@poetic-ai/poetic 1.42.1-bootstrap.0

package/dist/chunk-Y34DUC4A.js

@@ -0,0 +1,1356 @@
+import {
+  isProviderStderrOnlyRecoverableNoise,
+  stripAnsiControlSequences
+} from "./chunk-MYLH2S4G.js";
+import {
+  normalizeTokenUsage
+} from "./chunk-7DNSNKJV.js";
+import {
+  resolveProviderStreamingEnabled
+} from "./chunk-HIO33P3G.js";
+import {
+  buildProviderExecutionEnv
+} from "./chunk-APV6MK5E.js";
+import {
+  createLineDelimitedTmuxCompletionSignal,
+  executeProviderCommand
+} from "./chunk-SQZRPY23.js";
+import {
+  isSkipAuthEnvActive
+} from "./chunk-4VJITV4P.js";
+import {
+  createEngineMetadata
+} from "./chunk-GHHFDU2U.js";
+import {
+  resolveProviderCliCommand
+} from "./chunk-SURZ2WFE.js";
+import {
+  requireActivePolicyBoundary
+} from "./chunk-2AICM4P3.js";
+import {
+  mkPoeticTempDir
+} from "./chunk-C57KJOUQ.js";
+import {
+  ProviderExecutionError
+} from "./chunk-LUVKFFWR.js";
+import {
+  isDebugMode
+} from "./chunk-EJGCZGUF.js";
+import {
+  sanitizeString
+} from "./chunk-LPITVM7M.js";
+import {
+  POETIC_GROK_ALLOW_BROWSER_AUTH,
+  POETIC_GROK_AUTH_PROBE_TIMEOUT_MS,
+  POETIC_SKIP_AUTH,
+  readRawEnv
+} from "./chunk-5DLKYTQX.js";
+
+// src/core/providers/grok/auth.ts
+import { readFile, rm, writeFile } from "fs/promises";
+import path2 from "path";
+
+// src/core/providers/grok/auth-file.ts
+import { stat } from "fs/promises";
+import { homedir } from "os";
+import path from "path";
+var GROK_AUTH_FILE_MIN_SIZE = 100;
+var GROK_AUTH_FILE_MODE = 384;
+function grokAuthFilePath(env) {
+  return path.join(env?.HOME?.trim() || homedir(), ".grok", "auth.json");
+}
+async function probeGrokAuthFile(env) {
+  try {
+    const info = await stat(grokAuthFilePath(env));
+    if (!info.isFile()) {
+      return "no";
+    }
+    if (info.size < GROK_AUTH_FILE_MIN_SIZE) {
+      return "no";
+    }
+    if (process.platform !== "win32") {
+      const permissionBits = info.mode & 511;
+      if (permissionBits !== GROK_AUTH_FILE_MODE) {
+        return "no";
+      }
+    }
+    return "yes";
+  } catch (error) {
+    const code = error?.code;
+    if (code === "ENOENT") {
+      return "unknown";
+    }
+    if (code === "EACCES" || code === "EPERM") {
+      return "no";
+    }
+    return "unknown";
+  }
+}
+
+// src/core/providers/grok/cli-session-probe.ts
+var GROK_CLI_PROBE_TIMEOUT_MS = 8e3;
+var GROK_DONT_ASK_MIN_VERSION = "0.2.93";
+function parseGrokCliVersion(raw) {
+  const match = raw.match(/\b(\d+)\.(\d+)\.(\d+)\b/);
+  return match ? match[0] : void 0;
+}
+function grokVersionAtLeast(version, minimum) {
+  const a = version.split(".").map((n) => Number.parseInt(n, 10));
+  const b = minimum.split(".").map((n) => Number.parseInt(n, 10));
+  if (a.some(Number.isNaN) || b.some(Number.isNaN)) return false;
+  for (let i = 0; i < Math.max(a.length, b.length); i++) {
+    const x = a[i] ?? 0;
+    const y = b[i] ?? 0;
+    if (x !== y) return x > y;
+  }
+  return true;
+}
+var GROK_READ_ONLY_ALLOW_RULES = ["Read", "Grep", "Bash", "WebFetch", "WebSearch"];
+var GROK_READ_ONLY_TOOLS = ["Read", "Grep", "Bash", "WebFetch", "WebSearch"];
+var GROK_READ_ONLY_DISALLOWED_TOOLS = ["Edit", "Write"];
+var GROK_READ_ONLY_DENY_RULES = ["MCPTool(*)"];
+function grokResolvedHasLockedReadOnlyPosture(resolved) {
+  if (resolved.permissionMode !== "dontAsk") return false;
+  if (resolved.lockReadOnlyPosture !== true) return false;
+  if (resolved.alwaysApprove === true) return false;
+  if (!sameStringList(resolved.allowRules, GROK_READ_ONLY_ALLOW_RULES)) return false;
+  if (!sameStringList(resolved.tools, GROK_READ_ONLY_TOOLS)) return false;
+  if (!sameStringList(resolved.disallowedTools, GROK_READ_ONLY_DISALLOWED_TOOLS)) return false;
+  if (!sameStringList(resolved.denyRules, GROK_READ_ONLY_DENY_RULES)) return false;
+  return true;
+}
+function sameStringList(actual, expected) {
+  if (!actual || actual.length !== expected.length) return false;
+  return expected.every((value, index) => actual[index] === value);
+}
+var cachedDontAskSupport;
+async function grokCliSupportsDontAsk(runVersionProbe) {
+  if (cachedDontAskSupport !== void 0) return cachedDontAskSupport;
+  try {
+    const raw = await runVersionProbe();
+    const version = parseGrokCliVersion(raw);
+    cachedDontAskSupport = version !== void 0 && grokVersionAtLeast(version, GROK_DONT_ASK_MIN_VERSION);
+  } catch {
+    cachedDontAskSupport = false;
+  }
+  return cachedDontAskSupport;
+}
+
+// src/core/providers/grok/env.ts
+var GROK_CLI_PARENT_FALLBACK_KEYS = [
+  "HOME",
+  "PATH",
+  "PWD",
+  "SHELL",
+  "USER",
+  "LOGNAME",
+  "TMPDIR",
+  "TERM",
+  "LANG",
+  "LC_ALL",
+  "LC_CTYPE",
+  "XDG_CACHE_HOME",
+  "XDG_CONFIG_HOME",
+  "XDG_DATA_HOME",
+  "XDG_STATE_HOME"
+];
+function createGrokCliChildEnv(env) {
+  const childEnv = buildProviderExecutionEnv("grok", env);
+  for (const key of GROK_CLI_PARENT_FALLBACK_KEYS) {
+    const current = childEnv[key];
+    const isBlank = current === void 0 || current.trim() === "";
+    if (isBlank && process.env[key] !== void 0) {
+      childEnv[key] = process.env[key];
+    }
+  }
+  return childEnv;
+}
+
+// src/core/providers/grok/error-parser.ts
+function resolveModelUsageIdentity(obj) {
+  const modelUsage = obj.modelUsage;
+  if (!modelUsage || typeof modelUsage !== "object" || Array.isArray(modelUsage)) {
+    return void 0;
+  }
+  const ids = Object.keys(modelUsage).filter((id) => id.trim().length > 0);
+  if (ids.length !== 1) return void 0;
+  return ids[0]?.replace(/-build$/, "");
+}
+var TERMINAL_SUCCESS_STOP_REASONS = /* @__PURE__ */ new Set(["endturn"]);
+var ABORTED_STOP_REASONS = /* @__PURE__ */ new Set(["cancelled", "abort", "aborted"]);
+function normalizeStopReason(stopReason) {
+  if (typeof stopReason !== "string") return void 0;
+  const normalized = stopReason.trim().toLowerCase().replace(/[\s._-]+/g, "");
