dsh-grok-provider 0.1.11 → 1.0.1

package/CHANGELOG.md

@@ -1,5 +1,23 @@
 # Changelog
 
+## 1.0.1 - Unreleased
+
+- Fix fixed-Proxy HTTP 400 failures when enabled xAI server `web_search` / `x_search` descriptors coexist with Harness function definitions using the same reserved names. Every source function is still fully validated first; only the definitions whose names collide with enabled server tools are omitted from the wire request. The same local functions remain available whenever the corresponding server Search setting is off.
+- Preserve historical `function_call` / `function_call_output` items, including prior `web_search` and `x_search` calls, so an existing conversation can continue without rewriting or discarding its tool history. Bind the response decoder to a receipt that rejects any function/server-tool name intersection.
+- Preserve transport failures raised while reading the SSE source instead of relabeling them as parser failures. Fixed-Proxy HTTP 400 maps to `PROVIDER_ERROR`; focused adapter coverage also locks 401/403 to `AUTH`, 429 to `RATE_LIMIT`, and `AbortError` to `ABORTED`, while malformed, truncated, or unsupported SSE continues to map to `INVALID_RESPONSE`.
+- Complete one redacted real-account replay of the original failing X-session structure: 8 messages and 40 source functions compiled to 38 function definitions plus 2 server Search descriptors while preserving 2 historical reserved-name calls. One models GET and one Responses POST yielded 314 events and `response.completed`. No message text, result text, URL, account identity, or credential was retained.
+- Set the source manifest and lockfile to the unpublished `1.0.1` candidate. The exact Node `24.19.0` local suite passes with 253 tests, 251 pass, 0 fail, and 2 platform skips; the production dependency audit reports zero vulnerabilities, an isolated-cache dry-run pack lists 73 files, and the secret-pattern scan finds only the explicit fixture canary and its checklist record. Code PR #31, its push/PR CI, merge commit `0c60200e12c3b8455331f31a317ece9b1945c458`, and main CI run `33312621786` passed on macOS 14 and Windows 2022. A fixed final release commit, frozen artifact, isolated installation, Registry publication, signatures, attestations, provenance, and real-device Windows validation remain pending and must not be inferred from local or code-merge gates.
+
+## 1.0.0 - 2026-08-30
+
+- Fix the remaining `INVALID_RESPONSE` failures observed with exact `grok-4.6` Search responses by accepting repeated, already Search-backed reasoning IDs only as strictly empty placeholders. "Strictly empty" means no visible summary/content and no summary/raw lifecycle; a bounded opaque `encrypted_content` field remains permitted for replay continuity.
+- Require every reused reasoning lifecycle to reach its own `response.output_item.done`. Incomplete lifecycles, cross-type reuse, reuse before the original item closes or before one completed server Search, non-empty summary/raw content, unknown terminal fields, and accessor-backed terminal fields continue to fail closed.
+- Accept the observed completed Web Search `open_page` action only as the exact bounded `{ type: "open_page", url }` shape, require the streamed and final action type/URL to agree, discard the URL after validation, and never open, fetch, preview, or replay it.
+- Capture Search terminal items and their response containers through own-data snapshots before dispatch or comparison, so self-replacing accessors cannot mutate IDs, inputs, action types, or `open_page` URLs during validation. Once an ID is Search-backed, later empty reuses also short-circuit the completed-Search scan.
+- Add focused protocol regressions for multiple empty reuses, Web/X Search-backed reuse, lifecycle completion, closed reuse followed by max-token completion, opaque encrypted content, nested/container accessor rejection, and `open_page` start/final consistency.
+- Complete two-layer redacted real-account verification without retaining prompts, results, URLs, account identity, or credentials: raw Web/X protocol probes each completed one 64-event response and observed the requested Search kind; the production adapter completed 5 Responses calls, with direct Web/X both ending in `stop` and a Harness-shaped local `x_search` call/result continuation ending `tool-calls`, `tool-calls`, then `stop`, with one local call in each of the first two turns. That continuation did not place a Harness `x_search` function definition beside an xAI `{ type: "x_search" }` server descriptor in the same wire request; `1.0.1` later isolated that combination as an HTTP 400 conflict.
+- Set the source manifest and lockfile to `1.0.0`; pass 245 Node 24 tests (243 pass, 0 fail, 2 platform skips), production audit, deterministic build/bundle comparison, 72-entry dry-run pack, secret scan, and diff check. Code PR #28 and main CI run `33308371009` passed on macOS 14 and Windows 2022. Release commit `c6548199582b122f1d285422eabea0205eaf602f` passed final dual-platform CI run `33308603394`; annotated tag object `192561cda1ac58cbc4077f0de8fa614dff9a5557` peels to that commit. Trusted Publisher run `33309083806` attempt 1 published the explicitly authorized unique 72-file artifact: 226,704 bytes packed, 715,014 bytes unpacked, SHA-1 `50e5d898dba241d1e19def7705db216e3060b892`, SHA-256 `30cd83dad77f7d2611126b3c4737c8fabffeae79f385fa623e61dcecfe39f5e2`, and SRI `sha512-WL2f6Kfg5yT5nNf1p4//mLSajCnZttL/pDR3BISrFgSGtZd9DEJlnibq08ETz503n1wHIdCBcU/ICMPG9K4vOw==`. The frozen candidate, GitHub Release, and npm tarballs are byte-identical; npm reports `latest=1.0.0`, the isolated Node 24 Host `name`/`apply` and client `id` smoke passed, package metadata exposes 1 signature and 2 attestations, `npm audit signatures` verified 11 signed packages and 2 attestations, and SLSA provenance binds the tag, workflow, commit, and publish run. Real-device Windows external-browser launch remains unverified.
+
 ## 0.1.11 - 2026-08-30
 
 - Fix `INVALID_RESPONSE` failures when exact `grok-4.6` at High Effort continues after Web Search by accepting the observed one-time reuse of an already closed reasoning item ID as a new empty reasoning placeholder only after one completed Search, while rejecting open, cross-type, non-empty, or repeated reuse.

package/README.en.md

@@ -4,7 +4,11 @@
 
 Use an already authenticated official Grok Build account from DeepSeek Harness, with dynamic model discovery, streaming reasoning, image input, optional Web/X Search, tool calls, and an account quota/model capability dashboard.
 
