dsh-grok-provider 0.1.3 → 0.1.4

package/CHANGELOG.md

@@ -1,5 +1,16 @@
 # Changelog
 
+## 0.1.4 - 2026-08-28
+
+- Add an asynchronous Responses request compiler for bounded jpeg/png image input from the optional Harness attachment store.
+- Preserve the exact `0.1.3` text request path when no image is present; compile ordered user and tool-result image content only before transport starts.
+- Advertise image input only for exact `grok-4.6`; `grok-4.5` and all other models remain text-only.
+- Enforce per-image bytes, pixels, dimensions, image count, aggregate derived bytes, a 20,000-block image-compilation budget, one-level tool-result nesting, MIME magic, cancellation, and a final 16 MiB JSON limit with deterministic oldest-first offloading.
+- Keep `prompt_cache_key`, Web/X Search, image generation, URL downloads, new SSE events, authentication, and endpoint changes out of this release.
+- Verify exact `grok-4.6` against the fixed CLI Chat Proxy with red and blue fixtures in both user-image and tool-result-image positions; all four streams returned HTTP 200 SSE completion and passed the normalized whole-response color assertion.
+- Fail closed on `grok-4.5` image input after its controlled red-fixture Proxy response proved semantically unreliable; keep `grok-4.5` and every other model text-only.
+- Fix image requests to `detail:"high"` following the official xAI Responses image example; retain real Harness `0.1.1-rc.2` attachment-local/LlmRuntime isolation as a final candidate revalidation gate.
+
 ## 0.1.3 - 2026-08-27
 
 - Fix existing Harness conversations failing immediately after switching from Ark to Grok when an earlier tool-call ID contains Ark's `|` delimiter.

package/CONTRIBUTING.md

@@ -16,9 +16,9 @@
 
 ## 变更流程
 
-1. 阅读 [`docs/README.md`](docs/README.md) 和与改动相关的 ADR。
-2. 先写或更新测试，保持变更范围单一。
-3. 认证、凭据、固定 endpoint、模型协议或发布边界变化时，先更新 ADR、威胁模型和测试计划。
+1. 阅读 [`docs/README.md`](docs/README.md)、[能力路线图](docs/11-capability-roadmap.md) 和与改动相关的 ADR。
+2. 先写或更新测试，保持变更范围单一。内容类型必须落在当前版本切片内，不得把搜索或生图并进图片输入版本。
+3. 认证、凭据、固定 endpoint、模型协议或发布边界变化时，先更新 ADR、威胁模型和测试计划。公开协议可以驱动隔离原型，但新内容类型在对外声明、合并发布基线或制作候选包前必须完成固定 CLI Chat Proxy 的脱敏 spike。
 4. 同步维护 `README.md` 与 `README.en.md` 的用户可见信息。
 5. 运行验证：
 
@@ -42,6 +42,7 @@ npm run pack:check
 
 ## 设计原则
 
+- 内容类型按 [`docs/11-capability-roadmap.md`](docs/11-capability-roadmap.md) 分版本引入，不把未排期能力混进当前切片。
 - 模型能力来自动态目录，不通过隐藏未知模型制造“全部支持”的假象。
 - Renderer、RPC 与错误信息不接触凭据或身份数据。
 - 只允许固定官方网络目标，拒绝用户配置任意 base URL 和认证重定向。
@@ -50,4 +51,4 @@ npm run pack:check
 
 ---
 
-English summary: include exact versions, a minimal reproduction, and redacted diagnostics in bug reports. Never post credentials or personal data. Keep PRs focused, add tests first, update design/security documents for boundary changes, keep both READMEs synchronized, and run `npm test` plus `npm run pack:check` before submission.
+English summary: include exact versions, a minimal reproduction, and redacted diagnostics in bug reports. Never post credentials or personal data. Keep PRs focused, add tests first, follow the capability roadmap so content-type slices stay on their assigned versions, update design/security documents for boundary changes, keep both READMEs synchronized, and run `npm test` plus `npm run pack:check` before submission.

package/README.en.md

@@ -4,7 +4,7 @@
 
 Use an already authenticated official Grok Build account from DeepSeek Harness, with dynamic model discovery, streaming reasoning, tool calls, and an account quota/model capability dashboard.
 
-> Unofficial community project; not affiliated with xAI or DeepSeek Harness. The current stable version is `0.1.3`. The project no longer publishes prereleases; stable defects are fixed in a new incremented stable version.
+> Unofficial community project; not affiliated with xAI or DeepSeek Harness. The current source version is `0.1.4`; the published stable version is whatever the npm Registry currently assigns to `latest`. The project no longer publishes prereleases; stable defects are fixed in a new incremented stable version.
 
