([...artifactPaths, ...markdownPaths])];
+    const imageEvents = imagePaths.map((path) => ({ type: 'image-artifact', path }));
+    // Grok identifies each model call independently of the enclosing user prompt.
+    const messageId = grokStreamId(message);
+    const identity = messageId === undefined ? {} : { messageId };
     const reasoning = reasoningText(update);
     if (reasoning !== null)
-        return { type: 'reasoning-delta', text: reasoning };
-    const text = textValue(update.delta ?? update.text ?? update.content ?? update.message ?? update.detail);
+        return [...imageEvents, { type: 'reasoning-delta', text: reasoning, ...identity }];
     if (type.includes('permission')) {
         const requestId = permissionRequestId(message) ?? (typeof update.requestId === 'string' ? update.requestId : typeof update.id === 'string' ? update.id : null);
         if (requestId !== null) {
             const tool = isToolRecord(update.toolCall) ? update.toolCall : isToolRecord(update.tool_call) ? update.tool_call : update;
             const toolName = firstToolText(tool.title, tool.name, tool.toolName, tool.tool_name, update.toolName);
             const callId = firstToolText(tool.toolCallId, tool.tool_call_id, tool.callId, tool.call_id, update.callId, update.call_id);
-            return { type: 'permission-request', requestId, kind: typeof update.kind === 'string' ? update.kind : toolName ?? 'unknown', ...(toolName ? { toolName } : {}), ...(callId ? { callId } : {}), ...(text ? { detail: text } : {}) };
+            return [{ type: 'permission-request', requestId, kind: typeof update.kind === 'string' ? update.kind : toolName ?? 'unknown', ...(toolName ? { toolName } : {}), ...(callId ? { callId } : {}), ...(text ? { detail: text } : {}) }];
         }
     }
-    if (type.includes('agent_message') || type.includes('text') || type === 'message')
-        return text ? { type: 'text-delta', text } : null;
+    if (type.includes('agent_message') || type.includes('text') || type === 'message') {
+        const visible = text === null ? '' : stripImageMarkdown(text, markdownPaths);
+        const textEvent = visible === '' ? undefined : { type: 'text-delta', text: visible, ...identity };
+        return [...imageEvents, ...(textEvent === undefined ? [] : [textEvent])];
+    }
+    if (type.includes('image') || type.includes('artifact') || type.includes('generated'))
+        return imageEvents;
     if (type.includes('thought') || type.includes('reason'))
-        return text ? { type: 'reasoning-delta', text } : null;
+        return text ? [{ type: 'reasoning-delta', text, ...identity }] : [];
     if (type.includes('tool') || type.includes('command')) {
         const tool = isToolRecord(update.toolCall) ? update.toolCall : isToolRecord(update.tool_call) ? update.tool_call : update;
-        const name = firstToolText(tool.name, tool.toolName, tool.tool_name, tool.title, update.name, update.toolName, update.title);
+        const meta = isToolRecord(tool._meta) ? tool._meta : isToolRecord(update._meta) ? update._meta : {};
+        const xaiTool = isToolRecord(meta['x.ai/tool']) ? meta['x.ai/tool'] : undefined;
+        // Grok changes title to a display label such as Edit `path` while the call
+        // is running. Its structured name must survive until native persistence.
+        const name = firstToolText(tool.name, tool.toolName, tool.tool_name, xaiTool?.name, update.name, update.toolName, tool.title, update.title);
         const callId = firstToolText(tool.callId, tool.call_id, tool.toolCallId, tool.tool_call_id, tool.id, update.toolCallId, update.tool_call_id, update.id);
         if (!name && !callId)
-            return null;
+            return [];
         const input = serializeToolValue(tool.rawInput ?? tool.input ?? tool.arguments ?? tool.args ?? update.rawInput);
-        const output = serializeToolValue(tool.rawOutput ?? tool.output ?? tool.result ?? update.rawOutput);
+        // ACP tool results can contain nested text blocks without a rawOutput field.