-> Unofficial community project; not affiliated with xAI or DeepSeek Harness. The current source candidate is `0.1.11`; the current stable release and npm Registry `latest` are both `0.1.10`. Published `0.1.10` repaired Web/X Search settings registration, but real use later found that `grok-4.6` at High Effort can hit a generic invalid-response error while continuing after Web Search because of a reasoning-lifecycle compatibility gap; unpublished `0.1.11` is the focused protocol repair. Version `0.1.8` was published and then withdrawn and cannot be reused. The project no longer publishes prereleases; stable defects are fixed in a new incremented stable version.
+> Unofficial community project; not affiliated with xAI or DeepSeek Harness. The current stable release and npm Registry `latest` are both `1.0.0`. Source is preparing an unpublished `1.0.1` repair candidate; version `0.1.8` was published and then withdrawn and cannot be reused.
+
+The current source candidate is `1.0.1`; npm Registry `latest` is `1.0.0`. Continue installing `1.0.0` until a `1.0.1` artifact is frozen, receives separate exact publication authorization, and completes Registry readback.
+
+The `1.0.1` candidate fixes another real Search failure: when xAI server `web_search` / `x_search` is enabled, same-name Harness function definitions alongside those server tools cause fixed-Proxy HTTP 400. The candidate fully validates every function before omitting only enabled-name collisions from the wire definitions; historical function calls/results remain. The SSE layer also propagates transport errors, so HTTP 400 surfaces as `PROVIDER_ERROR` instead of a misleading `INVALID_RESPONSE`.
 
 ## What it provides
 
@@ -15,8 +19,8 @@ Use an already authenticated official Grok Build account from DeepSeek Harness,
 | Models | Discovers every model visible to the account at runtime; no static model allowlist |
 | Conversations | Streaming Responses text, reasoning, encrypted reasoning replay, usage, and finish reasons |
 | Images | Only exact `grok-4.6` accepts bounded JPEG/PNG images from Harness attachments; `grok-4.5` and all other models remain text-only |
-| Search | `0.1.10` provides independent, default-off Web Search and X Search for exact `grok-4.6`; the `0.1.11` candidate repairs the High Effort + Web Search reasoning-continuation lifecycle, while remote lifecycles are never misrepresented as local tools |
-| Tools | Returns function calls to the Harness permission layer; the provider never executes tools |
+| Search | Published `1.0.0` provides default-off Web/X Search for exact `grok-4.6`; the `1.0.1` candidate resolves HTTP 400 conflicts between server Search and same-name Harness function definitions |
+| Tools | Returns function calls to the Harness permission layer; the provider never executes tools, and local `web_search` / `x_search` remain when the corresponding Search setting is off |
 | Account dashboard | Login status, weekly/monthly quota, reset time, dynamic model capabilities and reasoning efforts |
 | Surfaces | Bilingual Web settings and a closed `/grok` TUI command set |
 
@@ -40,10 +44,10 @@ When the network is reachable and OIDC discovery succeeds, the official CLI open
 
 ### 2. Install the provider
 
-`0.1.11` is not published yet. After it is published and read back from the Registry, install that exact version from npm:
+Install the exact published version that has been read back from the Registry:
 
 ```sh
-dsh plugin --profile web add dsh-grok-provider@0.1.11
+dsh plugin --profile web add dsh-grok-provider@1.0.0
 dsh web
 ```
 
@@ -130,8 +134,9 @@ Uninstalling the provider does not remove the official Grok CLI or directly modi
 
 ## Sources and discovery
 
-- Current npm stable release: [dsh-grok-provider@0.1.10](https://www.npmjs.com/package/dsh-grok-provider/v/0.1.10) (unique artifact, dual-platform CI, signatures, and provenance verified; known High Effort + Web Search reasoning-compatibility defect)
-- Most recent GitHub release and integrity values: [v0.1.10](https://github.com/yoshino-xiao7/dsh-grok-provider/releases/tag/v0.1.10)
+- Current npm stable release: [dsh-grok-provider@1.0.0](https://www.npmjs.com/package/dsh-grok-provider/v/1.0.0) (unique artifact, dual-platform CI, signatures, attestations, and provenance verified)
+- Most recent GitHub release and integrity values: [v1.0.0](https://github.com/yoshino-xiao7/dsh-grok-provider/releases/tag/v1.0.0)
+- Release evidence: release commit `c6548199582b122f1d285422eabea0205eaf602f`, annotated tag object `192561cda1ac58cbc4077f0de8fa614dff9a5557` peeling to that commit, final CI run [`33308603394`](https://github.com/yoshino-xiao7/dsh-grok-provider/actions/runs/33308603394), and Trusted Publisher run [`33309083806` attempt 1](https://github.com/yoshino-xiao7/dsh-grok-provider/actions/runs/33309083806/attempts/1). The repository owner explicitly authorized the unique 72-file artifact, which is 226,704 bytes packed and 715,014 bytes unpacked; SHA-1 is `50e5d898dba241d1e19def7705db216e3060b892`, SHA-256 is `30cd83dad77f7d2611126b3c4737c8fabffeae79f385fa623e61dcecfe39f5e2`, and SRI is `sha512-WL2f6Kfg5yT5nNf1p4//mLSajCnZttL/pDR3BISrFgSGtZd9DEJlnibq08ETz503n1wHIdCBcU/ICMPG9K4vOw==`. Frozen-candidate, GitHub Release, and npm Registry copies are byte-identical; an isolated Node 24 install passed Host `name`/`apply` and client `id` smoke checks. `npm audit signatures` confirmed verified Registry signatures for 11 packages and verified attestations for 2 packages; this package's public metadata exposes 1 Registry signature and 2 attestations, and provenance binds `release.yml`, `v1.0.0`, the release commit, and publish run exactly.
 - GitHub community discovery: the repository carries the DeepSeek Harness-recommended `dsh-plugin` and `dsh` topics
 - YukiRyou managed source: [deepseek-yukiryou-plugin-catalog](https://github.com/yoshino-xiao7/deepseek-yukiryou-plugin-catalog), still pinned to the real-device-accepted `dsh-grok-provider@0.1.0` and marking only `darwin-arm64`
 
@@ -139,12 +144,29 @@ Directory inclusion is not an endorsement by xAI or DeepSeek Harness. [Listing P
 