 ## What it provides
 
@@ -14,6 +14,7 @@ Use an already authenticated official Grok Build account from DeepSeek Harness,
 | Credentials | Reuses official CLI session state without creating a second token store |
 | Models | Discovers every model visible to the account at runtime; no static model allowlist |
 | Conversations | Streaming Responses text, reasoning, encrypted reasoning replay, usage, and finish reasons |
+| Images | Only exact `grok-4.6` accepts bounded JPEG/PNG images from Harness attachments; `grok-4.5` and all other models remain text-only |
 | Tools | Returns function calls to the Harness permission layer; the provider never executes tools |
 | Account dashboard | Login status, weekly/monthly quota, reset time, dynamic model capabilities and reasoning efforts |
 | Surfaces | Bilingual Web settings and a closed `/grok` TUI command set |
@@ -38,10 +39,10 @@ The official CLI opens a browser on first use. The provider supports only the of
 
 ### 2. Install the provider
 
-Install the published exact version from npm:
+After `0.1.4` is published, install that exact version from npm:
 
 ```sh
-dsh plugin --profile web add dsh-grok-provider@0.1.3
+dsh plugin --profile web add dsh-grok-provider@0.1.4
 dsh web
 ```
 
@@ -111,16 +112,16 @@ Uninstalling the provider does not remove the official Grok CLI or directly modi
 
 ## Sources and discovery
 
-- Exact npm version: [dsh-grok-provider@0.1.3](https://www.npmjs.com/package/dsh-grok-provider/v/0.1.3)
-- GitHub release and integrity values: [v0.1.3](https://github.com/yoshino-xiao7/dsh-grok-provider/releases/tag/v0.1.3)
+- npm `0.1.4` page (available after publication): [dsh-grok-provider@0.1.4](https://www.npmjs.com/package/dsh-grok-provider/v/0.1.4)
+- GitHub `0.1.4` release and integrity values (available after publication): [v0.1.4](https://github.com/yoshino-xiao7/dsh-grok-provider/releases/tag/v0.1.4)
 - GitHub community discovery: the repository carries the DeepSeek Harness-recommended `dsh-plugin` and `dsh` topics
-- YukiRyou managed source: [deepseek-yukiryou-plugin-catalog](https://github.com/yoshino-xiao7/deepseek-yukiryou-plugin-catalog), following the exact verified stable version and currently marking only verified macOS arm64
+- YukiRyou managed source: [deepseek-yukiryou-plugin-catalog](https://github.com/yoshino-xiao7/deepseek-yukiryou-plugin-catalog), still pinned to the real-device-accepted `dsh-grok-provider@0.1.0` and marking only `darwin-arm64`
 
-Directory inclusion is not an endorsement by xAI or DeepSeek Harness. The public curated directory still requires its repository-age gate and independent maintainer review.
+Directory inclusion is not an endorsement by xAI or DeepSeek Harness. [Listing PR #3415](https://github.com/awesome-dsh-plugin/awesome-dsh-plugin/pull/3415) has added the project to the public `awesome-dsh-plugin` `model` category. That directory is repository-level discovery and carries no exact npm-version or platform-acceptance claim.
 
 ## Compatibility and scope
 
-| Item | `0.1.3` status |
+| Item | `0.1.4` status |
 | --- | --- |
 | DeepSeek Harness | Exact support for `0.1.1-rc.2` |
 | Node.js | `>=24.19.0` |
@@ -130,7 +131,9 @@ Directory inclusion is not an endorsement by xAI or DeepSeek Harness. The public
 | Grok CLI | No full-version lock; official path, `login --oauth` capability, and production OIDC credential contract are enforced |
 | Models | Every account catalog model whose backend has a strict codec in this release |
 
-The initial release excludes image input, Web/X Search, arbitrary downloads, API-key mode, multiple accounts, enterprise OIDC, ACP, and Headless agent wrapping. See the complete [product requirements](docs/01-product-requirements.md).
+`0.1.4` enables image input only for exact `grok-4.6`; `grok-4.5` and every other dynamically discovered model remain text-only. Images must be verified JPEG/PNG projections from the Harness attachment service. Ordinary user content and images nested one level inside a tool result are supported, with `detail:"high"` fixed to the official xAI Responses image example; URLs, filesystem paths, file IDs, and caller-supplied data URLs are rejected.
+
+Each projected image is limited to 4 MiB, 16,777,216 pixels, and 8192px per side. A request retains at most eight images and 8 MiB of projected image bytes. When a limit is exceeded, the globally oldest images are offloaded to Harness text placeholders; the final JSON remains capped at 16 MiB. Web/X Search, image generation, arbitrary downloads, API-key mode, multiple accounts, enterprise OIDC, ACP, and Headless agent wrapping remain out of scope; see the [capability roadmap](docs/11-capability-roadmap.md).
 