+        const content = tool.content ?? update.content;
+        const contentText = Array.isArray(content)
+            ? content.flatMap((block) => isRecord(block) ? textValue(block.content ?? block) ?? [] : []).join('\n') || undefined
+            : undefined;
+        const rawOutput = serializeToolValue(tool.rawOutput ?? tool.output ?? tool.result ?? update.rawOutput);
+        const output = rawOutput ?? contentText;
         const error = serializeToolValue(tool.error ?? update.error);
         const agentId = firstToolText(tool.agentId, tool.agent_id, update.agentId, update.agent_id);
         const detail = serializeToolValue(tool.detail ?? update.detail ?? update.content);
         const fallback = error !== undefined || type.includes('error') || type.includes('fail')
             ? 'failed'
-            : output !== undefined || type.includes('result') || type.includes('complete')
+            : rawOutput !== undefined || type.includes('result') || type.includes('complete')
                 ? 'completed'
                 : 'running';
-        return {
-            type: 'tool-event',
-            toolName: name ?? 'tool',
-            status: normalizeToolStatus(tool.status ?? tool.state ?? update.status, fallback),
-            ...(callId ? { callId } : {}),
-            ...(input !== undefined ? { input } : {}),
-            ...(output !== undefined ? { output } : {}),
-            ...(output !== undefined ? { outputMode: type.toLowerCase().includes('delta') ? 'delta' : 'snapshot' } : {}),
-            ...(error !== undefined ? { error } : {}),
-            ...(agentId ? { agentId } : {}),
-            ...(detail !== undefined ? { detail } : {}),
-        };
+        return [...imageEvents, {
+                type: 'tool-event',
+                toolName: name ?? 'tool',
+                status: normalizeToolStatus(tool.status ?? tool.state ?? update.status, fallback),
+                ...(callId ? { callId } : {}),
+                ...(input !== undefined ? { input } : {}),
+                ...(output !== undefined ? { output } : {}),
+                ...(output !== undefined ? { outputMode: type.toLowerCase().includes('delta') ? 'delta' : 'snapshot' } : {}),
+                ...(error !== undefined ? { error } : {}),
+                ...(agentId ? { agentId } : {}),
+                ...(detail !== undefined ? { detail } : {}),
+            }];
+    }
+    const usage = usageChunk(update);
+    return usage === null ? imageEvents : [...imageEvents, usage];
+}
+async function resolveGrokImageArtifact(artifact, state, roots) {
+    const raw = artifact.path?.trim();
+    if (raw === undefined || raw === '')
+        return artifact.data === undefined ? null : artifact;
+    const candidates = isAbsolute(raw)
+        ? [raw]
+        : [
+            ...(state.rawStoreRef === undefined ? [] : containedPath(state.rawStoreRef, raw)),
+            ...(state.rawStoreRef === undefined ? [] : containedPath(dirname(state.rawStoreRef), raw)),
+            ...roots.flatMap((root) => containedPath(root, join(state.providerSessionId, raw))),
+            ...roots.flatMap((root) => containedPath(root, raw)),
+            ...(state.cwd === undefined ? [] : containedPath(state.cwd, raw)),
+        ];
+    for (const candidate of candidates) {
+        try {
+            if (await isRegularFile(candidate))
+                return { ...artifact, path: candidate };
+        }
+        catch { /* Provider 可能只在另一处保存产物，继续尝试受控候选。 */ }
+    }
+    return null;
+}
+function containedPath(root, child) {
+    const base = resolve(root);
+    const candidate = resolve(base, child);
+    const outside = relative(base, candidate);
+    return outside === '' || outside === '..' || outside.startsWith(`..${sep}`) || isAbsolute(outside) ? [] : [candidate];
+}
+function isAdmittedGrokFileMutation(name) {
+    const key = name.trim().toLowerCase().replace(/[\s-]+/gu, '_');
+    return ['write', 'edit', 'search_replace', 'str_replace', 'string_replace'].includes(key);
+}
+/** Admit existing file/bridge authority; shells and unknown requests retain native approval. */
+function isAdmittedGrokPermission(message, input, state, tools) {
+    if (message.method !== 'session/request_permission' || input.plan === true)
+        return false;
+    const mode = input.permission?.sandboxMode;
+    if (mode !== 'workspace-write' && mode !== 'danger-full-access')
+        return false;
+    const params = isRecord(message.params) ? message.params : {};
+    const tool = isToolRecord(params.toolCall) ? params.toolCall : {};
+    const metadata = isRecord(params._meta) ? params._meta : {};
+    if (metadata.risk !== undefined || tool.risk !== undefined)
+        return false;
+    // Never substitute a persistent grant or invent an option absent from the request.
+    if (!Array.isArray(params.options) || !params.options.some(option => isRecord(option)
+        && firstToolText(option.kind, option.type)?.toLowerCase() === 'allow_once'
+        && firstToolText(option.optionId, option.option_id, option.id) !== undefined))
+        return false;
+    const observed = tools.get(permissionCallId(message) ?? '');
+    // Titles become human-readable labels such as "Write `/path`". Keep the
+    // canonical identity from the matching call, while MCP wrappers name their
+    // inner bridge tool in the permission request itself.