 ## Compatibility and scope
 
-| Item | `0.1.10` stable / `0.1.11` candidate status |
+### `1.0.1` candidate repair boundary
+
+- The cause is not the model, account, Search response shape, or a 42-tool total. It is the coexistence of a same-name Harness function definition with `{ type: "web_search" }` / `{ type: "x_search" }` when server Search is enabled; the fixed Proxy returns HTTP 400 for that combination.
+- The compiler fully validates all 40 source functions before omitting only wire definitions that collide with an enabled server Search tool. Local tools remain unchanged when the corresponding setting is off, and historical `function_call` / `function_call_output` items are neither deleted nor renamed.
+- The final request receipt rejects every function/server-tool name intersection. The SSE parser preserves source transport errors, so HTTP 400 maps to `PROVIDER_ERROR` while genuine SSE/protocol faults remain `INVALID_RESPONSE`.
+- One explicitly authorized redacted real-account replay used the original failing X-session structure: 8 messages, 40 source functions, 38 wire functions + 2 server tools, with 2 historical reserved-name calls preserved. Exactly 1 models GET and 1 Responses POST yielded 314 events and `response.completed`. No message/response text, URL, identity, or credential was retained.
+- The exact Node `24.19.0` local suite reports 253 tests, 251 pass, 0 fail, and 2 platform skips; the production dependency audit reports zero vulnerabilities, an isolated-cache dry-run pack lists 73 files, and the secret-pattern scan finds only the explicit fixture canary and its checklist record. Code PR #31 push/PR CI, merge commit `0c60200e12c3b8455331f31a317ece9b1945c458`, and main CI run `33312621786` pass on macOS 14 and Windows 2022. This evidence still does not establish a fixed final release commit, frozen artifact, isolated installation, publication, supply-chain readback, or real-device Windows browser login. See [`docs/releases/v1.0.1.md`](docs/releases/v1.0.1.md) for candidate details.
+
+### `1.0.0` repair boundary
+
+- The original reasoning lifecycle must close, and one completed Web/X server Search must precede the first reuse of that ID. Later appearances are accepted only as strictly empty placeholders.
+- "Strictly empty" means empty visible summary/content and no summary/raw lifecycle. A bounded opaque `encrypted_content` value is allowed, but it is not exposed as visible reasoning and upstream plaintext is not retained.
+- Every reuse must receive its own `response.output_item.done`. If `response.incomplete` arrives while a reused lifecycle is still open, the stream maps to the generic invalid-response error; a later `max_output_tokens` terminal remains valid after every reused lifecycle has closed. Non-empty summary/raw data, cross-type reuse, unknown terminal fields, and accessor-backed fields remain rejected.
+- A completed `open_page` action accepts only exact `type + url`; streamed and final action type/URL must agree. The Provider discards the URL after validation and never visits, previews, downloads, or replays it.
+- Two-layer redacted real-account verification passed against the final source: raw Web/X probes each completed one 64-event response, observed the requested Search kind, and reached `completed`; the production adapter completed 5 Responses calls, with direct Web/X both ending in `stop` and a Harness-shaped local `x_search` call/result continuation ending `tool-calls`, `tool-calls`, then `stop`, with one local call in each of the first two turns. That continuation did not place a Harness `x_search` function definition beside an xAI `{ type: "x_search" }` server descriptor in the same wire request; `1.0.1` later isolated that combination as an HTTP 400 conflict. No results, URLs, prompts, identity, or credentials were retained; this is not publication, OAuth, or real-device Windows evidence.
+- The manifest and lockfile are synchronized at `1.0.0`; the Node 24 suite reports 245 tests, 243 pass, 0 fail, and 2 platform skips. Production audit reports zero vulnerabilities, and the deterministic build/bundle comparison, 72-entry dry-run pack, secret scan, and diff check pass. Code PR #28, main CI run [`33308371009`](https://github.com/yoshino-xiao7/dsh-grok-provider/actions/runs/33308371009), the final release commit, dual-platform final CI, unique artifact, exact authorization, and Registry/signature/attestation/provenance readback are complete.
+
+| Item | Published `1.0.0` status |
 | --- | --- |
 | DeepSeek Harness | Exact support for `0.1.1-rc.2` |
 | Node.js | `>=24.19.0` |
-| macOS arm64 | Image sending has real-Harness confirmation; focused `0.1.11` regressions, the redacted summary/Search probe, and the code merge commit's macOS 14 CI pass; the release-evidence commit's final CI and unique artifact remain pending |
-| Windows x64 | The `0.1.11` code merge commit's Windows 2022 CI and existing slow fakes pass; the release-evidence commit's final CI remains pending. On a reachable network the official CLI generates the URL and opens the browser, and that path still lacks real-device Windows acceptance |
+| macOS arm64 | Image sending has real-Harness confirmation; focused `1.0.0` regressions, the redacted Search probes, final macOS 14 CI, and unique-artifact acceptance all pass |
+| Windows x64 | Final `1.0.0` Windows 2022 CI and existing slow fakes pass. On a reachable network the official CLI generates the URL and opens the browser, and that path still lacks real-device Windows acceptance |
 | macOS x64 / Linux | Unsupported |
 | Grok CLI | No full-version lock; official path, `login --oauth` capability, and production OIDC credential contract are enforced |
 | Models | Every account catalog model whose backend has a strict codec in this release |
@@ -153,7 +175,7 @@ Directory inclusion is not an endorsement by xAI or DeepSeek Harness. [Listing P
 
 Each projected image is limited to 4 MiB, 16,777,216 pixels, and 8192px per side. A request retains at most eight images and 8 MiB of projected image bytes. When a limit is exceeded, the globally oldest images are offloaded to Harness text placeholders; the final JSON remains capped at 16 MiB.
 