 ## How it works
 
@@ -147,7 +150,7 @@ dsh-grok-provider Host
               xAI Grok Build
 ```
 
-Model IDs come from the runtime catalog rather than a hardcoded list. If an account exposes a new backend that cannot be mapped safely, discovery fails closed instead of hiding the model and claiming complete support.
+Model IDs come from the runtime catalog rather than a hardcoded list. Image modality is enabled only for exact model IDs backed by separate protocol and live evidence. If an account exposes a new backend that cannot be mapped safely, discovery fails closed instead of hiding the model and claiming complete support.
 
 ## Security and privacy
 
@@ -156,7 +159,7 @@ Model IDs come from the runtime catalog rather than a hardcoded list. If an acco
 - The Host must perform a bounded read of the official `auth.json`, whose raw file may contain a refresh token. The parser does not use, cache, or persist that refresh token; it retains only validation metadata and a short-lived access-token lease.
 - The provider does not implement a refresh grant. Near expiry it may invoke one bounded official `grok models`, then reread and revalidate the official credential file.
 - Login subprocesses use fixed argv, a scrubbed environment, output limits, deadlines, cancellation, and no shell.
-- Prompts and tool results are sent to the xAI Grok Build service; the provider itself does not log them.
+- Prompts, tool results, and image projections selected for a request are sent to the xAI Grok Build service; the provider itself does not log that content, source images, or projected bytes.
 
 See the full [threat model](docs/03-security-threat-model.md). For vulnerabilities, read the [security policy](SECURITY.md) and never post tokens, `auth.json`, personal data, or full diagnostic logs in a public issue.
 
@@ -180,7 +183,7 @@ A protobuf-omitted zero is restored only with a complete typed period. In every
 
 ### An existing conversation fails immediately after switching from another model to Grok
 
-Versions through `0.1.2` could not convert some third-party tool-call histories containing special characters, notably `|` in Ark call IDs. Update to `0.1.3`; it preserves call/result correlation while safely mapping incompatible historical IDs before sending the request to Grok.
+Versions through `0.1.2` could not convert some third-party tool-call histories containing special characters, notably `|` in Ark call IDs. Update to `0.1.3` or later; it preserves call/result correlation while safely mapping incompatible historical IDs before sending the request to Grok.
 
 ### Does Windows work?
 
@@ -202,6 +205,7 @@ Project map:
 - [`docs/04-harness-contract.md`](docs/04-harness-contract.md): Harness integration contract;
 - [`docs/05-test-plan.md`](docs/05-test-plan.md): platform, security, and release gates;
 - [`docs/09-implementation-status.md`](docs/09-implementation-status.md): implementation and acceptance status;
+- [`docs/11-capability-roadmap.md`](docs/11-capability-roadmap.md): content-type sequence from `0.1.4`;
 - [`CHANGELOG.md`](CHANGELOG.md): version history.
 
 Read the [contributing guide](CONTRIBUTING.md) before filing an issue or PR. Changes to authentication, transport, credential formats, or release boundaries must update the relevant ADR/threat model before implementation and tests.
@@ -215,10 +219,12 @@ Read the [contributing guide](CONTRIBUTING.md) before filing an issue or PR. Cha
 - [x] Publish the `0.1.1` documentation and release-process correction
 - [x] Publish the `0.1.2` Windows CLI compatibility correction
 - [x] Publish the `0.1.3` cross-provider tool-history compatibility correction
+- [x] `0.1.4`: image input only for exact `grok-4.6`; red/blue user and tool-result Proxy gates plus final Harness attachment revalidation pass, while `grok-4.5` fails closed as text-only
+- [ ] Later independent slice: opt-in, default-off Web Search / X Search
+- [ ] A subsequent slice: opt-in image generation (inline results only, committed through Harness attachments)
 - [ ] Complete independent Windows x64 acceptance and publish a later stable fix if needed
-- [ ] Evaluate additional content types and platforms only against verified Harness/xAI contracts
 
-The roadmap is not a compatibility promise; every new capability must pass the documented design and security gates.
+Slice details, gates, and permanent non-goals are in the [capability roadmap](docs/11-capability-roadmap.md). The roadmap is not a compatibility promise; each capability needs its own ADR and security gates. `prompt_cache_key` is not bundled with image input. Arbitrary URL downloads and API-key mode stay out of scope.
 
 ## License
 

package/README.md

@@ -4,7 +4,7 @@
 
 让 DeepSeek Harness 使用你已登录的官方 Grok Build 账号：动态模型发现、流式推理、工具调用，以及账号额度与模型能力面板。
 
-> 非官方社区项目，与 xAI 或 DeepSeek Harness 官方无隶属关系。当前稳定版本为 `0.1.3`。项目不再发行预发行版；正式版缺陷通过新的递增稳定版本修复。
+> 非官方社区项目，与 xAI 或 DeepSeek Harness 官方无隶属关系。当前源码版本为 `0.1.4`；npm 已发布稳定版本以 Registry 的 `latest` 标签为准。项目不再发行预发行版；正式版缺陷通过新的递增稳定版本修复。
 
 ## 它解决什么问题
 
@@ -14,6 +14,7 @@
 | 凭据 | 复用官方 CLI 的登录状态；插件不创建第二份 token 存储 |
 | 模型 | 运行时读取账号可见的全部 Grok Build 模型，不维护静态模型白名单 |
 | 对话 | Responses 流式文本、reasoning、加密 reasoning replay、usage 与 finish reason |
+| 图片 | 仅精确 `grok-4.6` 接收 Harness attachment 中有界的 JPEG/PNG 图片；`grok-4.5` 与其他模型保持 text-only |
 | 工具 | 将 function call 交回 Harness 权限层；Provider 本身不执行工具 |
 | 账户面板 | 登录状态、每周/月额度、重置时间、动态模型能力与 reasoning 档位 |
 | 界面 | Web 设置页中英文切换；TUI 提供闭合的 `/grok` 命令 |
@@ -38,10 +39,10 @@ grok models
 
 ### 2. 安装 Provider
 
-从 npm 安装已发布的精确版本：
+`0.1.4` 发布后，从 npm 安装该精确版本：
 
