dsh-grok-provider 0.1.11 → 1.0.0

package/CHANGELOG.md

@@ -1,5 +1,15 @@
 # Changelog
 
+## 1.0.0 - 2026-08-30 (candidate)
+
+- Fix the remaining `INVALID_RESPONSE` failures observed with exact `grok-4.6` Search responses by accepting repeated, already Search-backed reasoning IDs only as strictly empty placeholders. "Strictly empty" means no visible summary/content and no summary/raw lifecycle; a bounded opaque `encrypted_content` field remains permitted for replay continuity.
+- Require every reused reasoning lifecycle to reach its own `response.output_item.done`. Incomplete lifecycles, cross-type reuse, reuse before the original item closes or before one completed server Search, non-empty summary/raw content, unknown terminal fields, and accessor-backed terminal fields continue to fail closed.
+- Accept the observed completed Web Search `open_page` action only as the exact bounded `{ type: "open_page", url }` shape, require the streamed and final action type/URL to agree, discard the URL after validation, and never open, fetch, preview, or replay it.
+- Capture Search terminal items and their response containers through own-data snapshots before dispatch or comparison, so self-replacing accessors cannot mutate IDs, inputs, action types, or `open_page` URLs during validation. Once an ID is Search-backed, later empty reuses also short-circuit the completed-Search scan.
+- Add focused protocol regressions for multiple empty reuses, Web/X Search-backed reuse, lifecycle completion, closed reuse followed by max-token completion, opaque encrypted content, nested/container accessor rejection, and `open_page` start/final consistency.
+- Complete two-layer redacted real-account verification without retaining prompts, results, URLs, account identity, or credentials: raw Web/X protocol probes each completed one 64-event response and observed the requested Search kind; the production adapter completed 5 Responses calls, with direct Web/X both ending in `stop` and a Harness-shaped same-name `x_search` flow ending `tool-calls`, `tool-calls`, then `stop`, with one local call in each of the first two turns.
+- Set the source manifest and lockfile to `1.0.0`; pass 245 Node 24 tests (243 pass, 0 fail, 2 platform skips), production audit, deterministic build/bundle comparison, 72-entry dry-run pack, secret scan, and diff check. Code PR #28 and main CI run `33308371009` pass on macOS 14 and Windows 2022. Keep npm `latest` and the supported stable release at `0.1.11` until the release-evidence commit's final CI, frozen artifact, exact owner authorization, publication, Registry readback, signatures, attestations, and provenance are complete. Real-device Windows external-browser launch remains unverified.
+
 ## 0.1.11 - 2026-08-30
 
 - Fix `INVALID_RESPONSE` failures when exact `grok-4.6` at High Effort continues after Web Search by accepting the observed one-time reuse of an already closed reasoning item ID as a new empty reasoning placeholder only after one completed Search, while rejecting open, cross-type, non-empty, or repeated reuse.

package/README.en.md

@@ -4,7 +4,11 @@
 
 Use an already authenticated official Grok Build account from DeepSeek Harness, with dynamic model discovery, streaming reasoning, image input, optional Web/X Search, tool calls, and an account quota/model capability dashboard.
 
-> Unofficial community project; not affiliated with xAI or DeepSeek Harness. The current source candidate is `0.1.11`; the current stable release and npm Registry `latest` are both `0.1.10`. Published `0.1.10` repaired Web/X Search settings registration, but real use later found that `grok-4.6` at High Effort can hit a generic invalid-response error while continuing after Web Search because of a reasoning-lifecycle compatibility gap; unpublished `0.1.11` is the focused protocol repair. Version `0.1.8` was published and then withdrawn and cannot be reused. The project no longer publishes prereleases; stable defects are fixed in a new incremented stable version.
+> Unofficial community project; not affiliated with xAI or DeepSeek Harness. The current stable release and npm Registry `latest` remain `0.1.11`. Version `1.0.0` is an in-development Search-response protocol repair candidate: it is not published, has no frozen unique artifact, and has not received exact-artifact publication authorization. Do not treat its candidate install command or real-account probes as Registry release evidence. Version `0.1.8` was published and then withdrawn and cannot be reused. The project no longer publishes prereleases; stable defects are fixed in a new incremented stable version.
+
+The current source candidate is `1.0.0`; npm Registry `latest` remain `0.1.11` until publication and readback complete.
+
+The `1.0.0` candidate addresses two real upstream shapes: after one completed Search, the same reasoning ID may continue through multiple strictly empty placeholder lifecycles; a completed Web Search may also return an `open_page` action. The candidate accepts only closed, Search-backed, strictly empty reuse and an exact bounded `{ type: "open_page", url }`; it never opens or downloads the URL.
 