-Published `0.1.10` registers and persists both Search settings through the canonical Harness settings module; each new call reads the latest value once before model discovery, while prepared and in-flight calls keep their original snapshot. Real use later found that exact `grok-4.6` at High Effort may close a reasoning item, complete Search, and then reuse the same ID once as an empty placeholder, which the old decoder rejected. The `0.1.11` candidate permits that strictly empty one-time reuse only when a completed Search lies between the two reasoning lifecycles and adds the official raw `reasoning_text` lifecycle. Raw and summary modes are mutually exclusive; replay metadata does not retain raw plaintext, later requests send only `encrypted_content` with an empty summary, and live raw deltas remain visible to Harness as reasoning output. A redacted real probe observed 34 summary deltas and zero raw deltas, so it verifies only the summary/Search path; raw reasoning remains fixture-verified. Search stays default-off and limited to exact `grok-4.6`; remote activity is not projected as a local tool, and citation URLs are never opened or downloaded. Search results are untrusted remote data, so verify sources before commands or file changes. Image generation, arbitrary downloads, API-key mode, multiple accounts, enterprise OIDC, ACP, and Headless agent wrapping remain out of scope; see the [capability roadmap](docs/11-capability-roadmap.md).
+Published `0.1.10` registers and persists both Search settings through the canonical Harness settings module; each new call reads the latest value once before model discovery, while prepared and in-flight calls keep their original snapshot. Real use later found that exact `grok-4.6` at High Effort may close a reasoning item, complete Search, and then reuse the same ID once as an empty placeholder, which the old decoder rejected. Published `0.1.11` permits that strictly empty one-time reuse only when a completed Search lies between the two reasoning lifecycles and adds the official raw `reasoning_text` lifecycle. Raw and summary modes are mutually exclusive; replay metadata does not retain raw plaintext, later requests send only `encrypted_content` with an empty summary, and live raw deltas remain visible to Harness as reasoning output. A redacted real probe observed 34 summary deltas and zero raw deltas, so it verifies only the summary/Search path; raw reasoning remains fixture-verified. Search stays default-off and limited to exact `grok-4.6`; remote activity is not projected as a local tool, and citation URLs are never opened or downloaded. Search results are untrusted remote data, so verify sources before commands or file changes. Image generation, arbitrary downloads, API-key mode, multiple accounts, enterprise OIDC, ACP, and Headless agent wrapping remain out of scope; see the [capability roadmap](docs/11-capability-roadmap.md).
 
 ## How it works
 
@@ -257,7 +279,8 @@ Read the [contributing guide](CONTRIBUTING.md) before filing an issue or PR. Cha
 - [x] Publish `0.1.7`: Provider/CLI version diagnostics, CLI installation recovery, redacted OIDC discovery-timeout settlement, and the `IconThinkOutline16` settings-navigation compatibility layer
 - [x] Publish `0.1.9`: added the Web/X Search protocol and settings page; the unique artifact, dual-platform CI, signatures, and SLSA provenance are verified; post-release verification found the missing Host settings namespace and unusable controls
 - [x] Publish `0.1.10`: `llm-grok` registration, per-call capture, unique artifact, dual-platform CI, signatures, and provenance are complete
-- [ ] Publish `0.1.11`: repair High Effort + Web Search reasoning-lifecycle compatibility; the code PR and main dual-platform CI pass, while release-evidence final CI, the unique artifact, exact authorization, Registry, and provenance readback remain pending
+- [x] Publish `0.1.11`: repair High Effort + Web Search reasoning-lifecycle compatibility; the unique artifact, final dual-platform CI, exact authorization, Registry, signatures, attestations, and provenance readback are complete
+- [x] Publish `1.0.0`: repair multiple strictly empty reasoning-ID reuses and completed Web Search `open_page` actions; the unique artifact, final dual-platform CI, exact authorization, Registry, signatures, attestations, and provenance readback are complete
 - [ ] A subsequent slice: opt-in image generation (inline results only, committed through Harness attachments)
 - [ ] Complete independent Windows x64 acceptance and publish a later stable fix if needed
 

package/README.md

@@ -4,7 +4,11 @@
 
 让 DeepSeek Harness 使用你已登录的官方 Grok Build 账号：动态模型发现、流式推理、图片输入、可选 Web/X Search、工具调用，以及账号额度与模型能力面板。
 
-> 非官方社区项目，与 xAI 或 DeepSeek Harness 官方无隶属关系。当前源码候选版本为 `0.1.11`；当前稳定版及 npm Registry 的 `latest` 均为 `0.1.10`。已发布的 `0.1.10` 修复了 Web/X Search 设置注册，但真实使用随后发现 `grok-4.6` 在 High Effort + Web Search 续跑时可能因 reasoning 生命周期兼容缺口返回通用非法响应；尚未发布的 `0.1.11` 专门修复该协议兼容问题。`0.1.8` 曾发布后撤回且版本号不可复用。项目不再发行预发行版；正式版缺陷通过新的递增稳定版本修复。
+> 非官方社区项目，与 xAI 或 DeepSeek Harness 官方无隶属关系。当前稳定版及 npm Registry 的 `latest` 均为 `1.0.0`。源码正在准备尚未发布的 `1.0.1` 修复候选；`0.1.8` 曾发布后撤回且版本号不可复用。
+
+当前源码候选版为 `1.0.1`；npm Registry 的 `latest` 为 `1.0.0`。在 `1.0.1` 制品冻结、另行获得精确发布授权并完成 Registry 回读前，请继续安装 `1.0.0`。
+
+`1.0.1` 候选修复另一类真实 Search 失败：启用 xAI server `web_search` / `x_search` 时，Harness 同名 function definitions 与 server tools 共存会被固定 Proxy 以 HTTP 400 拒绝。候选先完整验证全部 functions，再只过滤已启用的同名 wire definition；历史 function calls/results 保留。SSE 层也会透传 transport error，使 HTTP 400 显示为 `PROVIDER_ERROR`，而不是误报 `INVALID_RESPONSE`。
 