+  return normalized.length > 0 ? normalized : void 0;
+}
+function isTerminalSuccessStopReason(stopReason) {
+  const normalized = normalizeStopReason(stopReason);
+  return normalized !== void 0 && TERMINAL_SUCCESS_STOP_REASONS.has(normalized);
+}
+function isAbortedStopReason(stopReason) {
+  const normalized = normalizeStopReason(stopReason);
+  return normalized !== void 0 && ABORTED_STOP_REASONS.has(normalized);
+}
+function isAbortedSuccessEnvelope(stopReason) {
+  return isAbortedStopReason(stopReason);
+}
+function isConcludingStopReason(stopReason) {
+  return isTerminalSuccessStopReason(stopReason) || isAbortedStopReason(stopReason);
+}
+function isGrokTerminalEnvelope(obj) {
+  const record = asRecord(obj);
+  if (!record) return false;
+  const type = typeof record.type === "string" ? record.type.toLowerCase() : void 0;
+  if (type === "error") return true;
+  const isSuccessShaped = typeof record.text === "string" || type === void 0 || type !== void 0 && TERMINAL_SUCCESS_EVENT_TYPES.has(type) || type === "end";
+  if (!isSuccessShaped) return false;
+  const data = asRecord(record.data);
+  const stopReason = readStringField(record, "stopReason", "stop_reason") ?? (data ? readStringField(data, "stopReason", "stop_reason") : void 0);
+  return isConcludingStopReason(stopReason);
+}
+function isGrokTerminalSuccessEnvelope(obj) {
+  const record = asRecord(obj);
+  if (!record) return false;
+  const type = typeof record.type === "string" ? record.type.toLowerCase() : void 0;
+  if (type === "error") return false;
+  const isSuccessShaped = typeof record.text === "string" || type === void 0 || type !== void 0 && TERMINAL_SUCCESS_EVENT_TYPES.has(type) || type === "end";
+  if (!isSuccessShaped) return false;
+  const data = asRecord(record.data);
+  const stopReason = readStringField(record, "stopReason", "stop_reason") ?? (data ? readStringField(data, "stopReason", "stop_reason") : void 0);
+  return isTerminalSuccessStopReason(stopReason);
+}
+function capturedStdoutHasTerminalEnvelope(stdout) {
+  if (!stdout || !stdout.trim()) return false;
+  for (const obj of findJsonObjects(stdout)) {
+    const record = asRecord(obj);
+    if (!record) continue;
+    const type = typeof record.type === "string" ? record.type.toLowerCase() : void 0;
+    if (type === "error") return true;
+    if (isGrokTerminalSuccessEnvelope(obj)) return true;
+  }
+  return false;
+}
+function grokLineConcludes(line) {
+  const trimmed = line.trim();
+  if (trimmed[0] !== "{") return false;
+  const parsed = tryParseJson(trimmed);
+  return isGrokTerminalEnvelope(parsed);
+}
+function createGrokTmuxCompletionSignal() {
+  const lineSignal = createLineDelimitedTmuxCompletionSignal(grokLineConcludes);
+  let accumulated = "";
+  let concluded = false;
+  const MAX_ACCUMULATED_BYTES = 8 * 1024 * 1024;
+  return (chunk, stream) => {
+    if (concluded) return true;
+    if (lineSignal(chunk, stream)) {
+      concluded = true;
+      return true;
+    }
+    if (stream !== "stdout" || !chunk) return false;
+    if (accumulated.length <= MAX_ACCUMULATED_BYTES) {
+      accumulated += chunk;
+      if (accumulated.trimEnd().endsWith("}")) {
+        for (const obj of findJsonObjects(accumulated)) {
+          if (isGrokTerminalEnvelope(obj)) {
+            concluded = true;
+            return true;
+          }
+        }
+      }
+    }
+    return false;
+  };
+}
+function isStderrOnlyNoise(stderr) {
+  return isProviderStderrOnlyRecoverableNoise("grok", stderr);
+}
+function tryParseJson(text) {
+  try {
+    return JSON.parse(text);
+  } catch {
+    return void 0;
+  }
+}
+function findBalancedJsonTexts(text) {
+  const results = [];
+  let start = -1;
+  let depth = 0;
+  let inString = false;
+  let escaped = false;
+  const stack = [];
+  for (let i = 0; i < text.length; i += 1) {
+    const char = text[i];
+    if (start < 0) {
+      if (char === "{" || char === "[") {
+        start = i;
+        depth = 1;
+        stack.push(char === "{" ? "}" : "]");
+      }
+      continue;
+    }
+    if (inString) {
+      if (escaped) {
+        escaped = false;
+      } else if (char === "\\") {
+        escaped = true;
+      } else if (char === '"') {
+        inString = false;
+      }
+      continue;
+    }
+    if (char === '"') {
+      inString = true;
+      continue;
+    }
+    if (char === "{" || char === "[") {
+      depth += 1;
+      stack.push(char === "{" ? "}" : "]");
+      continue;
+    }
+    if (char === "}" || char === "]") {
+      const expected = stack.pop();
+      if (char !== expected) {
+        start = -1;
+        depth = 0;
+        inString = false;
+        escaped = false;
+        stack.length = 0;
+        continue;
+      }
+      depth -= 1;
+      if (depth === 0) {
+        results.push(text.slice(start, i + 1));
+        start = -1;
+        inString = false;
+        escaped = false;
+        stack.length = 0;
+      }
+    }
+  }
+  return results;
+}
+function appendJsonObject(value, values) {
+  if (Array.isArray(value)) {
+    for (const item of value) {
+      if (item && typeof item === "object") values.push(item);
+    }
+    return;
+  }
+  if (value && typeof value === "object") values.push(value);
+}
+function findJsonObjects(stdout) {
+  if (!stdout) return [];
+  const trimmed = stdout.trim();
+  if (!trimmed) return [];
+  const whole = tryParseJson(trimmed);
+  if (whole && typeof whole === "object") {
+    const values2 = [];
+    appendJsonObject(whole, values2);
+    return values2;
+  }
+  const values = [];
+  for (const balanced of findBalancedJsonTexts(trimmed)) {
+    const parsed = tryParseJson(balanced);
+    appendJsonObject(parsed, values);
+  }
+  if (values.length > 0) return values;
+  for (const line of trimmed.split(/\r?\n/)) {
+    const t = line.trim();
+    if (!t || t[0] !== "{" && t[0] !== "[") continue;