 ## What it provides
 
@@ -15,7 +19,7 @@ Use an already authenticated official Grok Build account from DeepSeek Harness,
 | Models | Discovers every model visible to the account at runtime; no static model allowlist |
 | Conversations | Streaming Responses text, reasoning, encrypted reasoning replay, usage, and finish reasons |
 | Images | Only exact `grok-4.6` accepts bounded JPEG/PNG images from Harness attachments; `grok-4.5` and all other models remain text-only |
-| Search | `0.1.10` provides independent, default-off Web Search and X Search for exact `grok-4.6`; the `0.1.11` candidate repairs the High Effort + Web Search reasoning-continuation lifecycle, while remote lifecycles are never misrepresented as local tools |
+| Search | Published `0.1.11` provides default-off Web/X Search for exact `grok-4.6`; the `1.0.0` candidate adds multiple strictly empty reasoning reuses and completed `open_page` actions, while remote lifecycles are never misrepresented as local tools |
 | Tools | Returns function calls to the Harness permission layer; the provider never executes tools |
 | Account dashboard | Login status, weekly/monthly quota, reset time, dynamic model capabilities and reasoning efforts |
 | Surfaces | Bilingual Web settings and a closed `/grok` TUI command set |
@@ -40,13 +44,22 @@ When the network is reachable and OIDC discovery succeeds, the official CLI open
 
 ### 2. Install the provider
 
-`0.1.11` is not published yet. After it is published and read back from the Registry, install that exact version from npm:
+Install the exact published version that has been read back from the Registry:
 
 ```sh
 dsh plugin --profile web add dsh-grok-provider@0.1.11
 dsh web
 ```
 
+After `1.0.0` is published and read back from the Registry, use:
+
+```sh
+dsh plugin --profile web add dsh-grok-provider@1.0.0
+dsh web
+```
+
+Do not treat that candidate command as currently installable; npm `latest` is still `0.1.11`.
+
 ### 3. Sign in and select a model
 
 Open **Settings → Grok Build**:
@@ -130,8 +143,9 @@ Uninstalling the provider does not remove the official Grok CLI or directly modi
 
 ## Sources and discovery
 
-- Current npm stable release: [dsh-grok-provider@0.1.10](https://www.npmjs.com/package/dsh-grok-provider/v/0.1.10) (unique artifact, dual-platform CI, signatures, and provenance verified; known High Effort + Web Search reasoning-compatibility defect)
-- Most recent GitHub release and integrity values: [v0.1.10](https://github.com/yoshino-xiao7/dsh-grok-provider/releases/tag/v0.1.10)
+- Current npm stable release: [dsh-grok-provider@0.1.11](https://www.npmjs.com/package/dsh-grok-provider/v/0.1.11) (unique artifact, dual-platform CI, signatures, attestations, and provenance verified)
+- Most recent GitHub release and integrity values: [v0.1.11](https://github.com/yoshino-xiao7/dsh-grok-provider/releases/tag/v0.1.11)
+- Release evidence: release commit `2e5c6dbc8bb83377a4db4d8e31452b3ce96500c5`, annotated tag object `353bcd3717d4440ab20a2b05a5e9d51eef22fa7f` peeling to that commit, final CI run [`33303080849`](https://github.com/yoshino-xiao7/dsh-grok-provider/actions/runs/33303080849), and Trusted Publisher run [`33303631312`](https://github.com/yoshino-xiao7/dsh-grok-provider/actions/runs/33303631312). The repository owner explicitly authorized the unique 71-file artifact, which is 207,022 bytes packed and 656,139 bytes unpacked; SHA-256 is `8fca0eca86769ee9febd35606cc8c944a0ae968cec2937a30ccaf68d36d42b2d` and SRI is `sha512-2qInRIq5Dkf7CqXq8z1mVvMelStg3nZ1wuWEqsExgfm7iXF0Jn5f7d11IAtHRxdKdJm/j0s8tYT1Dx6IdtGNqg==`. Registry, Release, and local copies are byte-identical, and an isolated Registry install passed Host/client smoke. `npm audit signatures` confirmed verified Registry signatures for 9 packages and verified attestations for 3 packages; this package's public metadata exposes 1 Registry signature and 2 attestations, and provenance binds `release.yml`, `v0.1.11`, the release commit, and publish run exactly.
 - GitHub community discovery: the repository carries the DeepSeek Harness-recommended `dsh-plugin` and `dsh` topics
 - YukiRyou managed source: [deepseek-yukiryou-plugin-catalog](https://github.com/yoshino-xiao7/deepseek-yukiryou-plugin-catalog), still pinned to the real-device-accepted `dsh-grok-provider@0.1.0` and marking only `darwin-arm64`
 
@@ -139,12 +153,21 @@ Directory inclusion is not an endorsement by xAI or DeepSeek Harness. [Listing P
 
