dsh-grok-provider 0.1.10 → 1.0.0

package/CHANGELOG.md

@@ -1,5 +1,25 @@
 # Changelog
 
+## 1.0.0 - 2026-08-30 (candidate)
+
+- Fix the remaining `INVALID_RESPONSE` failures observed with exact `grok-4.6` Search responses by accepting repeated, already Search-backed reasoning IDs only as strictly empty placeholders. "Strictly empty" means no visible summary/content and no summary/raw lifecycle; a bounded opaque `encrypted_content` field remains permitted for replay continuity.
+- Require every reused reasoning lifecycle to reach its own `response.output_item.done`. Incomplete lifecycles, cross-type reuse, reuse before the original item closes or before one completed server Search, non-empty summary/raw content, unknown terminal fields, and accessor-backed terminal fields continue to fail closed.
+- Accept the observed completed Web Search `open_page` action only as the exact bounded `{ type: "open_page", url }` shape, require the streamed and final action type/URL to agree, discard the URL after validation, and never open, fetch, preview, or replay it.
+- Capture Search terminal items and their response containers through own-data snapshots before dispatch or comparison, so self-replacing accessors cannot mutate IDs, inputs, action types, or `open_page` URLs during validation. Once an ID is Search-backed, later empty reuses also short-circuit the completed-Search scan.
+- Add focused protocol regressions for multiple empty reuses, Web/X Search-backed reuse, lifecycle completion, closed reuse followed by max-token completion, opaque encrypted content, nested/container accessor rejection, and `open_page` start/final consistency.
+- Complete two-layer redacted real-account verification without retaining prompts, results, URLs, account identity, or credentials: raw Web/X protocol probes each completed one 64-event response and observed the requested Search kind; the production adapter completed 5 Responses calls, with direct Web/X both ending in `stop` and a Harness-shaped same-name `x_search` flow ending `tool-calls`, `tool-calls`, then `stop`, with one local call in each of the first two turns.
+- Set the source manifest and lockfile to `1.0.0`; pass 245 Node 24 tests (243 pass, 0 fail, 2 platform skips), production audit, deterministic build/bundle comparison, 72-entry dry-run pack, secret scan, and diff check. Code PR #28 and main CI run `33308371009` pass on macOS 14 and Windows 2022. Keep npm `latest` and the supported stable release at `0.1.11` until the release-evidence commit's final CI, frozen artifact, exact owner authorization, publication, Registry readback, signatures, attestations, and provenance are complete. Real-device Windows external-browser launch remains unverified.
+
+## 0.1.11 - 2026-08-30
+
+- Fix `INVALID_RESPONSE` failures when exact `grok-4.6` at High Effort continues after Web Search by accepting the observed one-time reuse of an already closed reasoning item ID as a new empty reasoning placeholder only after one completed Search, while rejecting open, cross-type, non-empty, or repeated reuse.
+- Accept closed empty reasoning output items without weakening sequence, output-index, item-status, or encrypted-replay validation.
+- Decode the official Responses raw-reasoning lifecycle (`reasoning_text` content parts plus `response.reasoning_text.delta` / `done`) and keep raw reasoning strictly mutually exclusive with the existing reasoning-summary lifecycle.
+- Keep raw plaintext out of replay metadata: subsequent requests send only `encrypted_content` with `summary: []` and never replay or relabel raw plaintext as a summary; live raw reasoning deltas remain visible to Harness like summary reasoning deltas.
+- Add focused regressions for valid empty/reused reasoning, raw reasoning streaming and replay, plus malformed reuse, mixed raw/summary, out-of-order, duplicate, and incomplete lifecycle rejection.
+- Re-run a redacted real `grok-4.6` Web Search probe through the production decoder: one POST yielded 68 events, 34 summary deltas, zero raw-reasoning deltas, one accepted finish, and no saved prompt, response text, query, citation URL, or credential. This verifies the observed summary/Search path only; raw reasoning remains fixture-verified rather than live-probe verified.
+- Keep authentication, settings, model routing, image input, Search descriptors, citations, fixed endpoints, and platform support unchanged.
+
 ## 0.1.10 - 2026-08-30
 
 - Register the `llm-grok` Host settings namespace through Harness's canonical settings module so the Web Search and X Search controls are writable instead of permanently `unavailable`.

package/README.en.md

@@ -4,7 +4,11 @@
 
 Use an already authenticated official Grok Build account from DeepSeek Harness, with dynamic model discovery, streaming reasoning, image input, optional Web/X Search, tool calls, and an account quota/model capability dashboard.
 
-> Unofficial community project; not affiliated with xAI or DeepSeek Harness. The current source candidate is `0.1.10`; the current stable release and npm Registry `latest` are both `0.1.9`. Published `0.1.9` completed unique-artifact, dual-platform CI, signature, and provenance verification, but omitted Host settings registration, so its Web/X Search controls remain unavailable; unpublished `0.1.10` is the focused repair. Version `0.1.8` was published and then withdrawn and cannot be reused. The project no longer publishes prereleases; stable defects are fixed in a new incremented stable version.
+> Unofficial community project; not affiliated with xAI or DeepSeek Harness. The current stable release and npm Registry `latest` remain `0.1.11`. Version `1.0.0` is an in-development Search-response protocol repair candidate: it is not published, has no frozen unique artifact, and has not received exact-artifact publication authorization. Do not treat its candidate install command or real-account probes as Registry release evidence. Version `0.1.8` was published and then withdrawn and cannot be reused. The project no longer publishes prereleases; stable defects are fixed in a new incremented stable version.
+
+The current source candidate is `1.0.0`; npm Registry `latest` remain `0.1.11` until publication and readback complete.
+
+The `1.0.0` candidate addresses two real upstream shapes: after one completed Search, the same reasoning ID may continue through multiple strictly empty placeholder lifecycles; a completed Web Search may also return an `open_page` action. The candidate accepts only closed, Search-backed, strictly empty reuse and an exact bounded `{ type: "open_page", url }`; it never opens or downloads the URL.
 