+    const title = firstToolText(tool.title);
+    const bridgeTitle = title === 'codingns__agent_team' || title === 'codingns__agent_subagent'
+        || title === 'codingns__web_search' || title === 'codingns__web_fetch' ? title : undefined;
+    const name = firstToolText(tool.name, tool.toolName, tool.tool_name) ?? bridgeTitle ?? observed?.name ?? title;
+    if (name === 'codingns__agent_team')
+        return Boolean(state.teamToken && teamBridgeToken(input.sessionId) === state.teamToken);
+    if (name === 'codingns__agent_subagent')
+        return Boolean(!state.teamToken && state.bridgeToken && getSubagentBridge()?.token === state.bridgeToken);
+    if (name === 'codingns__web_search' || name === 'codingns__web_fetch') {
+        if (state.teamToken)
+            return teamBridgeToken(input.sessionId) === state.teamToken;
+        return Boolean(state.bridgeToken && getSubagentBridge()?.token === state.bridgeToken);
     }
-    return usageChunk(update);
+    if (!name || !isAdmittedGrokFileMutation(name))
+        return false;
+    if (observed && observed.name !== name)
+        return false;
+    const raw = tool.rawInput ?? observed?.input;
+    if (!isRecord(raw))
+        return false;
+    const paths = ['file_path', 'target_file', 'path'].flatMap(key => raw[key] === undefined ? [] : [raw[key]]);
+    if (!paths.length || paths.some(path => typeof path !== 'string' || !path.trim() || path.includes('\0')))
+        return false;
+    if (!input.cwd || !isAbsolute(input.cwd))
+        return false;
+    const root = canonicalGrokPath(input.cwd);
+    if (!root)
+        return false;
+    return paths.every(path => {
+        // Keep dot segments until realpath resolves existing symlink ancestors.
+        const target = canonicalGrokPath(isAbsolute(path) ? path : `${input.cwd}${sep}${path}`);
+        if (!target)
+            return false;
+        const outside = relative(root, target);
+        return mode === 'danger-full-access' || outside !== '' && outside !== '..' && !outside.startsWith(`..${sep}`) && !isAbsolute(outside);
+    });
+}
+/** Resolve existing ancestors, rejecting broken links and non-missing filesystem errors. */
+function canonicalGrokPath(path) {
+    const suffix = [];
+    let current = path;
+    for (;;) {
+        try {
+            lstatSync(current);
+        }
+        catch (error) {
+            if (error.code !== 'ENOENT' || dirname(current) === current)
+                return undefined;
+            suffix.unshift(basename(current));
+            current = dirname(current);
+            continue;
+        }
+        try {
+            return resolve(realpathSync.native(current), ...suffix);
+        }
+        catch {
+            return undefined;
+        }
+    }
+}
+/** Cache metadata enriches only IDs admitted by the native CLI's filtered list. */
+function readGrokModelMetadata(path) {
+    const result = new Map();
+    try {
+        const value = JSON.parse(readFileSync(path, 'utf8'));
+        if (!isRecord(value) || !isRecord(value.models))
+            return result;
+        for (const entry of Object.values(value.models)) {
+            if (!isRecord(entry) || !isRecord(entry.info) || typeof entry.info.id !== 'string')
+                continue;
+            const info = entry.info;
+            const efforts = Array.isArray(info.reasoning_efforts) ? info.reasoning_efforts.flatMap(effort => typeof effort === 'string' ? [effort] : isRecord(effort) && typeof effort.id === 'string' ? [effort.id] : []) : [];
+            result.set(info.id, { name: typeof info.name === 'string' ? info.name : info.id, efforts });
+        }
+    }
+    catch { /* Metadata is optional and never adds selectable model IDs. */ }
+    return result;
 }
 function permissionRequestId(message) {
     const params = isRecord(message.params) ? message.params : message;
@@ -538,6 +984,12 @@ function permissionRequestId(message) {
 function interactionRequestId(message) {
     return permissionRequestId(message);
 }
+function permissionCallId(message) {
+    const params = isRecord(message.params) ? message.params : message;
+    const update = isRecord(params.update) ? params.update : params;
+    const tool = isRecord(update.toolCall) ? update.toolCall : isRecord(update.tool_call) ? update.tool_call : update;
+    return firstToolText(tool.toolCallId, tool.tool_call_id, tool.callId, tool.call_id);
+}
 function permissionOptions(message) {
     const params = isRecord(message.params) ? message.params : {};
     const options = Array.isArray(params.options) ? params.options : [];
@@ -549,9 +1001,17 @@ function permissionOptions(message) {
             return [];
         return [{ id, kind: firstToolText(option.kind, option.type)?.toLowerCase() ?? '' }];
     });
+    if (ids.length === 0)
+        return { allowOptionId: 'allow-once', rejectOptionId: 'reject-once' };
+    // Grok lists allow_always before allow_once. A DSH one-time approval must
+    // never become a persistent grant merely because of provider option order.
     return {
-        allowOptionId: ids.find((option) => /allow|approve|accept/u.test(option.kind))?.id ?? ids[0]?.id ?? 'allow-once',
-        rejectOptionId: ids.find((option) => /reject|deny|decline|cancel/u.test(option.kind))?.id ?? ids[1]?.id ?? 'reject-once',
+        allowOptionId: ids.find((option) => option.kind === 'allow_once')?.id
+            ?? ids.find((option) => /^(allow|approve|accept)$/u.test(option.kind))?.id
+            ?? (ids[0]?.kind === '' ? ids[0].id : undefined),
+        rejectOptionId: ids.find((option) => option.kind === 'reject_once')?.id
+            ?? ids.find((option) => /^(reject|deny|decline|cancel)$/u.test(option.kind))?.id
+            ?? (ids[1]?.kind === '' ? ids[1].id : undefined),
     };
 }
 function readSessionId(value) {