 ```sh
-dsh plugin --profile web add dsh-grok-provider@0.1.3
+dsh plugin --profile web add dsh-grok-provider@0.1.4
 dsh web
 ```
 
@@ -111,16 +112,16 @@ dsh web
 
 ## 项目来源与发现
 
-- npm 精确版本：[dsh-grok-provider@0.1.3](https://www.npmjs.com/package/dsh-grok-provider/v/0.1.3)
-- GitHub 发行版与校验值：[v0.1.3](https://github.com/yoshino-xiao7/dsh-grok-provider/releases/tag/v0.1.3)
+- npm `0.1.4` 页面（发布后可用）：[dsh-grok-provider@0.1.4](https://www.npmjs.com/package/dsh-grok-provider/v/0.1.4)
+- GitHub `0.1.4` 发行版与校验值（发布后可用）：[v0.1.4](https://github.com/yoshino-xiao7/dsh-grok-provider/releases/tag/v0.1.4)
 - GitHub 社区发现：仓库已添加 DeepSeek Harness 官方推荐的 `dsh-plugin` 与 `dsh` Topics
-- YukiRyou 受管来源：[deepseek-yukiryou-plugin-catalog](https://github.com/yoshino-xiao7/deepseek-yukiryou-plugin-catalog)，跟随已验证的精确稳定版本，当前只标记已验证的 macOS arm64
+- YukiRyou 受管来源：[deepseek-yukiryou-plugin-catalog](https://github.com/yoshino-xiao7/deepseek-yukiryou-plugin-catalog)，当前仍锁定已完成真机验收的 `dsh-grok-provider@0.1.0`，且只标记 `darwin-arm64`
 
-出现在目录中不代表 xAI 或 DeepSeek Harness 官方背书。公共 curated 目录仍需满足其仓库年龄门槛并通过独立维护者评审。
+出现在目录中不代表 xAI 或 DeepSeek Harness 官方背书。项目已通过[收录 PR #3415](https://github.com/awesome-dsh-plugin/awesome-dsh-plugin/pull/3415) 进入公共 `awesome-dsh-plugin` 的 `model` 分类；该目录是仓库级发现入口，不承载精确 npm 版本或平台验收声明。
 
 ## 兼容性与范围
 
-| 项目 | `0.1.3` 状态 |
+| 项目 | `0.1.4` 状态 |
 | --- | --- |
 | DeepSeek Harness | 精确支持 `0.1.1-rc.2` |
 | Node.js | `>=24.19.0` |
@@ -130,7 +131,9 @@ dsh web
 | Grok CLI | 不锁完整版本；严格校验官方路径、`login --oauth` 能力与生产 OIDC 凭据契约 |
 | 模型 | 当前账号目录中 backend 已被严格 codec 支持的全部模型 |
 
-首版不包含图片输入、Web/X Search、任意文件下载、API Key 模式、多账号、企业 OIDC、ACP 或 Headless agent 封装。完整范围见[产品需求](docs/01-product-requirements.md)。
+`0.1.4` 只为精确的 `grok-4.6` 开启图片输入；`grok-4.5` 与其他动态发现的模型继续按 text-only 处理。图片只能来自 Harness attachment service 的已验证 JPEG/PNG 投影，支持普通用户内容和一层工具结果中的图片，并按 xAI 官方 Responses 图片示例固定使用 `detail:"high"`；不接受 URL、文件路径、file ID 或调用方预制的 data URL。
+
+每张投影图片最多 4 MiB、16,777,216 像素且任一边不超过 8192px；每次请求最多保留 8 张、投影字节合计最多 8 MiB。超限时按全局最旧优先移除图片并保留 Harness 的文本占位，最终 JSON 仍受 16 MiB 上限约束。Web/X Search、图片生成、任意文件下载、API Key 模式、多账号、企业 OIDC、ACP 与 Headless agent 封装仍不在本版本范围内；后续切片见[能力路线图](docs/11-capability-roadmap.md)。
 
 ## 工作原理
 
@@ -147,7 +150,7 @@ dsh-grok-provider Host
               xAI Grok Build
 ```
 
-模型 ID 来自运行时目录，不是硬编码列表。如果账号出现当前版本无法安全映射的新 backend，发现过程会失败关闭，而不是隐藏模型后宣称“全部支持”。
+模型 ID 来自运行时目录，不是硬编码列表；图片 modality 则只对有独立协议与真机证据的精确模型 ID 开启。如果账号出现当前版本无法安全映射的新 backend，发现过程会失败关闭，而不是隐藏模型后宣称“全部支持”。
 