 ## Compatibility and scope
 
-| Item | `0.1.10` stable / `0.1.11` candidate status |
+### `1.0.0` candidate repair boundary
+
+- The original reasoning lifecycle must close, and one completed Web/X server Search must precede the first reuse of that ID. Later appearances are accepted only as strictly empty placeholders.
+- "Strictly empty" means empty visible summary/content and no summary/raw lifecycle. A bounded opaque `encrypted_content` value is allowed, but it is not exposed as visible reasoning and upstream plaintext is not retained.
+- Every reuse must receive its own `response.output_item.done`. If `response.incomplete` arrives while a reused lifecycle is still open, the stream maps to the generic invalid-response error; a later `max_output_tokens` terminal remains valid after every reused lifecycle has closed. Non-empty summary/raw data, cross-type reuse, unknown terminal fields, and accessor-backed fields remain rejected.
+- A completed `open_page` action accepts only exact `type + url`; streamed and final action type/URL must agree. The Provider discards the URL after validation and never visits, previews, downloads, or replays it.
+- Two-layer redacted real-account verification passed against the final source: raw Web/X probes each completed one 64-event response, observed the requested Search kind, and reached `completed`; the production adapter completed 5 Responses calls, with direct Web/X both ending in `stop` and a same-name Harness `x_search` flow ending `tool-calls`, `tool-calls`, then `stop`, with one local call in each of the first two turns. No results, URLs, prompts, identity, or credentials were retained; this is not publication, OAuth, or real-device Windows evidence.
+- The manifest and lockfile are synchronized at `1.0.0`; the Node 24 suite reports 245 tests, 243 pass, 0 fail, and 2 platform skips. Production audit reports zero vulnerabilities, and the deterministic build/bundle comparison, 72-entry dry-run pack, secret scan, and diff check pass. Code PR #28 is merged at `yukiryou/main@7a6364dd58f3c7e9e1ad68a3d0197a14254bcb8c`, and main CI run [`33308371009`](https://github.com/yoshino-xiao7/dsh-grok-provider/actions/runs/33308371009) passes on macOS 14 and Windows 2022. The release-evidence commit's final CI, frozen artifact, digest/SRI, exact authorization, publication, and Registry/signature/attestation/provenance readback remain pending.
+
+| Item | Published `0.1.11` status |
 | --- | --- |
 | DeepSeek Harness | Exact support for `0.1.1-rc.2` |
 | Node.js | `>=24.19.0` |
-| macOS arm64 | Image sending has real-Harness confirmation; focused `0.1.11` regressions, the redacted summary/Search probe, and the code merge commit's macOS 14 CI pass; the release-evidence commit's final CI and unique artifact remain pending |
-| Windows x64 | The `0.1.11` code merge commit's Windows 2022 CI and existing slow fakes pass; the release-evidence commit's final CI remains pending. On a reachable network the official CLI generates the URL and opens the browser, and that path still lacks real-device Windows acceptance |
+| macOS arm64 | Image sending has real-Harness confirmation; focused `0.1.11` regressions, the redacted summary/Search probe, final macOS 14 CI, and unique-artifact acceptance all pass |
+| Windows x64 | Final `0.1.11` Windows 2022 CI and existing slow fakes pass. On a reachable network the official CLI generates the URL and opens the browser, and that path still lacks real-device Windows acceptance |
 | macOS x64 / Linux | Unsupported |
 | Grok CLI | No full-version lock; official path, `login --oauth` capability, and production OIDC credential contract are enforced |
 | Models | Every account catalog model whose backend has a strict codec in this release |
@@ -153,7 +176,7 @@ Directory inclusion is not an endorsement by xAI or DeepSeek Harness. [Listing P
 
 Each projected image is limited to 4 MiB, 16,777,216 pixels, and 8192px per side. A request retains at most eight images and 8 MiB of projected image bytes. When a limit is exceeded, the globally oldest images are offloaded to Harness text placeholders; the final JSON remains capped at 16 MiB.
 
-Published `0.1.10` registers and persists both Search settings through the canonical Harness settings module; each new call reads the latest value once before model discovery, while prepared and in-flight calls keep their original snapshot. Real use later found that exact `grok-4.6` at High Effort may close a reasoning item, complete Search, and then reuse the same ID once as an empty placeholder, which the old decoder rejected. The `0.1.11` candidate permits that strictly empty one-time reuse only when a completed Search lies between the two reasoning lifecycles and adds the official raw `reasoning_text` lifecycle. Raw and summary modes are mutually exclusive; replay metadata does not retain raw plaintext, later requests send only `encrypted_content` with an empty summary, and live raw deltas remain visible to Harness as reasoning output. A redacted real probe observed 34 summary deltas and zero raw deltas, so it verifies only the summary/Search path; raw reasoning remains fixture-verified. Search stays default-off and limited to exact `grok-4.6`; remote activity is not projected as a local tool, and citation URLs are never opened or downloaded. Search results are untrusted remote data, so verify sources before commands or file changes. Image generation, arbitrary downloads, API-key mode, multiple accounts, enterprise OIDC, ACP, and Headless agent wrapping remain out of scope; see the [capability roadmap](docs/11-capability-roadmap.md).
+Published `0.1.10` registers and persists both Search settings through the canonical Harness settings module; each new call reads the latest value once before model discovery, while prepared and in-flight calls keep their original snapshot. Real use later found that exact `grok-4.6` at High Effort may close a reasoning item, complete Search, and then reuse the same ID once as an empty placeholder, which the old decoder rejected. Published `0.1.11` permits that strictly empty one-time reuse only when a completed Search lies between the two reasoning lifecycles and adds the official raw `reasoning_text` lifecycle. Raw and summary modes are mutually exclusive; replay metadata does not retain raw plaintext, later requests send only `encrypted_content` with an empty summary, and live raw deltas remain visible to Harness as reasoning output. A redacted real probe observed 34 summary deltas and zero raw deltas, so it verifies only the summary/Search path; raw reasoning remains fixture-verified. Search stays default-off and limited to exact `grok-4.6`; remote activity is not projected as a local tool, and citation URLs are never opened or downloaded. Search results are untrusted remote data, so verify sources before commands or file changes. Image generation, arbitrary downloads, API-key mode, multiple accounts, enterprise OIDC, ACP, and Headless agent wrapping remain out of scope; see the [capability roadmap](docs/11-capability-roadmap.md).
 