 ## What it provides
 
@@ -15,7 +19,7 @@ Use an already authenticated official Grok Build account from DeepSeek Harness,
 | Models | Discovers every model visible to the account at runtime; no static model allowlist |
 | Conversations | Streaming Responses text, reasoning, encrypted reasoning replay, usage, and finish reasons |
 | Images | Only exact `grok-4.6` accepts bounded JPEG/PNG images from Harness attachments; `grok-4.5` and all other models remain text-only |
-| Search | `0.1.9` includes the protocol and settings page, but its controls are unavailable because Host registration for `llm-grok` is missing; the `0.1.10` candidate repairs registration so exact `grok-4.6` gets independent, default-off Web Search and X Search, while remote lifecycles are never misrepresented as local tools |
+| Search | Published `0.1.11` provides default-off Web/X Search for exact `grok-4.6`; the `1.0.0` candidate adds multiple strictly empty reasoning reuses and completed `open_page` actions, while remote lifecycles are never misrepresented as local tools |
 | Tools | Returns function calls to the Harness permission layer; the provider never executes tools |
 | Account dashboard | Login status, weekly/monthly quota, reset time, dynamic model capabilities and reasoning efforts |
 | Surfaces | Bilingual Web settings and a closed `/grok` TUI command set |
@@ -40,13 +44,22 @@ When the network is reachable and OIDC discovery succeeds, the official CLI open
 
 ### 2. Install the provider
 
-`0.1.10` is not published yet. After it is published and read back from the Registry, install that exact version from npm:
+Install the exact published version that has been read back from the Registry:
+
+```sh
+dsh plugin --profile web add dsh-grok-provider@0.1.11
+dsh web
+```
+
+After `1.0.0` is published and read back from the Registry, use:
 
 ```sh
-dsh plugin --profile web add dsh-grok-provider@0.1.10
+dsh plugin --profile web add dsh-grok-provider@1.0.0
 dsh web
 ```
 
+Do not treat that candidate command as currently installable; npm `latest` is still `0.1.11`.
+
 ### 3. Sign in and select a model
 
 Open **Settings → Grok Build**:
@@ -130,8 +143,9 @@ Uninstalling the provider does not remove the official Grok CLI or directly modi
 
 ## Sources and discovery
 
-- Current npm stable release: [dsh-grok-provider@0.1.9](https://www.npmjs.com/package/dsh-grok-provider/v/0.1.9) (release artifact verified; known Search settings-registration defect)
-- Most recent GitHub release and integrity values: [v0.1.9](https://github.com/yoshino-xiao7/dsh-grok-provider/releases/tag/v0.1.9)
+- Current npm stable release: [dsh-grok-provider@0.1.11](https://www.npmjs.com/package/dsh-grok-provider/v/0.1.11) (unique artifact, dual-platform CI, signatures, attestations, and provenance verified)
+- Most recent GitHub release and integrity values: [v0.1.11](https://github.com/yoshino-xiao7/dsh-grok-provider/releases/tag/v0.1.11)
+- Release evidence: release commit `2e5c6dbc8bb83377a4db4d8e31452b3ce96500c5`, annotated tag object `353bcd3717d4440ab20a2b05a5e9d51eef22fa7f` peeling to that commit, final CI run [`33303080849`](https://github.com/yoshino-xiao7/dsh-grok-provider/actions/runs/33303080849), and Trusted Publisher run [`33303631312`](https://github.com/yoshino-xiao7/dsh-grok-provider/actions/runs/33303631312). The repository owner explicitly authorized the unique 71-file artifact, which is 207,022 bytes packed and 656,139 bytes unpacked; SHA-256 is `8fca0eca86769ee9febd35606cc8c944a0ae968cec2937a30ccaf68d36d42b2d` and SRI is `sha512-2qInRIq5Dkf7CqXq8z1mVvMelStg3nZ1wuWEqsExgfm7iXF0Jn5f7d11IAtHRxdKdJm/j0s8tYT1Dx6IdtGNqg==`. Registry, Release, and local copies are byte-identical, and an isolated Registry install passed Host/client smoke. `npm audit signatures` confirmed verified Registry signatures for 9 packages and verified attestations for 3 packages; this package's public metadata exposes 1 Registry signature and 2 attestations, and provenance binds `release.yml`, `v0.1.11`, the release commit, and publish run exactly.
 - GitHub community discovery: the repository carries the DeepSeek Harness-recommended `dsh-plugin` and `dsh` topics
 - YukiRyou managed source: [deepseek-yukiryou-plugin-catalog](https://github.com/yoshino-xiao7/deepseek-yukiryou-plugin-catalog), still pinned to the real-device-accepted `dsh-grok-provider@0.1.0` and marking only `darwin-arm64`
 
@@ -139,21 +153,30 @@ Directory inclusion is not an endorsement by xAI or DeepSeek Harness. [Listing P
 