+    const parsed = tryParseJson(t);
+    appendJsonObject(parsed, values);
+  }
+  return values;
+}
+function readStringField(obj, camelKey, snakeKey) {
+  const camel = obj[camelKey];
+  if (typeof camel === "string") return camel;
+  if (snakeKey) {
+    const snake = obj[snakeKey];
+    if (typeof snake === "string") return snake;
+  }
+  return void 0;
+}
+function asRecord(value) {
+  return value && typeof value === "object" && !Array.isArray(value) ? value : void 0;
+}
+var STREAM_TEXT_EVENT_TYPES = /* @__PURE__ */ new Set([
+  "answer",
+  "assistant",
+  "completion",
+  "content",
+  "delta",
+  "final",
+  "message",
+  "output",
+  "response",
+  "result",
+  "success",
+  "text"
+]);
+var TERMINAL_SUCCESS_EVENT_TYPES = /* @__PURE__ */ new Set(["final", "result", "success"]);
+function buildSuccessEnvelope(obj, text, accumulatedThought) {
+  const data = asRecord(obj.data);
+  const success = {
+    type: "success",
+    text
+  };
+  const stopReason = readStringField(obj, "stopReason", "stop_reason") ?? (data ? readStringField(data, "stopReason", "stop_reason") : void 0);
+  const sessionId = readStringField(obj, "sessionId", "session_id") ?? (data ? readStringField(data, "sessionId", "session_id") : void 0);
+  const requestId = readStringField(obj, "requestId", "request_id") ?? (data ? readStringField(data, "requestId", "request_id") : void 0);
+  const thought = readStringField(obj, "thought") ?? (data ? readStringField(data, "thought") : void 0) ?? accumulatedThought;
+  if (stopReason) success.stopReason = stopReason;
+  if (sessionId) success.sessionId = sessionId;
+  if (requestId) success.requestId = requestId;
+  if (thought) success.thought = thought;
+  const usage = obj.usage ?? data?.usage;
+  if (usage && typeof usage === "object" && !Array.isArray(usage)) {
+    success.tokenUsage = normalizeTokenUsage(usage, "grok");
+  }
+  return success;
+}
+function extractTokenUsageFromObject(obj) {
+  const data = asRecord(obj.data);
+  const usageCandidates = [obj.usage, data?.usage];
+  const type = typeof obj.type === "string" ? obj.type.toLowerCase() : void 0;
+  if (type === "usage") {
+    usageCandidates.push(data);
+  }
+  for (const candidate of usageCandidates) {
+    if (!candidate || typeof candidate !== "object" || Array.isArray(candidate)) continue;
+    const usage = normalizeTokenUsage(candidate, "grok");
+    if (usage) return usage;
+  }
+  return void 0;
+}
+function isStepUsageEventType(type) {
+  if (typeof type !== "string") return false;
+  return /^step[-_.]?finish$/i.test(type);
+}
+function sumTokenUsages(usages) {
+  if (usages.length === 0) return void 0;
+  if (usages.length === 1) return usages[0];
+  const usage = usages.reduce(
+    (sum, current) => ({
+      inputTokens: sum.inputTokens + current.inputTokens,
+      outputTokens: sum.outputTokens + current.outputTokens,
+      cachedInputTokens: (sum.cachedInputTokens ?? 0) + (current.cachedInputTokens ?? 0),
+      cacheCreationInputTokens: (sum.cacheCreationInputTokens ?? 0) + (current.cacheCreationInputTokens ?? 0)
+    }),
+    {
+      inputTokens: 0,
+      outputTokens: 0,
+      cachedInputTokens: 0,
+      cacheCreationInputTokens: 0
+    }
+  );
+  return {
+    inputTokens: usage.inputTokens,
+    outputTokens: usage.outputTokens,
+    ...usage.cachedInputTokens > 0 ? { cachedInputTokens: usage.cachedInputTokens } : {},
+    ...usage.cacheCreationInputTokens > 0 ? { cacheCreationInputTokens: usage.cacheCreationInputTokens } : {},
+    totalTokens: usage.inputTokens + usage.outputTokens
+  };
+}
+function extractSuccessEnvelope(obj, accumulatedThought) {
+  if (typeof obj.text === "string") {
+    return buildSuccessEnvelope(obj, obj.text, accumulatedThought);
+  }
+  const type = typeof obj.type === "string" ? obj.type.toLowerCase() : void 0;
+  if (!type || !TERMINAL_SUCCESS_EVENT_TYPES.has(type)) return void 0;
+  if (typeof obj.data === "string") {
+    return buildSuccessEnvelope(obj, obj.data, accumulatedThought);
+  }
+  const data = asRecord(obj.data);
+  const dataText = data ? readStringField(data, "text") : void 0;
+  if (dataText !== void 0) {
+    return buildSuccessEnvelope(obj, dataText, accumulatedThought);
+  }
+  const message = asRecord(obj.message);
+  const messageText = message ? readStringField(message, "text") : void 0;
+  if (messageText !== void 0) {
+    return buildSuccessEnvelope(obj, messageText, accumulatedThought);
+  }
+  return void 0;
+}
+function extractStreamTextChunk(obj) {
+  const type = typeof obj.type === "string" ? obj.type.toLowerCase() : void 0;
+  if (!type || !STREAM_TEXT_EVENT_TYPES.has(type) || type === "success" || type === "result") {
+    return void 0;
+  }
+  if (typeof obj.data === "string") return obj.data;
+  const data = asRecord(obj.data);
+  return data ? readStringField(data, "text") : void 0;
+}
+function extractInnerFromMessage(message) {
+  if (!message) return void 0;
+  const firstBrace = message.indexOf("{");
+  if (firstBrace < 0) return void 0;
+  const candidate = message.slice(firstBrace).trim();
+  const parsed = tryParseJson(candidate);
+  if (!parsed || typeof parsed !== "object") return void 0;
+  const inner = {};
+  if (typeof parsed.code === "string") inner.code = parsed.code;
+  if (typeof parsed.detail === "string") inner.detail = parsed.detail;
+  if (typeof parsed.http_status === "number") inner.httpStatus = parsed.http_status;
+  if (typeof parsed.message === "string") inner.message = parsed.message;
+  return Object.keys(inner).length > 0 ? inner : void 0;
+}
+function hasProviderTransportDeathEvidence(haystack) {
+  return /Transport channel closed.*Auth\(AuthorizationRequired\)/i.test(haystack) || /Auth\(AuthorizationRequired\).*Transport channel closed/i.test(haystack) || /worker quit with fatal/i.test(haystack) || /Transport channel closed/i.test(haystack);
+}