 ## How it works
 
@@ -257,7 +280,8 @@ Read the [contributing guide](CONTRIBUTING.md) before filing an issue or PR. Cha
 - [x] Publish `0.1.7`: Provider/CLI version diagnostics, CLI installation recovery, redacted OIDC discovery-timeout settlement, and the `IconThinkOutline16` settings-navigation compatibility layer
 - [x] Publish `0.1.9`: added the Web/X Search protocol and settings page; the unique artifact, dual-platform CI, signatures, and SLSA provenance are verified; post-release verification found the missing Host settings namespace and unusable controls
 - [x] Publish `0.1.10`: `llm-grok` registration, per-call capture, unique artifact, dual-platform CI, signatures, and provenance are complete
-- [ ] Publish `0.1.11`: repair High Effort + Web Search reasoning-lifecycle compatibility; the code PR and main dual-platform CI pass, while release-evidence final CI, the unique artifact, exact authorization, Registry, and provenance readback remain pending
+- [x] Publish `0.1.11`: repair High Effort + Web Search reasoning-lifecycle compatibility; the unique artifact, final dual-platform CI, exact authorization, Registry, signatures, attestations, and provenance readback are complete
+- [ ] Publish `1.0.0`: repair multiple strictly empty reasoning-ID reuses and completed Web Search `open_page` actions; the code PR and main dual-platform CI pass, while release-evidence final CI, the unique artifact, and exact authorization remain pending
 - [ ] A subsequent slice: opt-in image generation (inline results only, committed through Harness attachments)
 - [ ] Complete independent Windows x64 acceptance and publish a later stable fix if needed
 

package/README.md

@@ -4,7 +4,11 @@
 
 让 DeepSeek Harness 使用你已登录的官方 Grok Build 账号：动态模型发现、流式推理、图片输入、可选 Web/X Search、工具调用，以及账号额度与模型能力面板。
 
-> 非官方社区项目，与 xAI 或 DeepSeek Harness 官方无隶属关系。当前源码候选版本为 `0.1.11`；当前稳定版及 npm Registry 的 `latest` 均为 `0.1.10`。已发布的 `0.1.10` 修复了 Web/X Search 设置注册，但真实使用随后发现 `grok-4.6` 在 High Effort + Web Search 续跑时可能因 reasoning 生命周期兼容缺口返回通用非法响应；尚未发布的 `0.1.11` 专门修复该协议兼容问题。`0.1.8` 曾发布后撤回且版本号不可复用。项目不再发行预发行版；正式版缺陷通过新的递增稳定版本修复。
+> 非官方社区项目，与 xAI 或 DeepSeek Harness 官方无隶属关系。当前稳定版及 npm Registry 的 `latest` 仍为 `0.1.11`。`1.0.0` 正在作为 Search 响应协议修复候选开发，尚未发布、尚未冻结唯一制品，也尚未获得精确制品发布授权；不得把候选安装命令或真实账号探针表述为 Registry 发布事实。`0.1.8` 曾发布后撤回且版本号不可复用。项目不再发行预发行版；正式版缺陷通过新的递增稳定版本修复。
+
+当前源码候选版本为 `1.0.0`；npm Registry 的 `latest` 仍为 `0.1.11`。
+
+`1.0.0` 候选解决两类真实上游形状：一次 Search 完成后，同一 reasoning ID 可能继续以多个严格空占位生命周期出现；已完成 Web Search 也可能返回 `open_page` action。候选只接受闭合、Search-backed、严格空的复用，以及精确且有界的 `{ type: "open_page", url }`，不会打开或下载 URL。
 
 ## 它解决什么问题
 
@@ -15,7 +19,7 @@
 | 模型 | 运行时读取账号可见的全部 Grok Build 模型，不维护静态模型白名单 |
 | 对话 | Responses 流式文本、reasoning、加密 reasoning replay、usage 与 finish reason |
 | 图片 | 仅精确 `grok-4.6` 接收 Harness attachment 中有界的 JPEG/PNG 图片；`grok-4.5` 与其他模型保持 text-only |
-| 搜索 | `0.1.10` 已让精确 `grok-4.6` 的 Web Search / X Search 可默认关闭、分别开启；`0.1.11` 候选修复 High Effort + Web Search 续跑的 reasoning 生命周期兼容，远端 lifecycle 仍不伪装成本地工具 |
+| 搜索 | 已发布 `0.1.11` 提供精确 `grok-4.6` 的默认关闭 Web/X Search；`1.0.0` 候选补齐多次严格空 reasoning 复用与完成态 `open_page` action，远端 lifecycle 仍不伪装成本地工具 |
 | 工具 | 将 function call 交回 Harness 权限层；Provider 本身不执行工具 |
 | 账户面板 | 登录状态、每周/月额度、重置时间、动态模型能力与 reasoning 档位 |
 | 界面 | Web 设置页中英文切换；TUI 提供闭合的 `/grok` 命令 |
@@ -40,13 +44,22 @@ grok models
 
 ### 2. 安装 Provider
 
-`0.1.11` 尚未发布；待它发布并完成 Registry 回读后，从 npm 安装该精确版本：
+从 npm 安装已发布并完成 Registry 回读的精确版本：
 
 ```sh
 dsh plugin --profile web add dsh-grok-provider@0.1.11
 dsh web
 ```
 
+`1.0.0` 发布并完成 Registry 回读后，可改用：
+
+```sh
+dsh plugin --profile web add dsh-grok-provider@1.0.0
+dsh web
+```
+
+当前请不要把这条候选命令当作已可安装版本；npm `latest` 仍是 `0.1.11`。
+
 ### 3. 登录并选择模型
 