 ## 安全与隐私
 
@@ -156,7 +159,7 @@ dsh-grok-provider Host
 - Host 必须有界读取官方 `auth.json`，其原始文件可能包含 refresh token；解析器不使用、不缓存、不持久化 refresh token，只保留闭合校验所需元数据与短期 access-token lease。
 - 插件不实现 refresh grant；凭据临近过期时，只能有界调用一次官方 `grok models`，再重新读取并验证官方文件。
 - 登录子进程使用固定 argv、过滤后的环境、输出上限、deadline 与取消处理，不通过 shell 启动。
-- 提示词和工具结果会发送给 xAI Grok Build 服务；插件本身不把它们写入日志。
+- 提示词、工具结果以及用户选择发送的图片投影会发往 xAI Grok Build 服务；插件本身不记录这些内容、原图或投影字节。
 
 完整边界见[威胁模型](docs/03-security-threat-model.md)。发现安全问题时，请阅读[安全策略](SECURITY.md)，不要在公开 Issue 中提交 token、`auth.json`、个人信息或完整诊断日志。
 
@@ -180,7 +183,7 @@ dsh-grok-provider Host
 
 ### 从其他模型切换到 Grok 后立即提示响应无效
 
-`0.1.2` 及更早版本不能转换部分包含特殊字符的第三方工具调用历史，典型情况是 Ark 调用 ID 中的 `|`。请更新到 `0.1.3`；新版本会保持工具调用与结果的关联，并在发送给 Grok 前安全映射不兼容的历史 ID。
+`0.1.2` 及更早版本不能转换部分包含特殊字符的第三方工具调用历史，典型情况是 Ark 调用 ID 中的 `|`。请更新到 `0.1.3` 或更高版本；新版本会保持工具调用与结果的关联，并在发送给 Grok 前安全映射不兼容的历史 ID。
 
 ### Windows 能用吗
 
@@ -202,6 +205,7 @@ npm run pack:check
 - [`docs/04-harness-contract.md`](docs/04-harness-contract.md)：Harness 集成契约；
 - [`docs/05-test-plan.md`](docs/05-test-plan.md)：平台、安全与发行门禁；
 - [`docs/09-implementation-status.md`](docs/09-implementation-status.md)：实现与验收状态；
+- [`docs/11-capability-roadmap.md`](docs/11-capability-roadmap.md)：`0.1.4` 起的内容类型路线；
 - [`CHANGELOG.md`](CHANGELOG.md)：版本变化。
 
 提交 Issue 或 PR 前请阅读[贡献指南](CONTRIBUTING.md)。认证、传输、凭据格式或发布边界的变化必须先更新对应 ADR/威胁模型，再开发和测试。
@@ -215,10 +219,12 @@ npm run pack:check
 - [x] 发布 `0.1.1` 文档与发布流程修正版
 - [x] 发布 `0.1.2` Windows CLI 兼容性修正版
 - [x] 发布 `0.1.3` 跨 Provider 工具调用历史兼容性修正版
+- [x] `0.1.4`：仅精确 `grok-4.6` 图片输入；user/tool-result 红蓝语义 Proxy 门禁与最终 Harness attachment 复验均已通过，`grok-4.5` 已按失败关闭保持 text-only
+- [ ] 后续独立切片：默认关闭、用户分别开启的 Web Search / X Search
+- [ ] 再后续独立切片：默认关闭的图片生成（只收内联结果，提交 Harness attachment）
 - [ ] 完成 Windows x64 独立真机验收并按需发布后续稳定修复版
-- [ ] 根据已验证的 Harness/xAI 协议逐项评估更多内容类型和平台
 
-路线图不是兼容性承诺；新增能力必须通过文档决策与安全门禁。
+完整切片、门禁与永久非目标见[能力路线图](docs/11-capability-roadmap.md)。路线图不是兼容性承诺；新增能力必须通过独立 ADR 与安全门禁。`prompt_cache_key` 不与图片输入捆绑；不引入任意 URL 下载或 API Key 模式。
 
 ## 许可证
 

package/SECURITY.md

@@ -4,7 +4,7 @@
 
 ## 支持范围
 
-当前稳定版本为 `0.1.3`。DeepSeek Harness、Node.js 与操作系统按发布线明确维护；Grok CLI 不使用完整版本字符串作为信任门禁，而是严格校验官方默认路径、命令能力、生产 OIDC 凭据契约和固定服务端协议。macOS arm64 已完成真实验收；Windows x64 有代码与 CI 覆盖。`0.1.3` 只修复有界历史调用 ID 的请求内安全映射，不改动认证、凭据或平台执行边界。项目不再发行预发行版，安全或兼容性缺陷使用新的递增稳定版本修复。
+本安全策略对应源码版本 `0.1.4`；当前已发布稳定版本以 npm Registry 的 `latest` 标签为准。DeepSeek Harness、Node.js 与操作系统按发布线明确维护；Grok CLI 不使用完整版本字符串作为信任门禁，而是严格校验官方默认路径、命令能力、生产 OIDC 凭据契约和固定服务端协议。macOS arm64 已完成真实验收；Windows x64 有代码与 CI 覆盖。`0.1.4` 只为精确 `grok-4.6` 增加有界图片输入；`grok-4.5` 与所有其他模型保持 text-only，不改动认证、凭据、CLI subprocess 或 endpoint 边界。图片只能来自 Harness attachment service 的已验证 JPEG/PNG 投影，以 `detail:"high"` 发送，并受单图字节、像素、边长、数量、总字节与最终 JSON 上限约束；URL、路径、file ID 和调用方预制 data URL 都会被拒绝。项目不再发行预发行版，安全或兼容性缺陷使用新的递增稳定版本修复。
 