+function isMaxTurnsExceededMessage(haystack) {
+  return /max[_\s-]?turns(?:[_\s-]?(?:exceeded|reached))?/i.test(haystack) || /max_turns_reached/i.test(haystack) || /turn limit/i.test(haystack);
+}
+function categorizeError(message, inner) {
+  const haystack = `${message}
+${inner?.code ?? ""}
+${inner?.detail ?? ""}
+${inner?.message ?? ""}`;
+  if (/FS_PERMISSION_DENIED/i.test(haystack)) return "fs_permission_denied";
+  if (hasProviderTransportDeathEvidence(haystack)) {
+    return "provider_transport_failure";
+  }
+  if (/AuthorizationRequired|Authentication|not authenticated/i.test(haystack)) return "auth";
+  if (isMaxTurnsExceededMessage(haystack)) return "max_turns_exceeded";
+  if (/rate[_\s-]?limit/i.test(haystack) || /too many requests/i.test(haystack) || /\b429\b/.test(haystack) || inner?.httpStatus === 429) {
+    return "rate_limit";
+  }
+  if (/\bECONNRESET\b/i.test(haystack) || /\bETIMEDOUT\b/i.test(haystack) || /\bENOTFOUND\b/i.test(haystack) || /\bECONNREFUSED\b/i.test(haystack) || /socket hang up/i.test(haystack) || /connection refused/i.test(haystack) || /network (?:error|failure|unreachable)/i.test(haystack) || /fetch failed/i.test(haystack)) {
+    return "network";
+  }
+  if (/does not support parameter/i.test(haystack) || inner?.httpStatus === 400) {
+    return "model_rejection";
+  }
+  if (/Internal error|API error/i.test(haystack)) return "runtime";
+  return "unknown";
+}
+function readStopReason(obj) {
+  const data = asRecord(obj.data);
+  return readStringField(obj, "stopReason", "stop_reason") ?? (data ? readStringField(data, "stopReason", "stop_reason") : void 0);
+}
+function hasTerminalSuccessSemantics(obj, stopReason) {
+  if (isAbortedStopReason(stopReason)) return false;
+  if (isTerminalSuccessStopReason(stopReason)) return true;
+  const type = typeof obj.type === "string" ? obj.type.toLowerCase() : void 0;
+  return type !== void 0 && TERMINAL_SUCCESS_EVENT_TYPES.has(type);
+}
+function buildAbortedRunError(stopReason, text, stderr) {
+  const stderrClean = stripAnsiControlSequences(stderr).trim();
+  const category = stderrClean.length > 0 && isStderrOnlyNoise(stderr) ? "provider_transport_failure" : categorizeError(`${stopReason ?? ""}
+${stderrClean}`);
+  const textNote = text.trim().length > 0 ? "non-empty partial output" : "empty output";
+  return {
+    type: "error",
+    message: `grok run aborted before completion (stopReason=${stopReason ?? "unknown"}, ${textNote})`,
+    category: category === "unknown" ? "provider_transport_failure" : category
+  };
+}
+function parseGrokOutput(stdout, stderr, exitCode) {
+  const objects = findJsonObjects(stdout);
+  if (objects.length === 0) {
+    const stderrClean = stripAnsiControlSequences(stderr).trim();
+    const stdoutClean = stripAnsiControlSequences(stdout).trim();
+    const message = [stdoutClean, stderrClean].filter(Boolean).join("\n") || `grok exited with code ${exitCode} and no parseable JSON on stdout`;
+    const category = categorizeError(message);
+    return {
+      type: "error",
+      message,
+      category: category === "unknown" ? "runtime" : category
+    };
+  }
+  const thoughtChunks = [];
+  const textChunks = [];
+  let success;
+  let abortedStopReason;
+  let abortedText = "";
+  let sawTerminalSuccessStop = false;
+  let terminalEndMeta;
+  let latestFinalTokenUsage;
+  let resolvedModel;
+  const stepTokenUsages = [];
+  for (const obj of objects) {
+    resolvedModel ??= resolveModelUsageIdentity(obj);
+    if (obj.type === "error") {
+      const message = typeof obj.message === "string" ? obj.message : JSON.stringify(obj.message);
+      const inner = extractInnerFromMessage(message);
+      const category = categorizeError(
+        `${message}
+${stripAnsiControlSequences(stderr).trim()}`,
+        inner
+      );
+      return {
+        type: "error",
+        message,
+        inner,
+        category
+      };
+    }
+    const tokenUsage = extractTokenUsageFromObject(obj);
+    if (tokenUsage) {
+      if (isStepUsageEventType(obj.type)) {
+        stepTokenUsages.push(tokenUsage);
+      } else {
+        latestFinalTokenUsage = tokenUsage;
+      }
+    }
+    if (obj.type === "thought" && typeof obj.data === "string") {
+      thoughtChunks.push(obj.data);
+      continue;
+    }
+    const stopReason = readStopReason(obj);
+    const type = typeof obj.type === "string" ? obj.type.toLowerCase() : void 0;
+    if (type === "end") {
+      if (isAbortedStopReason(stopReason)) {
+        abortedStopReason = stopReason;
+        continue;
+      }
+      if (isTerminalSuccessStopReason(stopReason)) {
+        sawTerminalSuccessStop = true;
+        terminalEndMeta = obj;
+        continue;
+      }
+    }
+    const accumulatedThought = thoughtChunks.length > 0 ? thoughtChunks.join("") : void 0;
+    const parsedSuccess = extractSuccessEnvelope(obj, accumulatedThought);
+    if (parsedSuccess) {
+      if (isAbortedSuccessEnvelope(parsedSuccess.stopReason)) {
+        abortedStopReason = parsedSuccess.stopReason;
+        abortedText = parsedSuccess.text;
+        continue;
+      }
+      if (hasTerminalSuccessSemantics(obj, parsedSuccess.stopReason)) {
+        success = parsedSuccess;
+        if (isTerminalSuccessStopReason(parsedSuccess.stopReason)) {
+          sawTerminalSuccessStop = true;
+        }
+        continue;
+      }
+      if (parsedSuccess.text.length > 0) {
+        textChunks.push(parsedSuccess.text);
+      }
+      continue;
+    }
+    const chunk = extractStreamTextChunk(obj);
+    if (chunk !== void 0) textChunks.push(chunk);
+  }
+  if (abortedStopReason !== void 0) {
+    return buildAbortedRunError(abortedStopReason, abortedText || textChunks.join(""), stderr);
+  }
+  if (!success && sawTerminalSuccessStop) {
+    const accumulatedThought = thoughtChunks.length > 0 ? thoughtChunks.join("") : void 0;