 ## 它解决什么问题
 
@@ -15,8 +19,8 @@
 | 模型 | 运行时读取账号可见的全部 Grok Build 模型，不维护静态模型白名单 |
 | 对话 | Responses 流式文本、reasoning、加密 reasoning replay、usage 与 finish reason |
 | 图片 | 仅精确 `grok-4.6` 接收 Harness attachment 中有界的 JPEG/PNG 图片；`grok-4.5` 与其他模型保持 text-only |
-| 搜索 | `0.1.10` 已让精确 `grok-4.6` 的 Web Search / X Search 可默认关闭、分别开启；`0.1.11` 候选修复 High Effort + Web Search 续跑的 reasoning 生命周期兼容，远端 lifecycle 仍不伪装成本地工具 |
-| 工具 | 将 function call 交回 Harness 权限层；Provider 本身不执行工具 |
+| 搜索 | 已发布 `1.0.0` 为精确 `grok-4.6` 提供默认关闭的 Web/X Search；`1.0.1` 候选解决 server Search 与 Harness 同名 function definition 的 HTTP 400 冲突 |
+| 工具 | 将 function call 交回 Harness 权限层；Provider 本身不执行工具，关闭对应 Search 开关时保留本地 `web_search` / `x_search` |
 | 账户面板 | 登录状态、每周/月额度、重置时间、动态模型能力与 reasoning 档位 |
 | 界面 | Web 设置页中英文切换；TUI 提供闭合的 `/grok` 命令 |
 
@@ -40,10 +44,10 @@ grok models
 
 ### 2. 安装 Provider
 
-`0.1.11` 尚未发布；待它发布并完成 Registry 回读后，从 npm 安装该精确版本：
+从 npm 安装已发布并完成 Registry 回读的精确版本：
 
 ```sh
-dsh plugin --profile web add dsh-grok-provider@0.1.11
+dsh plugin --profile web add dsh-grok-provider@1.0.0
 dsh web
 ```
 
@@ -130,8 +134,9 @@ dsh web
 
 ## 项目来源与发现
 
-- npm 当前稳定版：[dsh-grok-provider@0.1.10](https://www.npmjs.com/package/dsh-grok-provider/v/0.1.10)（唯一制品、双平台 CI、签名与 provenance 已验证；High Effort + Web Search 续跑存在已知 reasoning 兼容缺陷）
-- GitHub 最近发行版与校验值：[v0.1.10](https://github.com/yoshino-xiao7/dsh-grok-provider/releases/tag/v0.1.10)
+- npm 当前稳定版：[dsh-grok-provider@1.0.0](https://www.npmjs.com/package/dsh-grok-provider/v/1.0.0)（唯一制品、双平台 CI、签名、attestations 与 provenance 已验证）
+- GitHub 最近发行版与校验值：[v1.0.0](https://github.com/yoshino-xiao7/dsh-grok-provider/releases/tag/v1.0.0)
+- 发布证据：release commit `c6548199582b122f1d285422eabea0205eaf602f`，annotated tag object `192561cda1ac58cbc4077f0de8fa614dff9a5557` peel 至该提交，final CI run [`33308603394`](https://github.com/yoshino-xiao7/dsh-grok-provider/actions/runs/33308603394)，Trusted Publisher run [`33309083806` attempt 1](https://github.com/yoshino-xiao7/dsh-grok-provider/actions/runs/33309083806/attempts/1)。仓库所有者明确授权的唯一 tarball 含 72 个文件、226,704 bytes，unpacked size 715,014 bytes；SHA-1 为 `50e5d898dba241d1e19def7705db216e3060b892`，SHA-256 为 `30cd83dad77f7d2611126b3c4737c8fabffeae79f385fa623e61dcecfe39f5e2`，SRI 为 `sha512-WL2f6Kfg5yT5nNf1p4//mLSajCnZttL/pDR3BISrFgSGtZd9DEJlnibq08ETz503n1wHIdCBcU/ICMPG9K4vOw==`。冻结候选、GitHub Release 与 npm Registry 制品逐字节一致；Node 24 Registry 隔离安装的 Host `name`/`apply` 与 client `id` smoke 通过。`npm audit signatures` 确认安装图中 11 个包具有已验证 Registry 签名、2 个包具有已验证 attestations；本包公开 metadata 包含 1 个 Registry signature、2 个 attestations，provenance 精确绑定 `release.yml`、`v1.0.0`、release commit 与 publish run。
 - GitHub 社区发现：仓库已添加 DeepSeek Harness 官方推荐的 `dsh-plugin` 与 `dsh` Topics
 - YukiRyou 受管来源：[deepseek-yukiryou-plugin-catalog](https://github.com/yoshino-xiao7/deepseek-yukiryou-plugin-catalog)，当前仍锁定已完成真机验收的 `dsh-grok-provider@0.1.0`，且只标记 `darwin-arm64`
 