 ## Compatibility and scope
 
-| Item | `0.1.9` stable / `0.1.10` candidate status |
+### `1.0.0` candidate repair boundary
+
+- The original reasoning lifecycle must close, and one completed Web/X server Search must precede the first reuse of that ID. Later appearances are accepted only as strictly empty placeholders.
+- "Strictly empty" means empty visible summary/content and no summary/raw lifecycle. A bounded opaque `encrypted_content` value is allowed, but it is not exposed as visible reasoning and upstream plaintext is not retained.
+- Every reuse must receive its own `response.output_item.done`. If `response.incomplete` arrives while a reused lifecycle is still open, the stream maps to the generic invalid-response error; a later `max_output_tokens` terminal remains valid after every reused lifecycle has closed. Non-empty summary/raw data, cross-type reuse, unknown terminal fields, and accessor-backed fields remain rejected.
+- A completed `open_page` action accepts only exact `type + url`; streamed and final action type/URL must agree. The Provider discards the URL after validation and never visits, previews, downloads, or replays it.
+- Two-layer redacted real-account verification passed against the final source: raw Web/X probes each completed one 64-event response, observed the requested Search kind, and reached `completed`; the production adapter completed 5 Responses calls, with direct Web/X both ending in `stop` and a same-name Harness `x_search` flow ending `tool-calls`, `tool-calls`, then `stop`, with one local call in each of the first two turns. No results, URLs, prompts, identity, or credentials were retained; this is not publication, OAuth, or real-device Windows evidence.
+- The manifest and lockfile are synchronized at `1.0.0`; the Node 24 suite reports 245 tests, 243 pass, 0 fail, and 2 platform skips. Production audit reports zero vulnerabilities, and the deterministic build/bundle comparison, 72-entry dry-run pack, secret scan, and diff check pass. Code PR #28 is merged at `yukiryou/main@7a6364dd58f3c7e9e1ad68a3d0197a14254bcb8c`, and main CI run [`33308371009`](https://github.com/yoshino-xiao7/dsh-grok-provider/actions/runs/33308371009) passes on macOS 14 and Windows 2022. The release-evidence commit's final CI, frozen artifact, digest/SRI, exact authorization, publication, and Registry/signature/attestation/provenance readback remain pending.
+
+| Item | Published `0.1.11` status |
 | --- | --- |
 | DeepSeek Harness | Exact support for `0.1.1-rc.2` |
 | Node.js | `>=24.19.0` |
-| macOS arm64 | Image sending has real-Harness confirmation; the `0.1.10` Search repair passes real SettingsProvider/LLM tests, candidate-tarball isolated install, settings API, browser switch-write acceptance, and candidate macOS 14 CI |
-| Windows x64 | Code, slow fakes, and `0.1.10` candidate Windows 2022 CI pass. On a reachable network the official CLI generates the URL and opens the browser, and that path still lacks real-device Windows acceptance |
+| macOS arm64 | Image sending has real-Harness confirmation; focused `0.1.11` regressions, the redacted summary/Search probe, final macOS 14 CI, and unique-artifact acceptance all pass |
+| Windows x64 | Final `0.1.11` Windows 2022 CI and existing slow fakes pass. On a reachable network the official CLI generates the URL and opens the browser, and that path still lacks real-device Windows acceptance |
 | macOS x64 / Linux | Unsupported |
 | Grok CLI | No full-version lock; official path, `login --oauth` capability, and production OIDC credential contract are enforced |
 | Models | Every account catalog model whose backend has a strict codec in this release |
 
-`0.1.10` preserves the published image boundary: image input is enabled only for exact `grok-4.6`, while `grok-4.5` and every other dynamically discovered model remain text-only. Image sending has been confirmed in a real Harness conversation. Images must be verified JPEG/PNG projections from the Harness attachment service. Ordinary user content and images nested one level inside a tool result are supported with fixed `detail:"high"`; URLs, filesystem paths, file IDs, and caller-supplied data URLs are rejected. Private reasoning in ordinary user/system history is omitted while adjacent visible text remains ordered.
+`0.1.11` preserves the published image boundary: image input is enabled only for exact `grok-4.6`, while `grok-4.5` and every other dynamically discovered model remain text-only. Image sending has been confirmed in a real Harness conversation. Images must be verified JPEG/PNG projections from the Harness attachment service. Ordinary user content and images nested one level inside a tool result are supported with fixed `detail:"high"`; URLs, filesystem paths, file IDs, and caller-supplied data URLs are rejected. Private reasoning in ordinary user/system history is omitted while adjacent visible text remains ordered.
 
 Each projected image is limited to 4 MiB, 16,777,216 pixels, and 8192px per side. A request retains at most eight images and 8 MiB of projected image bytes. When a limit is exceeded, the globally oldest images are offloaded to Harness text placeholders; the final JSON remains capped at 16 MiB.
 
-Published `0.1.9` included the Search protocol and settings page but omitted the Host-side `llm-grok` namespace registration, leaving both controls unavailable. The `0.1.10` candidate registers and persists both settings through the canonical Harness settings module; each new call reads the latest value once before model discovery, while prepared and in-flight calls keep their original snapshot. Search remains default-off and limited to exact `grok-4.6`. Once enabled, ordinary conversation content and model-derived queries are sent to xAI and may incur additional usage. Web/X activity is already executed server-side and is not projected as a Harness-local tool call. Citation Markdown remains ordinary assistant text; bounded structured URL metadata is discarded, and the plugin never opens or downloads a citation. Search results are untrusted remote data, so verify sources before commands or file changes. Image generation, arbitrary downloads, API-key mode, multiple accounts, enterprise OIDC, ACP, and Headless agent wrapping remain out of scope; see the [capability roadmap](docs/11-capability-roadmap.md).
+Published `0.1.10` registers and persists both Search settings through the canonical Harness settings module; each new call reads the latest value once before model discovery, while prepared and in-flight calls keep their original snapshot. Real use later found that exact `grok-4.6` at High Effort may close a reasoning item, complete Search, and then reuse the same ID once as an empty placeholder, which the old decoder rejected. Published `0.1.11` permits that strictly empty one-time reuse only when a completed Search lies between the two reasoning lifecycles and adds the official raw `reasoning_text` lifecycle. Raw and summary modes are mutually exclusive; replay metadata does not retain raw plaintext, later requests send only `encrypted_content` with an empty summary, and live raw deltas remain visible to Harness as reasoning output. A redacted real probe observed 34 summary deltas and zero raw deltas, so it verifies only the summary/Search path; raw reasoning remains fixture-verified. Search stays default-off and limited to exact `grok-4.6`; remote activity is not projected as a local tool, and citation URLs are never opened or downloaded. Search results are untrusted remote data, so verify sources before commands or file changes. Image generation, arbitrary downloads, API-key mode, multiple accounts, enterprise OIDC, ACP, and Headless agent wrapping remain out of scope; see the [capability roadmap](docs/11-capability-roadmap.md).
 