+    success = buildSuccessEnvelope(
+      terminalEndMeta ?? { stopReason: "EndTurn" },
+      textChunks.join(""),
+      accumulatedThought
+    );
+  } else if (success && success.text.length === 0 && textChunks.length > 0) {
+    success = { ...success, text: textChunks.join("") };
+  }
+  if (success) {
+    if (resolvedModel) success.resolvedModel = resolvedModel;
+    const tokenUsage = latestFinalTokenUsage ?? sumTokenUsages(stepTokenUsages);
+    if (tokenUsage) {
+      success.tokenUsage = tokenUsage;
+    }
+    if (exitCode !== 0 && !isStderrOnlyNoise(stderr)) {
+      return {
+        type: "error",
+        message: `grok exited with code ${exitCode} despite success-shaped stdout`,
+        category: "runtime"
+      };
+    }
+    return success;
+  }
+  const hasOnlyNonterminalStreamEvents = objects.every((obj) => {
+    const type = typeof obj.type === "string" ? obj.type.toLowerCase() : void 0;
+    return type === "thought" || type === "status" || type === "progress" || type === "usage" || type !== void 0 && STREAM_TEXT_EVENT_TYPES.has(type) && type !== "success" && type !== "result";
+  });
+  if (hasOnlyNonterminalStreamEvents || textChunks.length > 0) {
+    return {
+      type: "error",
+      message: `Grok stdout stream ended without a terminal success/error envelope (${objects.length} event${objects.length === 1 ? "" : "s"})`,
+      category: exitCode === 0 ? "runtime" : "unknown"
+    };
+  }
+  return {
+    type: "error",
+    message: `Unrecognized Grok stdout envelope: ${JSON.stringify(objects[0]).slice(0, 200)}`,
+    category: "unknown"
+  };
+}
+var GROK_NONTERMINAL_STREAM_TYPES = /* @__PURE__ */ new Set(["thought", "status", "progress", "usage"]);
+function formatGrokStreamLineForDisplay(line, options = {}) {
+  const trimmed = line.trim();
+  if (!trimmed) {
+    return null;
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(trimmed);
+  } catch {
+    return trimmed;
+  }
+  const type = typeof parsed.type === "string" ? parsed.type.toLowerCase() : void 0;
+  const includePartials = options.includePartials ?? isDebugMode();
+  if (!includePartials && type && GROK_NONTERMINAL_STREAM_TYPES.has(type)) {
+    return null;
+  }
+  if (type === "success" && typeof parsed.text === "string" && parsed.text.length > 0) {
+    return parsed.text;
+  }
+  if (type === "error" && typeof parsed.message === "string") {
+    return `Error: ${parsed.message}`;
+  }
+  if (includePartials) {
+    if (type === "thought" && typeof parsed.data === "string") {
+      return parsed.data;
+    }
+    const chunk = extractStreamTextChunk(parsed);
+    if (chunk !== void 0 && chunk.length > 0) {
+      return chunk;
+    }
+  }
+  return null;
+}
+
+// src/core/providers/grok/execution/commands.ts
+var ALLOWED_OUTPUT_FORMATS = /* @__PURE__ */ new Set(["plain", "json", "streaming-json"]);
+var ALLOWED_PERMISSION_MODES = /* @__PURE__ */ new Set([
+  "default",
+  "acceptEdits",
+  "auto",
+  "dontAsk",
+  "bypassPermissions"
+]);
+var UNSUPPORTED_PERMISSION_MODES = /* @__PURE__ */ new Set(["plan", "delegate"]);
+var UNSAFE_HEADLESS_PERMISSION_MODES = /* @__PURE__ */ new Set(["acceptEdits", "auto"]);
+var ELEVATING_PERMISSION_MODES = /* @__PURE__ */ new Set(["bypassPermissions", "acceptEdits", "auto"]);
+var CLI_DEFAULT_MODEL = "auto";
+function shouldEmitGrokModelArg(model) {
+  const normalized = model?.trim();
+  return Boolean(normalized && normalized.toLowerCase() !== CLI_DEFAULT_MODEL);
+}
+function readEnv(env, key) {
+  const source = env ?? process.env;
+  const value = source[key];
+  if (typeof value !== "string") return void 0;
+  const trimmed = value.trim();
+  return trimmed.length > 0 ? trimmed : void 0;
+}
+function throwUnsafePermissionMode(raw) {
+  throw new Error(
+    [
+      `POETIC_GROK_PERMISSION_MODE=${raw} is unsafe for Grok headless execution.`,
+      "Unset POETIC_GROK_PERMISSION_MODE to use Grok CLI native defaults,",
+      `use locked dontAsk read-only posture for consults (grok >= ${GROK_DONT_ASK_MIN_VERSION}),`,
+      "or set POETIC_GROK_PERMISSION_MODE=bypassPermissions when policy permits."
+    ].join(" ")
+  );
+}
+function throwUnsupportedPermissionMode(raw) {
+  throw new Error(
+    [
+      `permissionMode=${raw} is not supported for Grok headless execution.`,
+      "Supported modes: default (omit flag), dontAsk (+ allow rules), bypassPermissions.",
+      "acceptEdits/auto are unsafe under headless OAuth and are rejected."
+    ].join(" ")
+  );
+}
+function throwDontAskUnsupported() {
+  throw new Error(
+    [
+      `Grok dontAsk requires Grok CLI >= ${GROK_DONT_ASK_MIN_VERSION}.`,
+      "The installed CLI does not support the locked headless read-only / dontAsk posture",
+      "(approval-worker modes die under headless OAuth on older versions; full",
+      "native read-only controls are verified on 0.2.93+).",
+      "Upgrade grok, or omit dontAsk / unset POETIC_GROK_PERMISSION_MODE."
+    ].join(" ")
+  );
+}
+function resolvePermissionMode(env, requested, options = {}) {
+  const envRaw = readEnv(env, "POETIC_GROK_PERMISSION_MODE");
+  const requestedMode = requested?.trim() || void 0;
+  if (requestedMode && UNSUPPORTED_PERMISSION_MODES.has(requestedMode)) {
+    throwUnsupportedPermissionMode(requestedMode);
+  }
+  if (requestedMode && UNSAFE_HEADLESS_PERMISSION_MODES.has(requestedMode)) {
+    throwUnsafePermissionMode(requestedMode);
+  }
+  let raw;
+  if (options.lockPermissionMode) {
+    if (envRaw && UNSAFE_HEADLESS_PERMISSION_MODES.has(envRaw)) {
+      throwUnsafePermissionMode(envRaw);
+    }
+    if (envRaw && ELEVATING_PERMISSION_MODES.has(envRaw)) {
+      raw = requestedMode;
+    } else {
+      raw = requestedMode ?? envRaw;
+    }
+  } else {
+    raw = envRaw ?? requestedMode;
+  }
+  if (!raw) return "default";
+  if (UNSUPPORTED_PERMISSION_MODES.has(raw)) {