@@ -139,12 +144,29 @@ dsh web
 
 ## 兼容性与范围
 
-| 项目 | `0.1.10` 稳定版 / `0.1.11` 候选状态 |
+### `1.0.1` 候选修复边界
+
+- 根因不是模型、账号、Search 响应形状或 42 项工具总数，而是启用 server Search 时，同名 Harness function definition 与 `{ type: "web_search" }` / `{ type: "x_search" }` 共存；固定 Proxy 对该组合返回 HTTP 400。
+- 编译器先完整验证 40 个源 functions，再仅过滤与已启用 server Search 同名的 wire definitions。关闭对应开关时，本地工具保持原样；已有会话中的历史 `function_call` / `function_call_output` 也不删除或改名。
+- 最终 request receipt 拒绝 function/server-tool 名称交集；SSE parser 保留 source transport error，HTTP 400 因而映射到 `PROVIDER_ERROR`，真正的 SSE/协议错误仍为 `INVALID_RESPONSE`。
+- 一次经明确授权的脱敏真实账号回放使用原失败 X 会话结构：8 条 messages、40 个 source functions、wire 38 functions + 2 server tools、保留 2 个历史 reserved-name calls；只执行 1 次 models GET 和 1 次 Responses POST，接收 314 events 并以 `response.completed` 闭合。未保存消息/回复正文、URL、身份或凭据。
+- 精确 Node `24.19.0` 本地全量门禁为 253 tests、251 pass、0 fail、2 platform skips；生产依赖审计为 0 漏洞，隔离 cache 的 dry-run pack 列出 73 个文件，秘密模式扫描只命中显式 fixture canary 及其检查表记录。代码 PR #31 的 push/PR CI、merge commit `0c60200e12c3b8455331f31a317ece9b1945c458` 及 main CI run `33312621786` 已在 macOS 14 / Windows 2022 全绿。上述证据仍不代表最终 release commit、冻结制品、隔离安装、发布、供应链回读或 Windows 真机浏览器登录已经完成。候选详情见 [`docs/releases/v1.0.1.md`](docs/releases/v1.0.1.md)。
+
+### `1.0.0` 修复边界
+
+- 一个 reasoning ID 的原始生命周期必须先闭合，并且首次复用前必须已有一个完成的 Web/X server Search；之后只允许它以严格空占位再次出现。
+- “严格空”是指可见 summary/content 为空，且没有 summary/raw lifecycle；允许有界、不透明的 `encrypted_content`，但不会把它当作可见 reasoning 或保存上游明文。
+- 每次复用都必须收到独立的 `response.output_item.done`；若 `response.incomplete` 到来时仍有复用段未闭合，则返回通用非法响应错误，所有复用段已闭合后的 `max_output_tokens` 终态仍有效。非空 summary/raw、跨类型、未知 terminal 字段或 accessor 字段继续拒绝。
+- 完成态 `open_page` 只接受精确 `type + url`，streamed/final action 的类型与 URL 必须一致；Provider 校验后丢弃 URL，不会访问、预览、下载或回放。
+- 最终源码完成两层脱敏真实账号复验：原始 Web/X 协议探针各 1 次请求、各 64 events，分别观察到对应 Search 且终态 `completed`；生产 adapter 共完成 5 次 Responses，direct Web/X 均为 `stop`，Harness 形状的本地 `x_search` call/result 续跑三轮依次为 `tool-calls`、`tool-calls`、`stop`，前两轮各 1 次本地调用。该续跑没有在同一 wire request 中同时放入 Harness `x_search` function definition 与 xAI `{ type: "x_search" }` server descriptor；`1.0.1` 后续才隔离出这一 HTTP 400 冲突。未保存结果、URL、prompt、身份或凭据；这些不是发布、OAuth 或 Windows 真机证据。
+- manifest/lock 已同步为 `1.0.0`；Node 24 全量测试为 245 项、243 pass、0 fail、2 项平台跳过，生产依赖审计为 0 漏洞，确定性 build/bundle、72 项 dry-run pack、秘密模式扫描与 diff 检查均通过。代码 PR #28、main CI run [`33308371009`](https://github.com/yoshino-xiao7/dsh-grok-provider/actions/runs/33308371009)、最终 release commit、双平台 final CI、唯一制品、精确授权及 Registry/signature/attestation/provenance 回读均已完成。
+
+| 项目 | `1.0.0` 已发布状态 |
 | --- | --- |
 | DeepSeek Harness | 精确支持 `0.1.1-rc.2` |
 | Node.js | `>=24.19.0` |
-| macOS arm64 | 图片发送已完成真实 Harness 验证；`0.1.11` 聚焦回归、脱敏真实 summary/Search 探针及代码 merge commit 的 macOS 14 CI 通过；发布证据提交的 final CI 与唯一制品待关闭 |
-| Windows x64 | `0.1.11` 代码 merge commit 的 Windows 2022 CI 与现有 slow-fake 通过；发布证据提交的 final CI 待关闭。网络可达时由官方 CLI 生成 URL 并打开浏览器，该路径仍未完成 Windows 真机验收 |
+| macOS arm64 | 图片发送已完成真实 Harness 验证；`1.0.0` 聚焦回归、脱敏真实 Search 探针、final macOS 14 CI 与唯一制品验收均通过 |
+| Windows x64 | `1.0.0` final Windows 2022 CI 与现有 slow-fake 通过；网络可达时由官方 CLI 生成 URL 并打开浏览器，该路径仍未完成 Windows 真机验收 |
 | macOS x64 / Linux | 不支持 |
 | Grok CLI | 不锁完整版本；严格校验官方路径、`login --oauth` 能力与生产 OIDC 凭据契约 |
 | 模型 | 当前账号目录中 backend 已被严格 codec 支持的全部模型 |
@@ -153,7 +175,7 @@ dsh web
 
 每张投影图片最多 4 MiB、16,777,216 像素且任一边不超过 8192px；每次请求最多保留 8 张、投影字节合计最多 8 MiB。超限时按全局最旧优先移除图片并保留 Harness 的文本占位，最终 JSON 仍受 16 MiB 上限约束。
 
-已发布的 `0.1.10` 使用 Harness 官方 settings 模块注册并持久化两个 Search 设置；每个新调用在模型发现前读取一次最新值，已准备和在途调用保持原快照。真实使用随后发现精确 `grok-4.6` 在 High Effort + Web Search 续跑时，可能先关闭 reasoning 项，在一次 Search 完成后再把同一 ID 使用一次作为空占位，旧解码器会因此失败关闭。`0.1.11` 候选仅在已完成 Search 位于两段 reasoning 之间时允许该 ID 以严格空项再出现一次，并增加官方 raw `reasoning_text` 生命周期；raw 与 summary 互斥，replay 元数据不保存 raw 明文，后续请求只发送 `encrypted_content` 与空 summary，当前流中的 raw delta 仍会作为 Harness 可见 reasoning 输出。脱敏真实探针观察到 34 个 summary delta、0 个 raw delta，因此只验证 summary/Search 路径，raw reasoning 仍只有 fixture 回归。Search 继续只对精确 `grok-4.6` 默认关闭地开放；远端活动不变成本地工具，citation URL 不会被打开或下载。搜索结果属于不可信远端数据，执行命令或修改文件前应核实来源。图片生成、任意文件下载、API Key 模式、多账号、企业 OIDC、ACP 与 Headless agent 封装仍不在本版本范围内；后续切片见[能力路线图](docs/11-capability-roadmap.md)。
+已发布的 `0.1.10` 使用 Harness 官方 settings 模块注册并持久化两个 Search 设置；每个新调用在模型发现前读取一次最新值，已准备和在途调用保持原快照。真实使用随后发现精确 `grok-4.6` 在 High Effort + Web Search 续跑时，可能先关闭 reasoning 项，在一次 Search 完成后再把同一 ID 使用一次作为空占位，旧解码器会因此失败关闭。已发布的 `0.1.11` 仅在已完成 Search 位于两段 reasoning 之间时允许该 ID 以严格空项再出现一次，并增加官方 raw `reasoning_text` 生命周期；raw 与 summary 互斥，replay 元数据不保存 raw 明文，后续请求只发送 `encrypted_content` 与空 summary，当前流中的 raw delta 仍会作为 Harness 可见 reasoning 输出。脱敏真实探针观察到 34 个 summary delta、0 个 raw delta，因此只验证 summary/Search 路径，raw reasoning 仍只有 fixture 回归。Search 继续只对精确 `grok-4.6` 默认关闭地开放；远端活动不变成本地工具，citation URL 不会被打开或下载。搜索结果属于不可信远端数据，执行命令或修改文件前应核实来源。图片生成、任意文件下载、API Key 模式、多账号、企业 OIDC、ACP 与 Headless agent 封装仍不在本版本范围内；后续切片见[能力路线图](docs/11-capability-roadmap.md)。
 