 ## How it works
 
@@ -256,7 +279,9 @@ Read the [contributing guide](CONTRIBUTING.md) before filing an issue or PR. Cha
 - [x] Publish `0.1.6`: image-history reasoning compatibility and per-stage official-CLI deadline repair for Windows; image sending is confirmed in a real Harness conversation
 - [x] Publish `0.1.7`: Provider/CLI version diagnostics, CLI installation recovery, redacted OIDC discovery-timeout settlement, and the `IconThinkOutline16` settings-navigation compatibility layer
 - [x] Publish `0.1.9`: added the Web/X Search protocol and settings page; the unique artifact, dual-platform CI, signatures, and SLSA provenance are verified; post-release verification found the missing Host settings namespace and unusable controls
-- [ ] Publish `0.1.10`: `llm-grok` registration, per-call capture, isolated install, the code PR, and main dual-platform CI are complete; merging release evidence, freezing the unique artifact, and exact release authorization remain
+- [x] Publish `0.1.10`: `llm-grok` registration, per-call capture, unique artifact, dual-platform CI, signatures, and provenance are complete
+- [x] Publish `0.1.11`: repair High Effort + Web Search reasoning-lifecycle compatibility; the unique artifact, final dual-platform CI, exact authorization, Registry, signatures, attestations, and provenance readback are complete
+- [ ] Publish `1.0.0`: repair multiple strictly empty reasoning-ID reuses and completed Web Search `open_page` actions; the code PR and main dual-platform CI pass, while release-evidence final CI, the unique artifact, and exact authorization remain pending
 - [ ] A subsequent slice: opt-in image generation (inline results only, committed through Harness attachments)
 - [ ] Complete independent Windows x64 acceptance and publish a later stable fix if needed
 

package/README.md

@@ -4,7 +4,11 @@
 
 让 DeepSeek Harness 使用你已登录的官方 Grok Build 账号：动态模型发现、流式推理、图片输入、可选 Web/X Search、工具调用，以及账号额度与模型能力面板。
 
-> 非官方社区项目，与 xAI 或 DeepSeek Harness 官方无隶属关系。当前源码候选版本为 `0.1.10`；当前稳定版及 npm Registry 的 `latest` 均为 `0.1.9`。已发布的 `0.1.9` 完成了唯一制品、双平台 CI、签名与 provenance 验证，但遗漏 Host 设置注册，因此 Web/X Search 开关会显示暂时不可用；尚未发布的 `0.1.10` 专门修复这条链路。`0.1.8` 曾发布后撤回且版本号不可复用。项目不再发行预发行版；正式版缺陷通过新的递增稳定版本修复。
+> 非官方社区项目，与 xAI 或 DeepSeek Harness 官方无隶属关系。当前稳定版及 npm Registry 的 `latest` 仍为 `0.1.11`。`1.0.0` 正在作为 Search 响应协议修复候选开发，尚未发布、尚未冻结唯一制品，也尚未获得精确制品发布授权；不得把候选安装命令或真实账号探针表述为 Registry 发布事实。`0.1.8` 曾发布后撤回且版本号不可复用。项目不再发行预发行版；正式版缺陷通过新的递增稳定版本修复。
+
+当前源码候选版本为 `1.0.0`；npm Registry 的 `latest` 仍为 `0.1.11`。
+
+`1.0.0` 候选解决两类真实上游形状：一次 Search 完成后，同一 reasoning ID 可能继续以多个严格空占位生命周期出现；已完成 Web Search 也可能返回 `open_page` action。候选只接受闭合、Search-backed、严格空的复用，以及精确且有界的 `{ type: "open_page", url }`，不会打开或下载 URL。
 
 ## 它解决什么问题
 
@@ -15,7 +19,7 @@
 | 模型 | 运行时读取账号可见的全部 Grok Build 模型，不维护静态模型白名单 |
 | 对话 | Responses 流式文本、reasoning、加密 reasoning replay、usage 与 finish reason |
 | 图片 | 仅精确 `grok-4.6` 接收 Harness attachment 中有界的 JPEG/PNG 图片；`grok-4.5` 与其他模型保持 text-only |
-| 搜索 | `0.1.9` 已包含协议与设置页，但开关因缺少 `llm-grok` Host 注册而不可用；`0.1.10` 候选修复注册，使精确 `grok-4.6` 的 Web Search / X Search 可默认关闭、分别开启，远端 lifecycle 不伪装成本地工具 |
+| 搜索 | 已发布 `0.1.11` 提供精确 `grok-4.6` 的默认关闭 Web/X Search；`1.0.0` 候选补齐多次严格空 reasoning 复用与完成态 `open_page` action，远端 lifecycle 仍不伪装成本地工具 |
 | 工具 | 将 function call 交回 Harness 权限层；Provider 本身不执行工具 |
 | 账户面板 | 登录状态、每周/月额度、重置时间、动态模型能力与 reasoning 档位 |
 | 界面 | Web 设置页中英文切换；TUI 提供闭合的 `/grok` 命令 |
@@ -40,13 +44,22 @@ grok models
 
 ### 2. 安装 Provider
 
-`0.1.10` 尚未发布；待它发布并完成 Registry 回读后，从 npm 安装该精确版本：
+从 npm 安装已发布并完成 Registry 回读的精确版本：
+
+```sh
+dsh plugin --profile web add dsh-grok-provider@0.1.11
+dsh web
+```
+
+`1.0.0` 发布并完成 Registry 回读后，可改用：
 
 ```sh
-dsh plugin --profile web add dsh-grok-provider@0.1.10
+dsh plugin --profile web add dsh-grok-provider@1.0.0
 dsh web
 ```
 