 ## 私下报告漏洞
 
@@ -17,7 +17,7 @@
 - 已脱敏的请求/响应形状或错误码；
 - 建议修复方向（如有）。
 
-绝对不要发送真实 `auth.json`、access/refresh token、`user_id`、Cookie、邮箱、姓名、完整提示词、工具参数或包含这些数据的诊断包。若秘密已暴露，请先通过官方 Grok CLI 注销/重新登录并按相应服务流程撤销凭据。
+绝对不要发送真实 `auth.json`、access/refresh token、`user_id`、Cookie、邮箱、姓名、完整提示词、工具参数、原图/投影图片字节或包含这些数据的诊断包。若秘密已暴露，请先通过官方 Grok CLI 注销/重新登录并按相应服务流程撤销凭据。
 
 ## 不属于漏洞的情况
 
@@ -32,4 +32,4 @@
 
 ---
 
-English summary: GitHub Private vulnerability reporting is enabled and is the preferred reporting channel. If it is unavailable, open only a detail-free contact issue. Never publish or send real credentials, identity data, prompts, tool arguments, cookies, or unreviewed diagnostic archives. Include exact versions, platform, minimal reproduction conditions, impact, and redacted evidence.
+English summary: GitHub Private vulnerability reporting is enabled and is the preferred reporting channel. Version `0.1.4` enables bounded JPEG/PNG attachment projections with `detail:"high"` only for exact `grok-4.6`; `grok-4.5` and all other models remain text-only. It accepts no URL, path, file ID, or caller-supplied data URL and does not change authentication or endpoints. If private reporting is unavailable, open only a detail-free contact issue. Never publish or send real credentials, identity data, prompts, tool arguments, cookies, source/projected image bytes, or unreviewed diagnostic archives. Include exact versions, platform, minimal reproduction conditions, impact, and redacted evidence.

package/dist/host/index.mjs

@@ -2,26 +2,22 @@ import os from "node:os"
 import path from "node:path"
 import { randomUUID } from "node:crypto"
 
-import { LlmError, attributionHeaders } from "@deepseek-ai/dsh-llm"
+import { attributionHeaders } from "@deepseek-ai/dsh-llm"
 import Schema from "@deepseek-ai/schemastery"
 
 import {
-  CredentialFileTooLargeError,
   GROK_PRODUCTION_OIDC_AUTH_CONTRACT,
   UnsupportedCredentialError,
   createCredentialSource,
 } from "../internal/credential-source.mjs"
-import { AuthModeUnavailableError } from "../internal/auth-registry.mjs"
 import { createAccountDashboard } from "../internal/account-dashboard.mjs"
 import { createAuthController } from "../internal/auth-controller.mjs"
 import { createAuthRpcHandler } from "../internal/auth-rpc.mjs"
 import { createGrokAdapter } from "../internal/grok-adapter.mjs"
 import { createGrokCommandHandler } from "../internal/grok-command-handler.mjs"
-import { GrokTransportError, createGrokTransport } from "../internal/grok-transport.mjs"
-import {
-  OfficialCredentialFileError,
-  createOfficialCredentialLoader,
-} from "../internal/official-credential-loader.mjs"
+import { createGrokTransport } from "../internal/grok-transport.mjs"
+import { mapLlmError } from "../internal/llm-error.mjs"
+import { createOfficialCredentialLoader } from "../internal/official-credential-loader.mjs"
 import { createOfficialCliAuth } from "../internal/official-cli-auth.mjs"
 import { createOfficialAuthDriver } from "../internal/official-auth-driver.mjs"
 import { verifyOfficialCliExecutable } from "../internal/official-cli-verifier.mjs"
@@ -64,6 +60,7 @@ export function apply(ctx) {
     }),
     createAdapter: ({ getGeneration }) => createGrokAdapter({
       getGeneration,
+      getAttachmentStore: () => ctx.get("attachments"),
       mapError: mapLlmError,
     }),
   })
@@ -117,31 +114,3 @@ export function apply(ctx) {
 
   ctx.effect(() => () => runtime.dispose(), "llm-grok runtime")
 }
-
-function mapLlmError(error) {
-  if (error instanceof LlmError) return error
-  if (error?.name === "AbortError") {
-    return new LlmError("The Grok Build request was cancelled", "ABORTED", { cause: error })
-  }
-  if (
-    error instanceof AuthModeUnavailableError ||
-    error instanceof UnsupportedCredentialError ||
-    error instanceof CredentialFileTooLargeError ||
-    error instanceof OfficialCredentialFileError ||
-    (error instanceof GrokTransportError && (error.status === 401 || error.status === 403))
-  ) {
-    return new LlmError("Grok authentication is required", "AUTH", {
-      cause: error,
-      ...(error.status === undefined ? {} : { status: error.status }),
-    })
-  }
-  if (error instanceof GrokTransportError) {
-    return new LlmError("The Grok Build request failed", error.status === 429 ? "RATE_LIMIT" : "PROVIDER_ERROR", {
-      cause: error,
-      ...(error.status === undefined ? {} : { status: error.status }),
-    })
-  }
-  return new LlmError("The Grok provider rejected an invalid or unsupported response", "INVALID_RESPONSE", {
-    cause: error,
-  })
-}