 ## 工作原理
 
@@ -257,7 +279,8 @@ npm run pack:check
 - [x] 发布 `0.1.7`：Provider/CLI 双版本诊断、CLI 安装恢复、OIDC discovery 超时脱敏结算与 `IconThinkOutline16` 设置导航兼容层
 - [x] 发布 `0.1.9`：加入 Web/X Search 协议与设置页，唯一制品、双平台 CI、签名与 SLSA provenance 均已验证；发布后确认 Host 设置 namespace 遗漏，开关不可用
 - [x] 发布 `0.1.10`：`llm-grok` 注册、按调用读取设置、唯一制品、双平台 CI、签名与 provenance 已完成
-- [ ] 发布 `0.1.11`：修复 High Effort + Web Search reasoning 生命周期兼容；代码 PR 与 main 双平台 CI 已通过，发布证据 final CI、唯一制品、精确授权、Registry 与 provenance 回读待完成
+- [x] 发布 `0.1.11`：修复 High Effort + Web Search reasoning 生命周期兼容；唯一制品、双平台 final CI、精确授权、Registry、签名、attestations 与 provenance 回读均已完成
+- [x] 发布 `1.0.0`：修复多次严格空 reasoning ID 复用和完成态 Web Search `open_page` action；唯一制品、双平台 final CI、精确授权、Registry、签名、attestations 与 provenance 回读均已完成
 - [ ] 再后续独立切片：默认关闭的图片生成（只收内联结果，提交 Harness attachment）
 - [ ] 完成 Windows x64 独立真机验收并按需发布后续稳定修复版
 

package/SECURITY.md

@@ -4,7 +4,11 @@
 
 ## 支持范围
 
-本安全策略对应源码候选版本 `0.1.11`；当前稳定版及 npm Registry 的 `latest` 均为 `0.1.10`。`0.1.8` 曾发布后撤回且版本号不可复用。已发布的 `0.1.10` 完成唯一制品、macOS 14 / Windows 2022 CI、Registry 字节、签名与 provenance 回读，并修复 Web/X Search 的 Host settings 注册；真实使用随后发现精确 `grok-4.6` 在 High Effort + Web Search 续跑时可能复用已关闭 reasoning ID 作为空占位，旧解码器会失败关闭为通用非法响应。尚未发布的 `0.1.11` 只修复该 reasoning 生命周期兼容并加入官方 raw reasoning 事件支持；代码 PR #25 与 main CI run `33302830043` 双平台已通过，发布证据提交的 final CI、唯一制品、精确授权和发布回读仍待完成。DeepSeek Harness、Node.js 与操作系统按发布线明确维护；Grok CLI 不使用完整版本字符串作为信任门禁，而是严格校验官方默认路径、命令能力、生产 OIDC 凭据契约和固定服务端协议。图片发送已在真实 Harness 对话中确认可用；脱敏真实 Search 探针不保存 prompt、回复、检索词、citation URL 或凭据，但也不覆盖浏览器手工对话、OAuth、完整真实会话或网络可达 Windows 真机外部浏览器弹出。
+本安全策略对应当前稳定版 `1.0.0`，npm Registry 的 `latest` 也指向 `1.0.0`。最终 release commit 为 `c6548199582b122f1d285422eabea0205eaf602f`；annotated tag object `192561cda1ac58cbc4077f0de8fa614dff9a5557` peel 到该提交，final CI run `33308603394` 双平台全绿，Trusted Publisher run `33309083806` attempt 1 发布了仓库所有者明确授权的唯一 72 文件制品。该 tarball 为 226,704 bytes，unpacked size 715,014 bytes，SHA-1 为 `50e5d898dba241d1e19def7705db216e3060b892`，SHA-256 为 `30cd83dad77f7d2611126b3c4737c8fabffeae79f385fa623e61dcecfe39f5e2`，SRI 为 `sha512-WL2f6Kfg5yT5nNf1p4//mLSajCnZttL/pDR3BISrFgSGtZd9DEJlnibq08ETz503n1wHIdCBcU/ICMPG9K4vOw==`；冻结候选、GitHub Release 与 npm Registry 字节一致。Node 24 Registry 隔离安装的 Host `name`/`apply` 与 client `id` smoke 通过；`npm audit signatures` 确认安装图中 11 个包具有已验证 Registry 签名、2 个包具有已验证 attestations，本包公开 metadata 包含 1 个 Registry signature、2 个 attestations，provenance 精确绑定 `release.yml`、`v1.0.0`、release commit 与 publish run。`0.1.8` 曾发布后撤回且版本号不可复用。DeepSeek Harness、Node.js 与操作系统按发布线明确维护；网络可达 Windows 真机外部浏览器弹出仍未验收。
+
+`1.0.0` 把 reasoning ID 复用收窄为 Search-backed 且严格空的完整生命周期：可见 summary/content 及 summary/raw lifecycle 必须为空，允许有界 opaque `encrypted_content`；每次复用都必须到达自己的 `response.output_item.done`，仅当 `response.incomplete` 到来时仍有复用段未闭合才失败关闭，所有复用段闭合后的 `max_output_tokens` 终态仍有效。非空、跨类型、未知 terminal 字段或 accessor 字段继续拒绝。完成态 Web Search `open_page` 只允许精确且有界的 `type + url`，streamed/final action 的类型与 URL 必须一致，校验后 URL 被丢弃且不会被访问、预览、下载或回放。脱敏真实账号复验未保存结果、URL、prompt、身份或凭据；供应链回读也不构成 OAuth、完整桌面会话或 Windows 真机浏览器验收。
+
+当前 npm Registry `latest` 与稳定发布版均为 `1.0.0`；源码 manifest/lock 已进入尚未发布的 `1.0.1` 候选。候选在启用 server Search 时先完整验证全部 Harness functions，再只从最终 wire definitions 过滤与已启用 `web_search` / `x_search` 精确同名的 callable definition；历史 function call/result 保留，关闭对应开关时本地 function 保留。request 与 decoder receipt 都拒绝 function/server-tool 名称交集。SSE source transport error 原样上抛并保持既有认证、限流、中止与 `PROVIDER_ERROR` 映射，只有 framing、JSON 或协议错误归类为 `INVALID_RESPONSE`；失败后不自动降级或重放 POST。一次授权的脱敏原失败会话结构回放已完成，但没有保存正文、URL、身份、凭据或原始响应，也不构成制品、CI、发布或 Windows 真机浏览器登录证据。
 