+当前请不要把这条候选命令当作已可安装版本；npm `latest` 仍是 `0.1.11`。
+
 ### 3. 登录并选择模型
 
 打开 **设置 → Grok Build**：
@@ -130,8 +143,9 @@ dsh web
 
 ## 项目来源与发现
 
-- npm 当前稳定版：[dsh-grok-provider@0.1.9](https://www.npmjs.com/package/dsh-grok-provider/v/0.1.9)（发行制品已验证；Search 开关存在已知设置注册缺陷）
-- GitHub 最近发行版与校验值：[v0.1.9](https://github.com/yoshino-xiao7/dsh-grok-provider/releases/tag/v0.1.9)
+- npm 当前稳定版：[dsh-grok-provider@0.1.11](https://www.npmjs.com/package/dsh-grok-provider/v/0.1.11)（唯一制品、双平台 CI、签名、attestations 与 provenance 已验证）
+- GitHub 最近发行版与校验值：[v0.1.11](https://github.com/yoshino-xiao7/dsh-grok-provider/releases/tag/v0.1.11)
+- 发布证据：release commit `2e5c6dbc8bb83377a4db4d8e31452b3ce96500c5`，annotated tag object `353bcd3717d4440ab20a2b05a5e9d51eef22fa7f` peel 至该提交，final CI run [`33303080849`](https://github.com/yoshino-xiao7/dsh-grok-provider/actions/runs/33303080849)，Trusted Publisher run [`33303631312`](https://github.com/yoshino-xiao7/dsh-grok-provider/actions/runs/33303631312)。仓库所有者明确授权的唯一 tarball 含 71 个文件、207,022 bytes，unpacked size 656,139 bytes；SHA-256 为 `8fca0eca86769ee9febd35606cc8c944a0ae968cec2937a30ccaf68d36d42b2d`，SRI 为 `sha512-2qInRIq5Dkf7CqXq8z1mVvMelStg3nZ1wuWEqsExgfm7iXF0Jn5f7d11IAtHRxdKdJm/j0s8tYT1Dx6IdtGNqg==`。Registry、Release 与本地制品逐字节一致，Registry 隔离安装及 Host/client smoke 通过；`npm audit signatures` 确认安装图中 9 个包具有已验证 Registry 签名、3 个包具有已验证 attestations，本包公开 metadata 包含 1 个 Registry signature、2 个 attestations，provenance 精确绑定 `release.yml`、`v0.1.11`、release commit 与 publish run。
 - GitHub 社区发现：仓库已添加 DeepSeek Harness 官方推荐的 `dsh-plugin` 与 `dsh` Topics
 - YukiRyou 受管来源：[deepseek-yukiryou-plugin-catalog](https://github.com/yoshino-xiao7/deepseek-yukiryou-plugin-catalog)，当前仍锁定已完成真机验收的 `dsh-grok-provider@0.1.0`，且只标记 `darwin-arm64`
 
@@ -139,21 +153,30 @@ dsh web
 
 ## 兼容性与范围
 
-| 项目 | `0.1.9` 稳定版 / `0.1.10` 候选状态 |
+### `1.0.0` 候选修复边界
+
+- 一个 reasoning ID 的原始生命周期必须先闭合，并且首次复用前必须已有一个完成的 Web/X server Search；之后只允许它以严格空占位再次出现。
+- “严格空”是指可见 summary/content 为空，且没有 summary/raw lifecycle；允许有界、不透明的 `encrypted_content`，但不会把它当作可见 reasoning 或保存上游明文。
+- 每次复用都必须收到独立的 `response.output_item.done`；若 `response.incomplete` 到来时仍有复用段未闭合，则返回通用非法响应错误，所有复用段已闭合后的 `max_output_tokens` 终态仍有效。非空 summary/raw、跨类型、未知 terminal 字段或 accessor 字段继续拒绝。
+- 完成态 `open_page` 只接受精确 `type + url`，streamed/final action 的类型与 URL 必须一致；Provider 校验后丢弃 URL，不会访问、预览、下载或回放。
+- 最终源码完成两层脱敏真实账号复验：原始 Web/X 协议探针各 1 次请求、各 64 events，分别观察到对应 Search 且终态 `completed`；生产 adapter 共完成 5 次 Responses，direct Web/X 均为 `stop`，Harness 同名 `x_search` 三轮依次为 `tool-calls`、`tool-calls`、`stop`，前两轮各 1 次本地调用。未保存结果、URL、prompt、身份或凭据；这些不是发布、OAuth 或 Windows 真机证据。
+- manifest/lock 已同步为 `1.0.0`；Node 24 全量测试为 245 项、243 pass、0 fail、2 项平台跳过，生产依赖审计为 0 漏洞，确定性 build/bundle、72 项 dry-run pack、秘密模式扫描与 diff 检查均通过。代码 PR #28 已合入 `yukiryou/main@7a6364dd58f3c7e9e1ad68a3d0197a14254bcb8c`，main CI run [`33308371009`](https://github.com/yoshino-xiao7/dsh-grok-provider/actions/runs/33308371009) 的 macOS 14 / Windows 2022 均通过；仍待发布证据提交的 final CI、冻结制品、摘要/SRI、精确授权、发布及 Registry/signature/attestation/provenance 回读。
+
+| 项目 | `0.1.11` 已发布状态 |
 | --- | --- |
 | DeepSeek Harness | 精确支持 `0.1.1-rc.2` |
 | Node.js | `>=24.19.0` |
-| macOS arm64 | 图片发送已完成真实 Harness 验证；`0.1.10` Search 修复已通过真实 SettingsProvider/LLM 回归、候选 tarball 隔离安装、设置 API、浏览器开关写入与候选 macOS 14 CI |
-| Windows x64 | 代码、slow-fake 与 `0.1.10` 候选 Windows 2022 CI 已通过。网络可达时由官方 CLI 生成 URL 并打开浏览器，该路径仍未完成 Windows 真机验收 |
+| macOS arm64 | 图片发送已完成真实 Harness 验证；`0.1.11` 聚焦回归、脱敏真实 summary/Search 探针、final macOS 14 CI 与唯一制品验收均通过 |
+| Windows x64 | `0.1.11` final Windows 2022 CI 与现有 slow-fake 通过；网络可达时由官方 CLI 生成 URL 并打开浏览器，该路径仍未完成 Windows 真机验收 |
 | macOS x64 / Linux | 不支持 |
 | Grok CLI | 不锁完整版本；严格校验官方路径、`login --oauth` 能力与生产 OIDC 凭据契约 |
 | 模型 | 当前账号目录中 backend 已被严格 codec 支持的全部模型 |
 
-`0.1.10` 沿用已发布版本的图片边界：只为精确的 `grok-4.6` 开启图片输入；`grok-4.5` 与其他动态发现的模型继续按 text-only 处理。图片发送已在真实 Harness 对话中确认可用。图片只能来自 Harness attachment service 的已验证 JPEG/PNG 投影，支持普通用户内容和一层工具结果中的图片，并固定使用 `detail:"high"`；不接受 URL、文件路径、file ID 或调用方预制的 data URL。普通 user/system 历史中的私有 reasoning 会被省略并保留相邻可见文本。
+`0.1.11` 沿用已发布版本的图片边界：只为精确的 `grok-4.6` 开启图片输入；`grok-4.5` 与其他动态发现的模型继续按 text-only 处理。图片发送已在真实 Harness 对话中确认可用。图片只能来自 Harness attachment service 的已验证 JPEG/PNG 投影，支持普通用户内容和一层工具结果中的图片，并固定使用 `detail:"high"`；不接受 URL、文件路径、file ID 或调用方预制的 data URL。普通 user/system 历史中的私有 reasoning 会被省略并保留相邻可见文本。
 