package/dist/internal/grok-adapter.mjs

@@ -1,6 +1,6 @@
 import { parseModelCatalogResponse } from "./model-catalog.mjs"
 import { createResponsesEventDecoder } from "./responses-codec.mjs"
-import { encodeResponsesRequest } from "./responses-request.mjs"
+import { createResponsesRequestCompiler } from "./responses-request-compiler.mjs"
 import { parseResponsesSse } from "./responses-sse.mjs"
 
 export class GrokAdapterError extends Error {
@@ -10,11 +10,16 @@ export class GrokAdapterError extends Error {
   }
 }
 
-export function createGrokAdapter({ getGeneration, mapError = (error) => error }) {
+export function createGrokAdapter({
+  getGeneration,
+  getAttachmentStore = () => undefined,
+  mapError = (error) => error,
+}) {
   if (typeof getGeneration !== "function") {
     throw new TypeError("A Grok adapter generation source is required")
   }
   if (typeof mapError !== "function") throw new TypeError("Invalid Grok adapter error mapper")
+  const requestCompiler = createResponsesRequestCompiler({ getAttachmentStore })
 
   const captureGeneration = () => {
     const generation = getGeneration()
@@ -29,17 +34,13 @@ export function createGrokAdapter({ getGeneration, mapError = (error) => error }
     return generation
   }
 
-  const resolveWithGeneration = async (generation, provider, model, signal) => {
-    try {
-      requireProvider(provider)
-      if (typeof model !== "string" || model.length === 0) throw new GrokAdapterError()
-      const entries = await discover(generation, provider, signal)
-      const match = entries.find((entry) => entry.resolvedModelInfo.id === model)
-      if (match === undefined) throw new GrokAdapterError()
-      return match.resolvedModelInfo
-    } catch (error) {
-      throw mapError(error)
-    }
+  const resolveRouteWithGeneration = async (generation, provider, model, signal) => {
+    requireProvider(provider)
+    if (typeof model !== "string" || model.length === 0) throw new GrokAdapterError()
+    const entries = await discover(generation, provider, signal)
+    const match = entries.find((entry) => entry.resolvedModelInfo.id === model)
+    if (match === undefined) throw new GrokAdapterError()
+    return match
   }
 
   return Object.freeze({
@@ -64,30 +65,43 @@ export function createGrokAdapter({ getGeneration, mapError = (error) => error }
     },
 
     async resolveModel(provider, model, signal) {
-      return resolveWithGeneration(captureGeneration(), provider, model, signal)
+      try {
+        const route = await resolveRouteWithGeneration(captureGeneration(), provider, model, signal)
+        return route.resolvedModelInfo
+      } catch (error) {
+        throw mapError(error, signal)
+      }
     },
 
     async prepareCall(provider, model, signal) {
-      const generation = captureGeneration()
-      const resolvedModel = await resolveWithGeneration(generation, provider, model, signal)
-      return Object.freeze({
-        model: resolvedModel,
-        stream(options) {
-          try {
-            validatePreparedOptions(options, resolvedModel)
-            return streamWithGeneration(generation, options, mapError)
-          } catch (error) {
-            throw mapError(error)
-          }
-        },
-      })
+      try {
+        const generation = captureGeneration()
+        const route = await resolveRouteWithGeneration(generation, provider, model, signal)
+        return Object.freeze({
+          model: route.resolvedModelInfo,
+          stream(options) {
+            let requestPlan
+            try {
+              requestPlan = requestCompiler.prepare(options)
+              validatePreparedRequestPlan(requestPlan, route.resolvedModelInfo)
+              return streamWithGeneration(generation, route, requestPlan, mapError)
+            } catch (error) {
+              throw mapError(error, requestPlan?.signal ?? readOwnDataSignal(options))
+            }
+          },
+        })
+      } catch (error) {
+        throw mapError(error, signal)
+      }
     },
 
     stream(options) {
+      let requestPlan
       try {
-        return streamWithGeneration(captureGeneration(), options, mapError)
+        requestPlan = requestCompiler.prepare(options)
+        return streamWithGeneration(captureGeneration(), undefined, requestPlan, mapError)
       } catch (error) {
-        throw mapError(error)
+        throw mapError(error, requestPlan?.signal ?? readOwnDataSignal(options))
       }
     },
   })
@@ -98,37 +112,66 @@ async function discover(generation, provider, signal) {
   return parseModelCatalogResponse(raw, { provider }).map((entry) => Object.freeze({
     backend: entry.backend,
     resolvedModelInfo: freezeModel(entry.resolvedModelInfo),
+    ...(entry.imageInput === undefined ? {} : { imageInput: entry.imageInput }),
   }))
 }
 