 `0.1.11` 沿用已发布版本的图片边界：只为精确 `grok-4.6` 提供有界图片输入；`grok-4.5` 与所有其他模型保持 text-only。普通 user/system 历史中的私有 reasoning 会被省略并保留相邻可见 text/image；只有有效的同 Provider assistant 历史可进入加密 reasoning replay，一层 tool-result 仍只接受公开 text/image。图片只能来自 Harness attachment service 的已验证 JPEG/PNG 投影，以 `detail:"high"` 发送，并受单图字节、像素、边长、数量、总字节与最终 JSON 上限约束；URL、路径、file ID 和调用方预制 data URL 都会被拒绝。
 
@@ -38,4 +42,8 @@
 
 ---
 
-English summary: GitHub Private vulnerability reporting is enabled and preferred. The current source candidate is `0.1.11`; the current stable release and npm Registry `latest` are both `0.1.10`. Version `0.1.8` was published and then withdrawn, and npm version numbers cannot be reused. Published `0.1.10` completed unique-artifact, macOS 14 / Windows 2022 CI, Registry-byte, signature, and provenance verification and repaired Host Search settings registration. Real use later found that exact `grok-4.6` at High Effort may close a reasoning ID, complete Search, and then reuse it once as an empty placeholder, which the old decoder rejected. Unpublished `0.1.11` permits that strictly empty reuse only when a completed server Search lies between the two reasoning lifecycles, accepts fully closed empty reasoning items, and adds a mutually exclusive official raw `reasoning_text` lifecycle. Replay metadata does not retain raw plaintext; later requests carry only `encrypted_content` plus `summary: []`, while live raw deltas remain visible to Harness. A redacted real probe produced one POST, 68 events, 34 summary deltas, zero raw deltas, and one finish, so it verifies only the summary/Search path; raw reasoning remains fixture-verified. Code PR #25 and main CI run `33302830043` passed on macOS 14 and Windows 2022; the release-evidence commit's final CI, the unique artifact, exact authorization, and release readback remain pending. Authentication, settings, image input, citations, endpoints, and platform support are unchanged. Search results and citations remain untrusted remote data. Never send credentials, identity data, prompts, tool arguments, cookies, image bytes, Search contents, or unreviewed diagnostics.
+Release security note: `1.0.0` accepts only complete Search-backed strictly empty reasoning reuse (empty visible summary/content and no summary/raw lifecycle, with bounded opaque `encrypted_content` allowed) and exact bounded completed `open_page` type/URL pairs whose streamed and final values agree. Every reuse requires its own `response.output_item.done`; an open/incomplete reused lifecycle, non-empty or cross-type reuse, unknown terminal fields, and accessor-backed Search items or response containers fail closed. A later max-token response remains valid after every reused lifecycle has closed. Redacted probes retained no results, URLs, prompts, identity, or credentials. Release commit `c6548199582b122f1d285422eabea0205eaf602f`, final CI run `33308603394`, the unique artifact, explicit authorization, Trusted Publisher run `33309083806` attempt 1, Registry integrity, signatures, attestations, and provenance are verified.
+
+The current stable release and npm Registry `latest` are both `1.0.0`; the source manifest and lockfile now describe an unpublished `1.0.1` candidate. When server Search is enabled, the candidate fully validates every Harness function before omitting only callable definitions whose names exactly collide with enabled `web_search` / `x_search` server descriptors. Historical calls/results remain, local functions remain when the matching switch is off, and request/decoder receipts reject every function/server-tool intersection. SSE source transport errors retain their existing auth, rate-limit, abort, and `PROVIDER_ERROR` mappings; only framing, JSON, and protocol failures become `INVALID_RESPONSE`, and failures are never silently retried without Search. One authorized redacted replay of the original failing session structure completed without retaining text, URLs, identity, credentials, or raw responses. This is not artifact, CI, publication, or real-device Windows login evidence.
+
+English summary: GitHub Private vulnerability reporting is enabled and preferred. The current stable release and npm Registry `latest` are both `1.0.0`; version `0.1.8` was published and then withdrawn, and npm version numbers cannot be reused. Release commit `c6548199582b122f1d285422eabea0205eaf602f`, annotated tag object `192561cda1ac58cbc4077f0de8fa614dff9a5557`, final dual-platform CI run `33308603394`, and Trusted Publisher run `33309083806` attempt 1 bind the explicitly authorized unique 72-file artifact. The tarball is 226,704 bytes packed and 715,014 bytes unpacked, with SHA-1 `50e5d898dba241d1e19def7705db216e3060b892`, SHA-256 `30cd83dad77f7d2611126b3c4737c8fabffeae79f385fa623e61dcecfe39f5e2`, and SRI `sha512-WL2f6Kfg5yT5nNf1p4//mLSajCnZttL/pDR3BISrFgSGtZd9DEJlnibq08ETz503n1wHIdCBcU/ICMPG9K4vOw==`. Frozen-candidate, GitHub Release, and Registry copies are byte-identical; the isolated Node 24 Host/client smoke and `npm audit signatures` passed. Public metadata exposes 1 Registry signature and 2 attestations, and provenance exactly binds `release.yml`, `v1.0.0`, the release commit, and publish run. The release accepts only complete Search-backed strictly empty reasoning reuse and exact bounded completed `open_page` pairs, discards validated URLs without visiting them, and retains the fixed-origin, credential, settings, model, image, and platform boundaries. Network-reachable external-browser launch remains unverified on a physical Windows device. Search results and citations remain untrusted remote data. Never send credentials, identity data, prompts, tool arguments, cookies, image bytes, Search contents, or unreviewed diagnostics.