+    if (envRaw === raw && requestedMode !== raw) return "default";
+    throwUnsupportedPermissionMode(raw);
+  }
+  if (!ALLOWED_PERMISSION_MODES.has(raw)) return "default";
+  if (UNSAFE_HEADLESS_PERMISSION_MODES.has(raw)) {
+    throwUnsafePermissionMode(raw);
+  }
+  if (raw === "dontAsk" && options.supportsDontAsk === false) {
+    throwDontAskUnsupported();
+  }
+  return raw;
+}
+function resolveAllowRules(env, requested) {
+  const raw = readEnv(env, "POETIC_GROK_ALLOW_RULES");
+  const source = raw ? raw.split(",").map((r) => r.trim()) : (requested ?? []).map((r) => r.trim());
+  const rules = source.filter((r) => r.length > 0);
+  return rules.length > 0 ? rules : void 0;
+}
+function resolveMaxTurns(env) {
+  const raw = readEnv(env, "POETIC_GROK_MAX_TURNS");
+  if (!raw) return void 0;
+  if (!/^[0-9]+$/.test(raw)) return void 0;
+  const n = Number.parseInt(raw, 10);
+  if (!Number.isFinite(n) || n <= 0) return void 0;
+  return n;
+}
+function resolveOutputFormat(env) {
+  const raw = readEnv(env, "POETIC_GROK_OUTPUT_FORMAT");
+  if (raw && ALLOWED_OUTPUT_FORMATS.has(raw)) return raw;
+  if (resolveProviderStreamingEnabled(env ?? process.env)) return "streaming-json";
+  return "json";
+}
+function resolveMemoryDisabled(env) {
+  const raw = readEnv(env, "POETIC_GROK_MEMORY");
+  return raw !== "1";
+}
+function resolveAutoApprove(env) {
+  const raw = readEnv(env, "POETIC_GROK_AUTO_APPROVE") ?? readEnv(env, "POETIC_GROK_ALWAYS_APPROVE");
+  return raw !== "0";
+}
+function resolveTools(env) {
+  const raw = readEnv(env, "POETIC_GROK_TOOLS");
+  if (!raw) return void 0;
+  const tools = raw.split(",").map((t) => t.trim()).filter((t) => t.length > 0);
+  return tools.length > 0 ? tools : void 0;
+}
+function resolveResumeSessionId(resumeSessionId) {
+  const trimmed = resumeSessionId?.trim();
+  return trimmed && trimmed.length > 0 ? trimmed : void 0;
+}
+function buildGrokArgv(input) {
+  if (!input.promptFile || input.promptFile.trim().length === 0) {
+    throw new Error("buildGrokArgv: promptFile is required");
+  }
+  const lockReadOnlyPosture = input.lockReadOnlyPosture === true;
+  const permissionMode = resolvePermissionMode(input.env, input.permissionMode, {
+    lockPermissionMode: input.lockPermissionMode === true,
+    supportsDontAsk: input.supportsDontAsk
+  });
+  const maxTurns = resolveMaxTurns(input.env);
+  const outputFormat = resolveOutputFormat(input.env);
+  const memoryDisabled = resolveMemoryDisabled(input.env);
+  const alwaysApprove = resolveAutoApprove(input.env);
+  const tools = lockReadOnlyPosture ? [...GROK_READ_ONLY_TOOLS] : resolveTools(input.env);
+  const disallowedTools = lockReadOnlyPosture ? [...GROK_READ_ONLY_DISALLOWED_TOOLS] : void 0;
+  const denyRules = lockReadOnlyPosture ? [...GROK_READ_ONLY_DENY_RULES] : void 0;
+  const allowRules = permissionMode === "dontAsk" ? lockReadOnlyPosture ? [...GROK_READ_ONLY_ALLOW_RULES] : resolveAllowRules(input.env, input.allowRules) : void 0;
+  const resumeSessionId = resolveResumeSessionId(input.resumeSessionId);
+  if (permissionMode === "dontAsk" && !allowRules) {
+    throw new Error(
+      "Grok dontAsk permission mode requires at least one allow rule (allowRules input or POETIC_GROK_ALLOW_RULES); without allow rules the allow channel grants no tools."
+    );
+  }
+  const args = [
+    "--prompt-file",
+    input.promptFile,
+    "--output-format",
+    outputFormat,
+    "--no-auto-update",
+    "--no-alt-screen"
+  ];
+  if (maxTurns !== void 0) {
+    args.push("--max-turns", String(maxTurns));
+  }
+  if (permissionMode !== "default") {
+    args.push("--permission-mode", permissionMode);
+  }
+  if (allowRules) {
+    for (const rule of allowRules) {
+      args.push("--allow", rule);
+    }
+  }
+  if (memoryDisabled) {
+    args.push("--no-memory");
+  }
+  if (alwaysApprove && permissionMode !== "dontAsk" && !lockReadOnlyPosture) {
+    args.push("--always-approve");
+  }
+  if (resumeSessionId) {
+    args.push("--resume", resumeSessionId);
+  }
+  if (input.modelReasoningEffort) {
+    args.push("--reasoning-effort", input.modelReasoningEffort);
+  }
+  if (tools && tools.length > 0) {
+    args.push("--tools", tools.join(","));
+  }
+  if (disallowedTools && disallowedTools.length > 0) {
+    args.push("--disallowed-tools", disallowedTools.join(","));
+  }
+  if (denyRules) {
+    for (const rule of denyRules) {
+      args.push("--deny", rule);
+    }
+  }
+  const model = input.model?.trim();
+  if (shouldEmitGrokModelArg(model)) {
+    args.push("-m", model);
+  }
+  return {
+    args,
+    resolved: {
+      permissionMode,
+      maxTurns,
+      outputFormat,
+      memoryDisabled,
+      alwaysApprove: alwaysApprove && permissionMode !== "dontAsk" && !lockReadOnlyPosture,
+      reasoningEffort: input.modelReasoningEffort,
+      tools,
+      allowRules,
+      resumeSessionId,
+      ...lockReadOnlyPosture ? {
+        disallowedTools,
+        denyRules,
+        lockReadOnlyPosture: true
+      } : {}
+    }
+  };
+}
+
+// src/core/providers/grok/metadata.ts
+var metadata = createEngineMetadata(
+  {
+    id: "grok",
+    name: "Grok",
+    description: "xAI Grok Build via the grok CLI (headless mode)",
+    cliCommand: "grok",
+    cliBinary: "grok",
+    installCommand: "curl -fsSL https://x.ai/cli/install.sh | bash",
+    authHint: "grok  # first run opens browser auth; set XAI_API_KEY for headless",
+    setupCommand: "poetic provider setup --providers grok",
+    docsPath: "docs/PROVIDER_SETUP.md",
+    docsAnchor: "grok-cli",
+    experimental: false
+  },
+  ["installCommand", "experimental"]
+);
+
+// src/core/providers/grok/auth.ts
+var AUTH_PROBE_ENV = {
+  POETIC_GROK_MAX_TURNS: "2",
+  POETIC_GROK_AUTO_APPROVE: "0"
+};
+var EDIT_PROBE_ENV = {
+  POETIC_GROK_MAX_TURNS: "8",
+  POETIC_GROK_AUTO_APPROVE: "1"
+};
+var DEFAULT_AUTH_PROBE_TIMEOUT_MS = 45e3;