 每张投影图片最多 4 MiB、16,777,216 像素且任一边不超过 8192px；每次请求最多保留 8 张、投影字节合计最多 8 MiB。超限时按全局最旧优先移除图片并保留 Harness 的文本占位，最终 JSON 仍受 16 MiB 上限约束。
 
-已发布的 `0.1.9` 包含 Search 协议实现和设置页面，但漏掉了 Host 侧 `llm-grok` namespace 注册，两个开关因此永久处于不可用状态。`0.1.10` 候选使用 Harness 官方 settings 模块注册并持久化这两个设置；每个新调用在模型发现前读取一次最新值，已准备和在途调用保持原快照。Search 仍只对精确 `grok-4.6` 开放并默认关闭。开启后，普通对话内容以及模型据此生成的检索词会交给 xAI，并可能产生额外用量。Web/X 是服务端已执行的检索过程，不会变成 Harness 本地工具调用；回答中的 citation Markdown 保留为普通文本，结构化 URL 元数据有界校验后丢弃，插件不会打开或下载引用。搜索结果属于不可信远端数据，执行命令或修改文件前应核实来源。图片生成、任意文件下载、API Key 模式、多账号、企业 OIDC、ACP 与 Headless agent 封装仍不在本版本范围内；后续切片见[能力路线图](docs/11-capability-roadmap.md)。
+已发布的 `0.1.10` 使用 Harness 官方 settings 模块注册并持久化两个 Search 设置；每个新调用在模型发现前读取一次最新值，已准备和在途调用保持原快照。真实使用随后发现精确 `grok-4.6` 在 High Effort + Web Search 续跑时，可能先关闭 reasoning 项，在一次 Search 完成后再把同一 ID 使用一次作为空占位，旧解码器会因此失败关闭。已发布的 `0.1.11` 仅在已完成 Search 位于两段 reasoning 之间时允许该 ID 以严格空项再出现一次，并增加官方 raw `reasoning_text` 生命周期；raw 与 summary 互斥，replay 元数据不保存 raw 明文，后续请求只发送 `encrypted_content` 与空 summary，当前流中的 raw delta 仍会作为 Harness 可见 reasoning 输出。脱敏真实探针观察到 34 个 summary delta、0 个 raw delta，因此只验证 summary/Search 路径，raw reasoning 仍只有 fixture 回归。Search 继续只对精确 `grok-4.6` 默认关闭地开放；远端活动不变成本地工具，citation URL 不会被打开或下载。搜索结果属于不可信远端数据，执行命令或修改文件前应核实来源。图片生成、任意文件下载、API Key 模式、多账号、企业 OIDC、ACP 与 Headless agent 封装仍不在本版本范围内；后续切片见[能力路线图](docs/11-capability-roadmap.md)。
 
 ## 工作原理
 
@@ -256,7 +279,9 @@ npm run pack:check
 - [x] 发布 `0.1.6`：图片历史 reasoning 兼容与 Windows 官方 CLI 分阶段 deadline 修复版；图片发送已完成真实 Harness 验证
 - [x] 发布 `0.1.7`：Provider/CLI 双版本诊断、CLI 安装恢复、OIDC discovery 超时脱敏结算与 `IconThinkOutline16` 设置导航兼容层
 - [x] 发布 `0.1.9`：加入 Web/X Search 协议与设置页，唯一制品、双平台 CI、签名与 SLSA provenance 均已验证；发布后确认 Host 设置 namespace 遗漏，开关不可用
-- [ ] 发布 `0.1.10`：`llm-grok` 注册、按调用读取设置、隔离安装、代码 PR 与 main 双平台 CI 已完成；仍需合并发布证据、冻结唯一制品和精确发布授权
+- [x] 发布 `0.1.10`：`llm-grok` 注册、按调用读取设置、唯一制品、双平台 CI、签名与 provenance 已完成
+- [x] 发布 `0.1.11`：修复 High Effort + Web Search reasoning 生命周期兼容；唯一制品、双平台 final CI、精确授权、Registry、签名、attestations 与 provenance 回读均已完成
+- [ ] 发布 `1.0.0`：修复多次严格空 reasoning ID 复用和完成态 Web Search `open_page` action；代码 PR 与 main 双平台 CI 已通过，发布证据 final CI、唯一制品与精确授权仍待完成
 - [ ] 再后续独立切片：默认关闭的图片生成（只收内联结果，提交 Harness attachment）
 - [ ] 完成 Windows x64 独立真机验收并按需发布后续稳定修复版
 