 打开 **设置 → Grok Build**：
@@ -130,8 +143,9 @@ dsh web
 
 ## 项目来源与发现
 
-- npm 当前稳定版：[dsh-grok-provider@0.1.10](https://www.npmjs.com/package/dsh-grok-provider/v/0.1.10)（唯一制品、双平台 CI、签名与 provenance 已验证；High Effort + Web Search 续跑存在已知 reasoning 兼容缺陷）
-- GitHub 最近发行版与校验值：[v0.1.10](https://github.com/yoshino-xiao7/dsh-grok-provider/releases/tag/v0.1.10)
+- npm 当前稳定版：[dsh-grok-provider@0.1.11](https://www.npmjs.com/package/dsh-grok-provider/v/0.1.11)（唯一制品、双平台 CI、签名、attestations 与 provenance 已验证）
+- GitHub 最近发行版与校验值：[v0.1.11](https://github.com/yoshino-xiao7/dsh-grok-provider/releases/tag/v0.1.11)
+- 发布证据：release commit `2e5c6dbc8bb83377a4db4d8e31452b3ce96500c5`，annotated tag object `353bcd3717d4440ab20a2b05a5e9d51eef22fa7f` peel 至该提交，final CI run [`33303080849`](https://github.com/yoshino-xiao7/dsh-grok-provider/actions/runs/33303080849)，Trusted Publisher run [`33303631312`](https://github.com/yoshino-xiao7/dsh-grok-provider/actions/runs/33303631312)。仓库所有者明确授权的唯一 tarball 含 71 个文件、207,022 bytes，unpacked size 656,139 bytes；SHA-256 为 `8fca0eca86769ee9febd35606cc8c944a0ae968cec2937a30ccaf68d36d42b2d`，SRI 为 `sha512-2qInRIq5Dkf7CqXq8z1mVvMelStg3nZ1wuWEqsExgfm7iXF0Jn5f7d11IAtHRxdKdJm/j0s8tYT1Dx6IdtGNqg==`。Registry、Release 与本地制品逐字节一致，Registry 隔离安装及 Host/client smoke 通过；`npm audit signatures` 确认安装图中 9 个包具有已验证 Registry 签名、3 个包具有已验证 attestations，本包公开 metadata 包含 1 个 Registry signature、2 个 attestations，provenance 精确绑定 `release.yml`、`v0.1.11`、release commit 与 publish run。
 - GitHub 社区发现：仓库已添加 DeepSeek Harness 官方推荐的 `dsh-plugin` 与 `dsh` Topics
 - YukiRyou 受管来源：[deepseek-yukiryou-plugin-catalog](https://github.com/yoshino-xiao7/deepseek-yukiryou-plugin-catalog)，当前仍锁定已完成真机验收的 `dsh-grok-provider@0.1.0`，且只标记 `darwin-arm64`
 
@@ -139,12 +153,21 @@ dsh web
 
 ## 兼容性与范围
 
-| 项目 | `0.1.10` 稳定版 / `0.1.11` 候选状态 |
+### `1.0.0` 候选修复边界
+
+- 一个 reasoning ID 的原始生命周期必须先闭合，并且首次复用前必须已有一个完成的 Web/X server Search；之后只允许它以严格空占位再次出现。
+- “严格空”是指可见 summary/content 为空，且没有 summary/raw lifecycle；允许有界、不透明的 `encrypted_content`，但不会把它当作可见 reasoning 或保存上游明文。
+- 每次复用都必须收到独立的 `response.output_item.done`；若 `response.incomplete` 到来时仍有复用段未闭合，则返回通用非法响应错误，所有复用段已闭合后的 `max_output_tokens` 终态仍有效。非空 summary/raw、跨类型、未知 terminal 字段或 accessor 字段继续拒绝。
+- 完成态 `open_page` 只接受精确 `type + url`，streamed/final action 的类型与 URL 必须一致；Provider 校验后丢弃 URL，不会访问、预览、下载或回放。
+- 最终源码完成两层脱敏真实账号复验：原始 Web/X 协议探针各 1 次请求、各 64 events，分别观察到对应 Search 且终态 `completed`；生产 adapter 共完成 5 次 Responses，direct Web/X 均为 `stop`，Harness 同名 `x_search` 三轮依次为 `tool-calls`、`tool-calls`、`stop`，前两轮各 1 次本地调用。未保存结果、URL、prompt、身份或凭据；这些不是发布、OAuth 或 Windows 真机证据。
+- manifest/lock 已同步为 `1.0.0`；Node 24 全量测试为 245 项、243 pass、0 fail、2 项平台跳过，生产依赖审计为 0 漏洞，确定性 build/bundle、72 项 dry-run pack、秘密模式扫描与 diff 检查均通过。代码 PR #28 已合入 `yukiryou/main@7a6364dd58f3c7e9e1ad68a3d0197a14254bcb8c`，main CI run [`33308371009`](https://github.com/yoshino-xiao7/dsh-grok-provider/actions/runs/33308371009) 的 macOS 14 / Windows 2022 均通过；仍待发布证据提交的 final CI、冻结制品、摘要/SRI、精确授权、发布及 Registry/signature/attestation/provenance 回读。
+
+| 项目 | `0.1.11` 已发布状态 |
 | --- | --- |
 | DeepSeek Harness | 精确支持 `0.1.1-rc.2` |
 | Node.js | `>=24.19.0` |
-| macOS arm64 | 图片发送已完成真实 Harness 验证；`0.1.11` 聚焦回归、脱敏真实 summary/Search 探针及代码 merge commit 的 macOS 14 CI 通过；发布证据提交的 final CI 与唯一制品待关闭 |
-| Windows x64 | `0.1.11` 代码 merge commit 的 Windows 2022 CI 与现有 slow-fake 通过；发布证据提交的 final CI 待关闭。网络可达时由官方 CLI 生成 URL 并打开浏览器，该路径仍未完成 Windows 真机验收 |
+| macOS arm64 | 图片发送已完成真实 Harness 验证；`0.1.11` 聚焦回归、脱敏真实 summary/Search 探针、final macOS 14 CI 与唯一制品验收均通过 |
+| Windows x64 | `0.1.11` final Windows 2022 CI 与现有 slow-fake 通过；网络可达时由官方 CLI 生成 URL 并打开浏览器，该路径仍未完成 Windows 真机验收 |
 | macOS x64 / Linux | 不支持 |
 | Grok CLI | 不锁完整版本；严格校验官方路径、`login --oauth` 能力与生产 OIDC 凭据契约 |
 | 模型 | 当前账号目录中 backend 已被严格 codec 支持的全部模型 |
@@ -153,7 +176,7 @@ dsh web
 