-async function* streamWithGeneration(generation, options, mapError) {
+async function* streamWithGeneration(generation, preparedRoute, requestPlan, mapError) {
   try {
-    requireProvider(options?.provider)
-    const request = encodeResponsesRequest(options)
+    requireProvider(requestPlan.provider)
+    const route = preparedRoute ?? await resolveRoute(generation, requestPlan)
+    const request = await requestPlan.compile(route)
     const decoder = createResponsesEventDecoder()
     for await (const event of parseResponsesSse(
-      generation.transport.streamResponses(request, { signal: options.signal }),
+      generation.transport.streamResponses(request, { signal: requestPlan.signal }),
     )) {
       for (const chunk of decoder.push(event)) yield chunk
     }
     decoder.finish()
   } catch (error) {
-    throw mapError(error)
+    throw mapError(error, requestPlan.signal)
   }
 }
 
-function validatePreparedOptions(options, resolvedModel) {
-  if (!isPlainObject(options) || options.provider !== "grok" || options.model !== resolvedModel.id) {
+async function resolveRoute(generation, options) {
+  if (typeof options?.model !== "string" || options.model.length === 0) {
     throw new GrokAdapterError()
   }
-  if (options.reasoningEffort !== undefined) {
+  const entries = await discover(generation, options.provider, options.signal)
+  const route = entries.find((entry) => entry.resolvedModelInfo.id === options.model)
+  if (route === undefined) throw new GrokAdapterError()
+  return route
+}
+
+function validatePreparedRequestPlan(requestPlan, resolvedModel) {
+  if (
+    !isPlainObject(requestPlan) ||
+    requestPlan.provider !== "grok" ||
+    requestPlan.model !== resolvedModel.id
+  ) {
+    throw new GrokAdapterError()
+  }
+  if (requestPlan.reasoningEffort !== undefined) {
     const efforts = resolvedModel.reasoning?.efforts
-    if (!Array.isArray(efforts) || !efforts.some((effort) => effort.id === options.reasoningEffort)) {
+    if (
+      !Array.isArray(efforts) ||
+      !efforts.some((effort) => effort.id === requestPlan.reasoningEffort)
+    ) {
       throw new GrokAdapterError()
     }
   }
 }
 
+function readOwnDataSignal(options) {
+  try {
+    if (!isPlainObject(options)) return undefined
+    const descriptor = Object.getOwnPropertyDescriptor(options, "signal")
+    return descriptor !== undefined && "value" in descriptor ? descriptor.value : undefined
+  } catch {
+    return undefined
+  }
+}
+
 function freezeModel(model) {
   const frozen = {
     ...model,

package/dist/internal/llm-error.mjs

@@ -0,0 +1,61 @@
+import { LlmError } from "@deepseek-ai/dsh-llm"
+
+import { AuthModeUnavailableError } from "./auth-registry.mjs"
+import {
+  CredentialFileTooLargeError,
+  UnsupportedCredentialError,
+} from "./credential-source.mjs"
+import { GrokTransportError } from "./grok-transport.mjs"
+import { OfficialCredentialFileError } from "./official-credential-loader.mjs"
+import { UnsupportedImageInputError } from "./responses-request-compiler.mjs"
+
+export function mapLlmError(error, signal) {
+  if (signal?.aborted || error?.name === "AbortError") {
+    return new LlmError("The Grok Build request was cancelled", "ABORTED", { cause: error })
+  }
+  if (error instanceof LlmError) return error
+  if (
+    error instanceof AuthModeUnavailableError ||
+    error instanceof UnsupportedCredentialError ||
+    error instanceof CredentialFileTooLargeError ||
+    error instanceof OfficialCredentialFileError ||
+    (error instanceof GrokTransportError && (error.status === 401 || error.status === 403))
+  ) {
+    return new LlmError("Grok authentication is required", "AUTH", {
+      cause: error,
+      ...(error.status === undefined ? {} : { status: error.status }),
+    })
+  }
+  if (error instanceof GrokTransportError) {
+    return new LlmError("The Grok Build request failed", error.status === 429 ? "RATE_LIMIT" : "PROVIDER_ERROR", {
+      cause: error,
+      ...(error.status === undefined ? {} : { status: error.status }),
+    })
+  }
+  if (
+    error instanceof UnsupportedImageInputError ||
+    isUnsupportedAttachmentError(error)
+  ) {
+    return new LlmError("The Grok model cannot accept this image input", "UNSUPPORTED_CONTENT", {
+      cause: error,
+    })
+  }
+  return new LlmError("The Grok provider rejected an invalid or unsupported response", "INVALID_RESPONSE", {
+    cause: error,
+  })
+}
+
+function isUnsupportedAttachmentError(error) {
+  return error instanceof Error && [
+    "TOO_MANY_IMAGES",
+    "IMAGES_TOO_LARGE",
+    "UNSUPPORTED_IMAGE_TYPE",
+    "INVALID_IMAGE_BASE64",
+    "INVALID_IMAGE",
+    "IMAGE_TYPE_MISMATCH",
+    "IMAGE_TOO_LARGE",
+    "IMAGE_TOO_MANY_PIXELS",
+    "IMAGE_DIMENSION_TOO_LARGE",
+    "ATTACHMENT_PROJECTION_UNSUPPORTED",
+  ].includes(error.code)
+}