package/SECURITY.md

@@ -4,13 +4,17 @@
 
 ## 支持范围
 
-本安全策略对应源码候选版本 `0.1.10`；当前稳定版及 npm Registry 的 `latest` 均为 `0.1.9`。`0.1.8` 曾发布后撤回且版本号不可复用。已发布的 `0.1.9` 完成了失败关闭 fixture 下的隔离 Web Harness `ctx.llm` 四场景验收以及 macOS 14 / Windows 2022 CI，但遗漏 `llm-grok` Host settings namespace，导致 Web/X Search 开关失败关闭为不可用。尚未发布的 `0.1.10` 只修复设置注册和调用快照链路；该链路已通过真实 SettingsProvider/LLM 回归、候选 tarball 隔离安装、设置 API 与浏览器开关写入验收，候选双平台 CI 仍待完成。DeepSeek Harness、Node.js 与操作系统按发布线明确维护；Grok CLI 不使用完整版本字符串作为信任门禁，而是严格校验官方默认路径、命令能力、生产 OIDC 凭据契约和固定服务端协议。图片发送已在真实 Harness 对话中确认可用；Search 协议仍只有失败关闭 fixture 及隔离自动化证据，不覆盖浏览器手工对话、OAuth、真实账号、真实 xAI Search 请求或网络可达 Windows 真机外部浏览器弹出。
+本安全策略对应当前稳定版 `0.1.11`，npm Registry 的 `latest` 也指向 `0.1.11`。`0.1.8` 曾发布后撤回且版本号不可复用。`0.1.11` 在已发布 `0.1.10` 的 Web/X Search Host settings 修复基础上，收窄修复精确 `grok-4.6` 在 High Effort + Web Search 续跑时复用已关闭 reasoning ID 作为空占位的兼容缺口，并加入官方 raw reasoning 事件支持。最终 release commit 为 `2e5c6dbc8bb83377a4db4d8e31452b3ce96500c5`；annotated tag object `353bcd3717d4440ab20a2b05a5e9d51eef22fa7f` peel 到该提交，final CI run `33303080849` 双平台全绿，Trusted Publisher run `33303631312` 发布了仓库所有者明确授权的唯一 71 文件制品。该 tarball 为 207,022 bytes，unpacked size 656,139 bytes，SHA-256 为 `8fca0eca86769ee9febd35606cc8c944a0ae968cec2937a30ccaf68d36d42b2d`，SRI 为 `sha512-2qInRIq5Dkf7CqXq8z1mVvMelStg3nZ1wuWEqsExgfm7iXF0Jn5f7d11IAtHRxdKdJm/j0s8tYT1Dx6IdtGNqg==`；Registry、GitHub Release 与本地字节一致。Registry 隔离安装及 Host/client smoke 通过；`npm audit signatures` 确认安装图中 9 个包具有已验证 Registry 签名、3 个包具有已验证 attestations，本包公开 metadata 包含 1 个 Registry signature、2 个 attestations，provenance 精确绑定 `release.yml`、`v0.1.11`、release commit 与 publish run。DeepSeek Harness、Node.js 与操作系统按发布线明确维护；Grok CLI 不使用完整版本字符串作为信任门禁，而是严格校验官方默认路径、命令能力、生产 OIDC 凭据契约和固定服务端协议。图片发送已在真实 Harness 对话中确认可用；脱敏真实 Search 探针不保存 prompt、回复、检索词、citation URL 或凭据，但也不覆盖浏览器手工对话、OAuth、完整真实会话或网络可达 Windows 真机外部浏览器弹出。
 
-`0.1.10` 沿用已发布版本的图片边界：只为精确 `grok-4.6` 提供有界图片输入；`grok-4.5` 与所有其他模型保持 text-only。普通 user/system 历史中的私有 reasoning 会被省略并保留相邻可见 text/image；只有有效的同 Provider assistant 历史可进入加密 reasoning replay，一层 tool-result 仍只接受公开 text/image。图片只能来自 Harness attachment service 的已验证 JPEG/PNG 投影，以 `detail:"high"` 发送，并受单图字节、像素、边长、数量、总字节与最终 JSON 上限约束；URL、路径、file ID 和调用方预制 data URL 都会被拒绝。
+`1.0.0` 是尚未发布的候选修复，不属于当前支持稳定版，也未获得精确制品发布授权。候选把 reasoning ID 复用收窄为 Search-backed 且严格空的完整生命周期：可见 summary/content 及 summary/raw lifecycle 必须为空，允许有界 opaque `encrypted_content`；每次复用都必须到达自己的 `response.output_item.done`，仅当 `response.incomplete` 到来时仍有复用段未闭合才失败关闭，所有复用段闭合后的 `max_output_tokens` 终态仍有效。非空、跨类型、未知 terminal 字段或 accessor 字段继续拒绝。完成态 Web Search `open_page` 只允许精确且有界的 `type + url`，streamed/final action 的类型与 URL 必须一致，校验后 URL 被丢弃且不会被访问、预览、下载或回放。最终源码的真实账号复验只记录计数与终态：原始 Web/X 协议各完成 1 次、各 64 events，并观察到对应 Search；生产 adapter 共完成 5 次 Responses，direct Web/X 均为 `stop`，Harness 同名 `x_search` 三轮为 `tool-calls`、`tool-calls`、`stop`。未保存结果、URL、prompt、身份或凭据。代码 PR #28 与 main CI run `33308371009` 的双平台门禁已完成；发布证据 final CI、唯一制品、摘要/SRI、授权、发布与 Registry/signature/attestation/provenance 回读仍待完成。
+
+当前源码候选版本为 `1.0.0`；npm Registry 的 `latest` 仍为 `0.1.11`。
+
+`0.1.11` 沿用已发布版本的图片边界：只为精确 `grok-4.6` 提供有界图片输入；`grok-4.5` 与所有其他模型保持 text-only。普通 user/system 历史中的私有 reasoning 会被省略并保留相邻可见 text/image；只有有效的同 Provider assistant 历史可进入加密 reasoning replay，一层 tool-result 仍只接受公开 text/image。图片只能来自 Harness attachment service 的已验证 JPEG/PNG 投影，以 `detail:"high"` 发送，并受单图字节、像素、边长、数量、总字节与最终 JSON 上限约束；URL、路径、file ID 和调用方预制 data URL 都会被拒绝。
 
 `0.1.7` 的闭合运行时诊断、CLI 安装恢复、OIDC timeout 脱敏结算和 `IconThinkOutline16` 兼容层在本版保持不变。官方 CLI 仍负责生成登录 URL 与打开外部浏览器；插件不修复系统 DNS、代理、防火墙、VPN 或 CLI 行为。
 