 每张投影图片最多 4 MiB、16,777,216 像素且任一边不超过 8192px；每次请求最多保留 8 张、投影字节合计最多 8 MiB。超限时按全局最旧优先移除图片并保留 Harness 的文本占位，最终 JSON 仍受 16 MiB 上限约束。
 
-已发布的 `0.1.10` 使用 Harness 官方 settings 模块注册并持久化两个 Search 设置；每个新调用在模型发现前读取一次最新值，已准备和在途调用保持原快照。真实使用随后发现精确 `grok-4.6` 在 High Effort + Web Search 续跑时，可能先关闭 reasoning 项，在一次 Search 完成后再把同一 ID 使用一次作为空占位，旧解码器会因此失败关闭。`0.1.11` 候选仅在已完成 Search 位于两段 reasoning 之间时允许该 ID 以严格空项再出现一次，并增加官方 raw `reasoning_text` 生命周期；raw 与 summary 互斥，replay 元数据不保存 raw 明文，后续请求只发送 `encrypted_content` 与空 summary，当前流中的 raw delta 仍会作为 Harness 可见 reasoning 输出。脱敏真实探针观察到 34 个 summary delta、0 个 raw delta，因此只验证 summary/Search 路径，raw reasoning 仍只有 fixture 回归。Search 继续只对精确 `grok-4.6` 默认关闭地开放；远端活动不变成本地工具，citation URL 不会被打开或下载。搜索结果属于不可信远端数据，执行命令或修改文件前应核实来源。图片生成、任意文件下载、API Key 模式、多账号、企业 OIDC、ACP 与 Headless agent 封装仍不在本版本范围内；后续切片见[能力路线图](docs/11-capability-roadmap.md)。
+已发布的 `0.1.10` 使用 Harness 官方 settings 模块注册并持久化两个 Search 设置；每个新调用在模型发现前读取一次最新值，已准备和在途调用保持原快照。真实使用随后发现精确 `grok-4.6` 在 High Effort + Web Search 续跑时，可能先关闭 reasoning 项，在一次 Search 完成后再把同一 ID 使用一次作为空占位，旧解码器会因此失败关闭。已发布的 `0.1.11` 仅在已完成 Search 位于两段 reasoning 之间时允许该 ID 以严格空项再出现一次，并增加官方 raw `reasoning_text` 生命周期；raw 与 summary 互斥，replay 元数据不保存 raw 明文，后续请求只发送 `encrypted_content` 与空 summary，当前流中的 raw delta 仍会作为 Harness 可见 reasoning 输出。脱敏真实探针观察到 34 个 summary delta、0 个 raw delta，因此只验证 summary/Search 路径，raw reasoning 仍只有 fixture 回归。Search 继续只对精确 `grok-4.6` 默认关闭地开放；远端活动不变成本地工具，citation URL 不会被打开或下载。搜索结果属于不可信远端数据，执行命令或修改文件前应核实来源。图片生成、任意文件下载、API Key 模式、多账号、企业 OIDC、ACP 与 Headless agent 封装仍不在本版本范围内；后续切片见[能力路线图](docs/11-capability-roadmap.md)。
 
 ## 工作原理
 
@@ -257,7 +280,8 @@ npm run pack:check
 - [x] 发布 `0.1.7`：Provider/CLI 双版本诊断、CLI 安装恢复、OIDC discovery 超时脱敏结算与 `IconThinkOutline16` 设置导航兼容层
 - [x] 发布 `0.1.9`：加入 Web/X Search 协议与设置页，唯一制品、双平台 CI、签名与 SLSA provenance 均已验证；发布后确认 Host 设置 namespace 遗漏，开关不可用
 - [x] 发布 `0.1.10`：`llm-grok` 注册、按调用读取设置、唯一制品、双平台 CI、签名与 provenance 已完成
-- [ ] 发布 `0.1.11`：修复 High Effort + Web Search reasoning 生命周期兼容；代码 PR 与 main 双平台 CI 已通过，发布证据 final CI、唯一制品、精确授权、Registry 与 provenance 回读待完成
+- [x] 发布 `0.1.11`：修复 High Effort + Web Search reasoning 生命周期兼容；唯一制品、双平台 final CI、精确授权、Registry、签名、attestations 与 provenance 回读均已完成
+- [ ] 发布 `1.0.0`：修复多次严格空 reasoning ID 复用和完成态 Web Search `open_page` action；代码 PR 与 main 双平台 CI 已通过，发布证据 final CI、唯一制品与精确授权仍待完成
 - [ ] 再后续独立切片：默认关闭的图片生成（只收内联结果，提交 Harness attachment）
 - [ ] 完成 Windows x64 独立真机验收并按需发布后续稳定修复版
 