+var API_KEY_REQUIRES_ACTIVE_VERIFICATION_REASON = "Grok API key is configured, but authentication is not verified by passive checks. Requested execution or `poetic doctor --probe --provider grok` provides authoritative evidence.";
+var AUTH_FILE_REQUIRES_ACTIVE_VERIFICATION_REASON = "Grok CLI auth file exists, but headless edit execution is not verified by passive checks. Run `poetic doctor --probe --provider grok` to verify headless execution.";
+function authSkipRequested(env) {
+  return isSkipAuthEnvActive(POETIC_SKIP_AUTH.name, env);
+}
+function parsePositiveTimeoutMs(raw) {
+  if (!raw) return void 0;
+  const n = Number.parseInt(raw, 10);
+  if (!Number.isFinite(n) || n <= 0) return void 0;
+  return n;
+}
+function resolveAuthProbeTimeoutMs(env) {
+  const raw = env?.POETIC_GROK_AUTH_PROBE_TIMEOUT_MS ?? readRawEnv(POETIC_GROK_AUTH_PROBE_TIMEOUT_MS);
+  return parsePositiveTimeoutMs(raw) ?? DEFAULT_AUTH_PROBE_TIMEOUT_MS;
+}
+function hasGrokHeadlessApiKey(env = process.env) {
+  return Boolean(env?.GROK_CODE_XAI_API_KEY?.trim() || env?.XAI_API_KEY?.trim());
+}
+function allowsGrokBrowserAuth(env = process.env) {
+  const raw = env?.POETIC_GROK_ALLOW_BROWSER_AUTH ?? readRawEnv(POETIC_GROK_ALLOW_BROWSER_AUTH);
+  return raw === "1" || raw?.toLowerCase() === "true" || raw?.toLowerCase() === "yes";
+}
+function isTimeoutReason(reason) {
+  return reason === "hard_timeout" || reason === "idle_timeout" || reason === "timeout" || reason === "plm_timeout";
+}
+function requireActiveEditProbePolicyBoundary(env) {
+  try {
+    requireActivePolicyBoundary(
+      "Grok",
+      "Grok active edit auth probe (--always-approve)",
+      metadata.id,
+      { env }
+    );
+    return void 0;
+  } catch (error) {
+    if (error instanceof ProviderExecutionError) {
+      return {
+        ok: false,
+        category: "runtime",
+        message: error.message,
+        exitCode: error.exitCode
+      };
+    }
+    throw error;
+  }
+}
+function normalizeHeadlessProbeFailure(parsed, stdout, stderr) {
+  if (parsed.category === "auth" && !stdout.trim() && isStderrOnlyNoise(stderr)) {
+    return {
+      ok: false,
+      category: "runtime",
+      message: parsed.message
+    };
+  }
+  return {
+    ok: false,
+    category: parsed.category,
+    message: parsed.message
+  };
+}
+async function probeHeadlessSessionDetailed(options) {
+  const argvEnvOverrides = options?.argvEnvOverrides ?? AUTH_PROBE_ENV;
+  const childEnv = options?.env ? { ...options.env, ...argvEnvOverrides } : argvEnvOverrides;
+  const dir = await mkPoeticTempDir("grok-auth");
+  const promptFile = path2.join(dir, "prompt.txt");
+  try {
+    await writeFile(promptFile, "Reply with exactly: OK", "utf8");
+    const { command, prefixArgs } = resolveProviderCliCommand(metadata.id);
+    const { args } = buildGrokArgv({
+      promptFile,
+      model: metadata.defaultModel ?? "auto",
+      env: argvEnvOverrides
+    });
+    const childResult = await executeProviderCommand({
+      command,
+      args: [...prefixArgs, ...args],
+      workingDir: process.cwd(),
+      env: createGrokCliChildEnv(childEnv),
+      timeout: resolveAuthProbeTimeoutMs(options?.env),
+      metadata: {
+        id: metadata.id,
+        name: metadata.name,
+        installCommand: metadata.installCommand,
+        authHint: metadata.authHint,
+        docsPath: metadata.docsPath,
+        docsAnchor: metadata.docsAnchor
+      }
+    });
+    const stdout = childResult.stdout ?? "";
+    const stderr = childResult.stderr ?? "";
+    const exitCode = typeof childResult.exitCode === "number" ? childResult.exitCode : 1;
+    const parsed = parseGrokOutput(stdout, stderr, exitCode);
+    if (parsed.type === "success") {
+      return { ok: true, exitCode };
+    }
+    return {
+      ...normalizeHeadlessProbeFailure(parsed, stdout, stderr),
+      exitCode
+    };
+  } catch (error) {
+    if (error instanceof ProviderExecutionError) {
+      const stdout = error.stdout ?? "";
+      const stderr = error.stderr ?? "";
+      if (isTimeoutReason(error.reason)) {
+        return {
+          ok: false,
+          category: "runtime",
+          message: error.message,
+          exitCode: error.exitCode
+        };
+      }
+      if (stdout || stderr) {
+        const parsed = parseGrokOutput(stdout, stderr, error.exitCode ?? 1);
+        if (parsed.type === "success") {
+          return { ok: true, exitCode: error.exitCode };
+        }
+        return {
+          ...normalizeHeadlessProbeFailure(parsed, stdout, stderr),
+          exitCode: error.exitCode
+        };
+      }
+      return {
+        ok: false,
+        category: "runtime",
+        message: error.message,
+        exitCode: error.exitCode
+      };
+    }
+    return {
+      ok: false,
+      category: "runtime",
+      message: error instanceof Error ? error.message : String(error)
+    };
+  } finally {
+    await rm(dir, { recursive: true, force: true }).catch(() => {
+    });
+  }
+}
+async function probeHeadlessEditSessionDetailed(options) {
+  const argvEnvOverrides = options?.argvEnvOverrides ?? EDIT_PROBE_ENV;
+  const childEnv = options?.env ? { ...options.env, ...argvEnvOverrides } : argvEnvOverrides;
+  const boundaryFailure = requireActiveEditProbePolicyBoundary(options?.env);
+  if (boundaryFailure) return boundaryFailure;
+  const dir = await mkPoeticTempDir("grok-edit-auth");
+  const promptFile = path2.join(dir, "prompt.txt");
+  const targetFile = "poetic-grok-edit-probe.txt";
+  const targetPath = path2.join(dir, targetFile);
+  const expected = "POETIC_GROK_EDIT_PROBE_OK\n";
+  try {
+    await writeFile(
+      promptFile,
+      [
+        `Create a file named ${targetFile} in the current working directory.`,
+        `The file must contain exactly one line: ${expected.trim()}.`,
+        "Do not modify any other file."