-`0.1.10` 通过 Harness 官方 settings module 注册 `llm-grok`，按 schema 默认值、组合配置、持久化用户层的顺序解析两个 Search 开关。设置提交只影响之后创建的调用；每个调用在模型发现前冻结一次策略，在途请求不会被后续设置写入改变。Search 仍只为精确 `grok-4.6` 默认关闭地开放。启用后，普通对话内容与模型生成的检索词会交给 xAI，并可能产生额外用量；结果和 citation 属于可能错误或含提示注入的不可信远端数据。Provider 只允许固定 Proxy 实测的 Web lifecycle 与四项 X custom-tool 名称，不把它们映射为 Harness 本地工具，不跟随或下载 citation URL，并在观察到 Search 后放弃该响应的 encrypted reasoning replay。后台 purpose、未验证模型、未启用类别、未知事件和未闭合 lifecycle 均失败关闭。固定路径/argv、最小环境、无 shell、输出上限、凭据、固定 origin 与 URL 拒绝边界不变；本版不新增生成、认证模式或 endpoint。
+已发布的 `0.1.10` 通过 Harness 官方 settings module 注册 `llm-grok`，按 schema 默认值、组合配置、持久化用户层的顺序解析两个 Search 开关；设置提交只影响之后创建的调用。`0.1.11` 不改变这条设置链路，只收窄地扩展响应 codec：已闭合的 reasoning ID 最多可再出现一次，且必须有一个已完成的 server Search 位于两段 reasoning 之间，第二段必须是严格空项；无 Search 间隔、未闭合、跨类型、非空或第二次复用继续失败关闭。空 reasoning 项仍须完整闭合。官方 raw `reasoning_text` 与 summary reasoning 采用互斥状态机，混用、乱序、重复、截断和内容不一致均被拒绝；replay 元数据只保存加密内容及类型标记，不保存 raw 明文，下一请求只发送 `encrypted_content` 与 `summary: []`，不会回传或伪装为 summary；当前流中的 raw delta 仍作为 Harness 可见 reasoning 输出。脱敏真实探针完成 1 次 POST、68 个事件、34 个 summary delta、0 个 raw delta、1 个 finish，因此只能证明当前 summary/Search 路径，raw reasoning 仍只有协议 fixture 证据。Search 继续只为精确 `grok-4.6` 默认关闭地开放；结果和 citation 仍是不可信远端数据，Provider 不把远端 lifecycle 映射为 Harness 本地工具，也不跟随或下载 citation URL。固定路径/argv、最小环境、无 shell、输出上限、凭据、固定 origin 与 URL 拒绝边界不变；本版不新增生成、认证模式或 endpoint。
 
 ## 私下报告漏洞
 
@@ -38,4 +42,8 @@
 
 ---
 
-English summary: GitHub Private vulnerability reporting is enabled and preferred. The current source candidate is `0.1.10`; the current stable release and npm Registry `latest` are both `0.1.9`. Version `0.1.8` was published and then withdrawn, and npm version numbers cannot be reused. Published `0.1.9` passed four isolated Web Harness `ctx.llm` cases and macOS 14 / Windows 2022 CI under fail-closed fixtures, but omitted the `llm-grok` Host settings namespace and therefore left both Search controls unavailable. The unpublished `0.1.10` repair registers that namespace through the canonical Harness settings module and snapshots the current policy once per call before model discovery, so committed changes affect only later calls. Its settings path has passed real SettingsProvider/LLM tests, candidate-tarball isolated install, settings API, and browser switch-write acceptance; candidate dual-platform CI remains pending. Bounded JPEG/PNG input, browser-sign-in diagnostics, credentials, endpoints, fixed-Proxy Search allowlists, citation handling, and platform support remain unchanged. Search stays default-off and limited to exact `grok-4.6`; prompts and model-derived queries reach xAI only when enabled and may incur additional usage. Results and citations are untrusted remote data. Automated fixtures do not cover manual browser conversations, OAuth, a real account, real xAI Search requests, or network-reachable Windows browser launch. Never send credentials, identity data, prompts, tool arguments, cookies, image bytes, Search contents, or unreviewed diagnostics.
+Candidate security note: `1.0.0` is not yet a supported or published release and has no exact-artifact authorization. Its Search-response repair accepts only complete Search-backed strictly empty reasoning reuse (empty visible summary/content and no summary/raw lifecycle, with bounded opaque `encrypted_content` allowed) and exact bounded completed `open_page` type/URL pairs whose streamed and final values agree. Every reuse requires its own `response.output_item.done`; an open/incomplete reused lifecycle, non-empty or cross-type reuse, unknown terminal fields, and accessor-backed Search items or response containers fail closed. A later max-token response remains valid after every reused lifecycle has closed. Final-source redacted probes retained only counts and terminal status, never results, URLs, prompts, identity, or credentials. Code PR #28 and main CI run `33308371009` complete the dual-platform code gate; release-evidence final CI, artifact freezing, publication, and Registry integrity/provenance readback remain pending.
+
+The current source candidate is `1.0.0`; npm Registry `latest` remain `0.1.11` until publication and readback complete.
+
+English summary: GitHub Private vulnerability reporting is enabled and preferred. The current stable release and npm Registry `latest` are both `0.1.11`; version `0.1.8` was published and then withdrawn, and npm version numbers cannot be reused. `0.1.11` repairs the High Effort + Web Search empty reasoning-ID reuse compatibility gap and adds a mutually exclusive official raw `reasoning_text` lifecycle. Annotated tag object `353bcd3717d4440ab20a2b05a5e9d51eef22fa7f` peels to release commit `2e5c6dbc8bb83377a4db4d8e31452b3ce96500c5`; final dual-platform CI run `33303080849` and Trusted Publisher run `33303631312` bind the explicitly authorized artifact. The unique tarball contains 71 files, is 207,022 bytes packed and 656,139 bytes unpacked, has SHA-256 `8fca0eca86769ee9febd35606cc8c944a0ae968cec2937a30ccaf68d36d42b2d` and SRI `sha512-2qInRIq5Dkf7CqXq8z1mVvMelStg3nZ1wuWEqsExgfm7iXF0Jn5f7d11IAtHRxdKdJm/j0s8tYT1Dx6IdtGNqg==`, and is byte-identical across local, GitHub Release, and Registry copies. The exact Registry install passed Host/client smoke; `npm audit signatures` confirmed verified Registry signatures for 9 packages and verified attestations for 3 packages, while public metadata for this package exposes 1 Registry signature and 2 attestations. Provenance exactly binds `release.yml`, `v0.1.11`, the release commit, and publish run. Replay metadata does not retain raw plaintext; later requests carry only `encrypted_content` plus `summary: []`, while live raw deltas remain visible to Harness. A redacted real probe produced one POST, 68 events, 34 summary deltas, zero raw deltas, and one finish, so it verifies only the summary/Search path; raw reasoning remains fixture-verified. Authentication, settings, image input, citations, endpoints, and platform support are unchanged. Network-reachable external-browser launch remains unverified on a real Windows device. Search results and citations remain untrusted remote data. Never send credentials, identity data, prompts, tool arguments, cookies, image bytes, Search contents, or unreviewed diagnostics.