package/SECURITY.md

@@ -4,7 +4,11 @@
 
 ## 支持范围
 
-本安全策略对应源码候选版本 `0.1.11`；当前稳定版及 npm Registry 的 `latest` 均为 `0.1.10`。`0.1.8` 曾发布后撤回且版本号不可复用。已发布的 `0.1.10` 完成唯一制品、macOS 14 / Windows 2022 CI、Registry 字节、签名与 provenance 回读，并修复 Web/X Search 的 Host settings 注册；真实使用随后发现精确 `grok-4.6` 在 High Effort + Web Search 续跑时可能复用已关闭 reasoning ID 作为空占位，旧解码器会失败关闭为通用非法响应。尚未发布的 `0.1.11` 只修复该 reasoning 生命周期兼容并加入官方 raw reasoning 事件支持；代码 PR #25 与 main CI run `33302830043` 双平台已通过，发布证据提交的 final CI、唯一制品、精确授权和发布回读仍待完成。DeepSeek Harness、Node.js 与操作系统按发布线明确维护；Grok CLI 不使用完整版本字符串作为信任门禁，而是严格校验官方默认路径、命令能力、生产 OIDC 凭据契约和固定服务端协议。图片发送已在真实 Harness 对话中确认可用；脱敏真实 Search 探针不保存 prompt、回复、检索词、citation URL 或凭据，但也不覆盖浏览器手工对话、OAuth、完整真实会话或网络可达 Windows 真机外部浏览器弹出。
+本安全策略对应当前稳定版 `0.1.11`，npm Registry 的 `latest` 也指向 `0.1.11`。`0.1.8` 曾发布后撤回且版本号不可复用。`0.1.11` 在已发布 `0.1.10` 的 Web/X Search Host settings 修复基础上，收窄修复精确 `grok-4.6` 在 High Effort + Web Search 续跑时复用已关闭 reasoning ID 作为空占位的兼容缺口，并加入官方 raw reasoning 事件支持。最终 release commit 为 `2e5c6dbc8bb83377a4db4d8e31452b3ce96500c5`；annotated tag object `353bcd3717d4440ab20a2b05a5e9d51eef22fa7f` peel 到该提交，final CI run `33303080849` 双平台全绿，Trusted Publisher run `33303631312` 发布了仓库所有者明确授权的唯一 71 文件制品。该 tarball 为 207,022 bytes，unpacked size 656,139 bytes，SHA-256 为 `8fca0eca86769ee9febd35606cc8c944a0ae968cec2937a30ccaf68d36d42b2d`，SRI 为 `sha512-2qInRIq5Dkf7CqXq8z1mVvMelStg3nZ1wuWEqsExgfm7iXF0Jn5f7d11IAtHRxdKdJm/j0s8tYT1Dx6IdtGNqg==`；Registry、GitHub Release 与本地字节一致。Registry 隔离安装及 Host/client smoke 通过；`npm audit signatures` 确认安装图中 9 个包具有已验证 Registry 签名、3 个包具有已验证 attestations，本包公开 metadata 包含 1 个 Registry signature、2 个 attestations，provenance 精确绑定 `release.yml`、`v0.1.11`、release commit 与 publish run。DeepSeek Harness、Node.js 与操作系统按发布线明确维护；Grok CLI 不使用完整版本字符串作为信任门禁，而是严格校验官方默认路径、命令能力、生产 OIDC 凭据契约和固定服务端协议。图片发送已在真实 Harness 对话中确认可用；脱敏真实 Search 探针不保存 prompt、回复、检索词、citation URL 或凭据，但也不覆盖浏览器手工对话、OAuth、完整真实会话或网络可达 Windows 真机外部浏览器弹出。
+
+`1.0.0` 是尚未发布的候选修复，不属于当前支持稳定版，也未获得精确制品发布授权。候选把 reasoning ID 复用收窄为 Search-backed 且严格空的完整生命周期：可见 summary/content 及 summary/raw lifecycle 必须为空，允许有界 opaque `encrypted_content`；每次复用都必须到达自己的 `response.output_item.done`，仅当 `response.incomplete` 到来时仍有复用段未闭合才失败关闭，所有复用段闭合后的 `max_output_tokens` 终态仍有效。非空、跨类型、未知 terminal 字段或 accessor 字段继续拒绝。完成态 Web Search `open_page` 只允许精确且有界的 `type + url`，streamed/final action 的类型与 URL 必须一致，校验后 URL 被丢弃且不会被访问、预览、下载或回放。最终源码的真实账号复验只记录计数与终态：原始 Web/X 协议各完成 1 次、各 64 events，并观察到对应 Search；生产 adapter 共完成 5 次 Responses，direct Web/X 均为 `stop`，Harness 同名 `x_search` 三轮为 `tool-calls`、`tool-calls`、`stop`。未保存结果、URL、prompt、身份或凭据。代码 PR #28 与 main CI run `33308371009` 的双平台门禁已完成；发布证据 final CI、唯一制品、摘要/SRI、授权、发布与 Registry/signature/attestation/provenance 回读仍待完成。
+
+当前源码候选版本为 `1.0.0`；npm Registry 的 `latest` 仍为 `0.1.11`。
 