+      ].join(" "),
+      "utf8"
+    );
+    const { command, prefixArgs } = resolveProviderCliCommand(metadata.id);
+    const { args } = buildGrokArgv({
+      promptFile,
+      model: metadata.defaultModel ?? "auto",
+      env: argvEnvOverrides
+    });
+    const childResult = await executeProviderCommand({
+      command,
+      args: [...prefixArgs, ...args],
+      workingDir: dir,
+      env: createGrokCliChildEnv(childEnv),
+      timeout: resolveAuthProbeTimeoutMs(options?.env),
+      metadata: {
+        id: metadata.id,
+        name: metadata.name,
+        installCommand: metadata.installCommand,
+        authHint: metadata.authHint,
+        docsPath: metadata.docsPath,
+        docsAnchor: metadata.docsAnchor
+      }
+    });
+    const stdout = childResult.stdout ?? "";
+    const stderr = childResult.stderr ?? "";
+    const exitCode = typeof childResult.exitCode === "number" ? childResult.exitCode : 1;
+    const parsed = parseGrokOutput(stdout, stderr, exitCode);
+    if (parsed.type !== "success") {
+      return {
+        ...normalizeHeadlessProbeFailure(parsed, stdout, stderr),
+        exitCode
+      };
+    }
+    try {
+      const actual = await readFile(targetPath, "utf8");
+      if (actual === expected) {
+        return { ok: true, exitCode };
+      }
+      return {
+        ok: false,
+        category: "runtime",
+        message: `${metadata.name} active edit probe created ${targetFile}, but its contents did not match the expected sentinel.`,
+        exitCode
+      };
+    } catch {
+      return {
+        ok: false,
+        category: "runtime",
+        message: `${metadata.name} active edit probe completed but did not create ${targetFile}; headless text generation works, but edit/tool execution was not verified.`,
+        exitCode
+      };
+    }
+  } catch (error) {
+    if (error instanceof ProviderExecutionError) {
+      const stdout = error.stdout ?? "";
+      const stderr = error.stderr ?? "";
+      if (isTimeoutReason(error.reason)) {
+        return {
+          ok: false,
+          category: "runtime",
+          message: error.message,
+          exitCode: error.exitCode
+        };
+      }
+      if (stdout || stderr) {
+        const parsed = parseGrokOutput(stdout, stderr, error.exitCode ?? 1);
+        if (parsed.type === "success") {
+          try {
+            const actual = await readFile(targetPath, "utf8");
+            if (actual === expected) {
+              return { ok: true, exitCode: error.exitCode };
+            }
+          } catch {
+          }
+          return {
+            ok: false,
+            category: "runtime",
+            message: `${metadata.name} active edit probe completed but did not create ${targetFile}; headless text generation works, but edit/tool execution was not verified.`,
+            exitCode: error.exitCode
+          };
+        }
+        return {
+          ...normalizeHeadlessProbeFailure(parsed, stdout, stderr),
+          exitCode: error.exitCode
+        };
+      }
+      return {
+        ok: false,
+        category: "runtime",
+        message: error.message,
+        exitCode: error.exitCode
+      };
+    }
+    return {
+      ok: false,
+      category: "runtime",
+      message: error instanceof Error ? error.message : String(error)
+    };
+  } finally {
+    await rm(dir, { recursive: true, force: true }).catch(() => {
+    });
+  }
+}
+async function probeHeadlessSession(options) {
+  return (await probeHeadlessSessionDetailed(options)).ok;
+}
+function shouldSoftFailGrokCliAuthProbe(hasCliAuthFile, probe) {
+  if (!hasCliAuthFile || probe.ok) return false;
+  return probe.category === "runtime";
+}
+async function probeActiveGrokAuth(options) {
+  if (authSkipRequested(options?.env)) return { ok: true };
+  if (hasGrokHeadlessApiKey(options?.env)) {
+    return probeHeadlessEditSessionDetailed({ env: options?.env });
+  }
+  if (await probeGrokAuthFile(options?.env) === "yes") {
+    return probeHeadlessEditSessionDetailed({ env: options?.env });
+  }
+  if (!allowsGrokBrowserAuth(options?.env)) {
+    return {
+      ok: false,
+      category: "auth",
+      message: "No Grok headless API key, CLI auth file, or browser-auth probe opt-in is available."
+    };
+  }
+  return probeHeadlessEditSessionDetailed({ env: options?.env });
+}
+async function isAuthenticated(options) {
+  return await isAuthenticatedTriState(options) === "yes";
+}
+async function isAuthenticatedTriState(options) {
+  return (await getAuthReadiness(options)).state;
+}
+async function getAuthReadiness(options) {
+  const mode = options?.mode ?? "passive";
+  if (authSkipRequested(options?.env)) return { state: "yes" };
+  if (mode === "passive") {
+    if (hasGrokHeadlessApiKey(options?.env)) {
+      return {
+        state: "unknown",
+        reason: API_KEY_REQUIRES_ACTIVE_VERIFICATION_REASON
+      };
+    }
+    const authFileState = await probeGrokAuthFile(options?.env);
+    if (authFileState === "yes") {
+      return {
+        state: "unknown",
+        reason: AUTH_FILE_REQUIRES_ACTIVE_VERIFICATION_REASON
+      };
+    }
+    return { state: authFileState };
+  }
+  const result = await probeActiveGrokAuth(options);
+  if (result.ok) return { state: "yes", evidence: "execution" };
+  return {
+    state: result.category === "auth" ? "no" : "unknown",
+    // Sanitize before surfacing to readiness/health UIs: the message is
+    // provider-derived and may carry diagnostic text from the CLI.
+    ...result.message ? { reason: sanitizeString(result.message) } : {},
+    ...result.category ? { category: result.category } : {}
+  };
+}
+async function isInstalled() {
+  try {
+    const { execa } = await import("execa");
+    const { command, prefixArgs } = resolveProviderCliCommand(metadata.id);
+    const result = await execa(command, [...prefixArgs, "--version"], {
+      reject: false,
+      timeout: GROK_CLI_PROBE_TIMEOUT_MS,
+      stdio: "pipe"
+    });
+    return result.exitCode === 0;
+  } catch {
+    return false;
+  }
+}
+async function ensureAuth(options) {
+  if (authSkipRequested(options?.env)) return true;
+  if ((options?.mode ?? "passive") === "passive") return false;
+  return (await probeActiveGrokAuth(options)).ok;
+}
+async function clearAuth() {
+}
+async function nextAuthMenuAction() {
+  return "login";
+}
+var auth = {
+  isAuthenticated,
+  isAuthenticatedTriState,
+  ensureAuth,
+  clearAuth,
+  nextAuthMenuAction
+};
+function getGrokAuthSetupInstructions() {
+  return [
+    `${metadata.name} requires authentication via the grok CLI.`,
+    "",
+    "To fix:",
+    `  1. Install: ${metadata.installCommand}`,
+    `  2. Auth:    ${metadata.authHint ?? "grok login"}`,
+    `  3. Verify:  poetic doctor --provider ${metadata.id}`
+  ].join("\n");
+}
+
+export {
+  GROK_CLI_PROBE_TIMEOUT_MS,
+  GROK_DONT_ASK_MIN_VERSION,
+  parseGrokCliVersion,
+  GROK_READ_ONLY_ALLOW_RULES,
+  grokResolvedHasLockedReadOnlyPosture,
+  grokCliSupportsDontAsk,
+  createGrokCliChildEnv,
+  capturedStdoutHasTerminalEnvelope,
+  createGrokTmuxCompletionSignal,
+  isStderrOnlyNoise,
+  parseGrokOutput,
+  formatGrokStreamLineForDisplay,
+  shouldEmitGrokModelArg,
+  buildGrokArgv,
+  metadata,
+  hasGrokHeadlessApiKey,
+  allowsGrokBrowserAuth,
+  probeHeadlessSessionDetailed,
+  probeHeadlessEditSessionDetailed,
+  probeHeadlessSession,
+  shouldSoftFailGrokCliAuthProbe,
+  isAuthenticated,
+  isAuthenticatedTriState,
+  getAuthReadiness,
+  isInstalled,
+  ensureAuth,
+  clearAuth,
+  nextAuthMenuAction,
+  auth,
+  getGrokAuthSetupInstructions
+};
+//# sourceMappingURL=chunk-Y34DUC4A.js.map