 `0.1.11` 沿用已发布版本的图片边界：只为精确 `grok-4.6` 提供有界图片输入；`grok-4.5` 与所有其他模型保持 text-only。普通 user/system 历史中的私有 reasoning 会被省略并保留相邻可见 text/image；只有有效的同 Provider assistant 历史可进入加密 reasoning replay，一层 tool-result 仍只接受公开 text/image。图片只能来自 Harness attachment service 的已验证 JPEG/PNG 投影，以 `detail:"high"` 发送，并受单图字节、像素、边长、数量、总字节与最终 JSON 上限约束；URL、路径、file ID 和调用方预制 data URL 都会被拒绝。
 
@@ -38,4 +42,8 @@
 
 ---
 
-English summary: GitHub Private vulnerability reporting is enabled and preferred. The current source candidate is `0.1.11`; the current stable release and npm Registry `latest` are both `0.1.10`. Version `0.1.8` was published and then withdrawn, and npm version numbers cannot be reused. Published `0.1.10` completed unique-artifact, macOS 14 / Windows 2022 CI, Registry-byte, signature, and provenance verification and repaired Host Search settings registration. Real use later found that exact `grok-4.6` at High Effort may close a reasoning ID, complete Search, and then reuse it once as an empty placeholder, which the old decoder rejected. Unpublished `0.1.11` permits that strictly empty reuse only when a completed server Search lies between the two reasoning lifecycles, accepts fully closed empty reasoning items, and adds a mutually exclusive official raw `reasoning_text` lifecycle. Replay metadata does not retain raw plaintext; later requests carry only `encrypted_content` plus `summary: []`, while live raw deltas remain visible to Harness. A redacted real probe produced one POST, 68 events, 34 summary deltas, zero raw deltas, and one finish, so it verifies only the summary/Search path; raw reasoning remains fixture-verified. Code PR #25 and main CI run `33302830043` passed on macOS 14 and Windows 2022; the release-evidence commit's final CI, the unique artifact, exact authorization, and release readback remain pending. Authentication, settings, image input, citations, endpoints, and platform support are unchanged. Search results and citations remain untrusted remote data. Never send credentials, identity data, prompts, tool arguments, cookies, image bytes, Search contents, or unreviewed diagnostics.
+Candidate security note: `1.0.0` is not yet a supported or published release and has no exact-artifact authorization. Its Search-response repair accepts only complete Search-backed strictly empty reasoning reuse (empty visible summary/content and no summary/raw lifecycle, with bounded opaque `encrypted_content` allowed) and exact bounded completed `open_page` type/URL pairs whose streamed and final values agree. Every reuse requires its own `response.output_item.done`; an open/incomplete reused lifecycle, non-empty or cross-type reuse, unknown terminal fields, and accessor-backed Search items or response containers fail closed. A later max-token response remains valid after every reused lifecycle has closed. Final-source redacted probes retained only counts and terminal status, never results, URLs, prompts, identity, or credentials. Code PR #28 and main CI run `33308371009` complete the dual-platform code gate; release-evidence final CI, artifact freezing, publication, and Registry integrity/provenance readback remain pending.
+
+The current source candidate is `1.0.0`; npm Registry `latest` remain `0.1.11` until publication and readback complete.
+
+English summary: GitHub Private vulnerability reporting is enabled and preferred. The current stable release and npm Registry `latest` are both `0.1.11`; version `0.1.8` was published and then withdrawn, and npm version numbers cannot be reused. `0.1.11` repairs the High Effort + Web Search empty reasoning-ID reuse compatibility gap and adds a mutually exclusive official raw `reasoning_text` lifecycle. Annotated tag object `353bcd3717d4440ab20a2b05a5e9d51eef22fa7f` peels to release commit `2e5c6dbc8bb83377a4db4d8e31452b3ce96500c5`; final dual-platform CI run `33303080849` and Trusted Publisher run `33303631312` bind the explicitly authorized artifact. The unique tarball contains 71 files, is 207,022 bytes packed and 656,139 bytes unpacked, has SHA-256 `8fca0eca86769ee9febd35606cc8c944a0ae968cec2937a30ccaf68d36d42b2d` and SRI `sha512-2qInRIq5Dkf7CqXq8z1mVvMelStg3nZ1wuWEqsExgfm7iXF0Jn5f7d11IAtHRxdKdJm/j0s8tYT1Dx6IdtGNqg==`, and is byte-identical across local, GitHub Release, and Registry copies. The exact Registry install passed Host/client smoke; `npm audit signatures` confirmed verified Registry signatures for 9 packages and verified attestations for 3 packages, while public metadata for this package exposes 1 Registry signature and 2 attestations. Provenance exactly binds `release.yml`, `v0.1.11`, the release commit, and publish run. Replay metadata does not retain raw plaintext; later requests carry only `encrypted_content` plus `summary: []`, while live raw deltas remain visible to Harness. A redacted real probe produced one POST, 68 events, 34 summary deltas, zero raw deltas, and one finish, so it verifies only the summary/Search path; raw reasoning remains fixture-verified. Authentication, settings, image input, citations, endpoints, and platform support are unchanged. Network-reachable external-browser launch remains unverified on a real Windows device. Search results and citations remain untrusted remote data. Never send credentials, identity data, prompts, tool arguments, cookies, image bytes, Search contents, or unreviewed diagnostics.