dsh-grok-provider 0.1.6 → 0.1.9

package/CHANGELOG.md

@@ -1,5 +1,29 @@
 # Changelog
 
+## 0.1.9 - 2026-08-30
+
+- Add independent, default-off Web Search and X Search Provider settings for exact `grok-4.6`; keep every other dynamically discovered model Search-disabled until the same fixed-Proxy evidence exists.
+- Compile Harness function tools followed by `web_search` and `x_search` under one 128-tool and 16 MiB request budget, while preserving the byte-identical `0.1.7` request path when both settings are off and disabling Search for non-interactive `purpose` calls.
+- Bind each final request to a private response receipt so undeclared function names, disabled server tools, unknown events, malformed citations, and incomplete or out-of-order Search lifecycles fail closed before they can be projected into Harness.
+- Decode the fixed Proxy's standard Web Search lifecycle and its Grok-Build-specific four-name X Search `custom_tool_call` lifecycle as server-executed activity that emits no Harness tool-call chunks; observing either category suppresses encrypted reasoning replay for that response.
+- Preserve inline citation Markdown as assistant text while bounding and discarding structured citation metadata; never follow, preview, or download citation URLs.
+- Add bilingual Search risk disclosures to the existing Grok Build settings page through Harness `settingsScope`, without a second configuration RPC, renderer-local persistence, a production dependency, a new endpoint, or a new authentication mode.
+
+## 0.1.8 - 2026-08-30 (withdrawn)
+
+- Briefly published a Grok-only sidebar quota card that moved the sidebar's Grok quota querying and display ownership into the Provider, then withdrew the release by reverting that change.
+- The npm Registry version `dsh-grok-provider@0.1.8` remains permanently reserved and cannot be reused after unpublish; `latest` remains `0.1.7`, and the independent Search slice moves to `0.1.9`.
+
+## 0.1.7 - 2026-08-29
+
+- Add a separate Host diagnostics RPC that reports the installed package version and a closed Grok Build CLI state/version without exposing executable paths, stderr, environment, proxy data, or OAuth URLs.
+- Disable browser sign-in until the official default CLI executable, bounded version output, and `login --oauth` capability pass; show the official install guide and a re-detection action when the CLI is missing or invalid.
+- End the Web sign-in spinner with actionable, redacted outcomes for known OIDC discovery network timeout, the five-minute login deadline, missing/invalid CLI, and unknown CLI failure while preserving cancellation and cleanup quarantine semantics.
+- Keep runtime diagnostics single-flight and lifecycle-owned: capability teardown cancels and awaits inspection, cleanup failure latches the CLI instance and aborts its in-flight authentication actions, and serial authentication polling uses a request epoch to reject stale responses after user actions, settlement, or unmount.
+- Document the Windows pre-browser OIDC failure boundary and keep runtime diagnostics outside the authentication status polling path; the official CLI still owns sign-in URL generation and external-browser launch, so this release does not claim to repair Windows network/proxy conditions or to have verified network-reachable browser launch on a real Windows device.
+- Render the MIT-licensed `IconThinkOutline16` path geometry from `@deepseek-ai/dsh-client-ui-primitives@0.1.0-rc.7` for the one exact Grok Build settings navigation match through a scoped, lifecycle-owned compatibility layer; ambiguous labels or unexpected DOM structure retain the Host gear, unload removes every injected resource, and the bundled third-party notice preserves attribution.
+- Keep Web/X Search, image generation, new server-tool events, arbitrary URL downloads, API-key mode, and custom endpoints out of this maintenance release; the independent Search slice moves to `0.1.9` because the sidebar-quota `0.1.8` release was withdrawn and its Registry version cannot be reused.
+
 ## 0.1.6 - 2026-08-28
 
 - Accept schema-valid provider-neutral user and system history containing private reasoning blocks, omit that reasoning from the Grok wire, and preserve adjacent visible text and ordered image input; malformed or oversized omitted blocks still fail closed before attachment I/O.

package/README.en.md

@@ -2,19 +2,20 @@
 
 [简体中文](README.md) | [English](README.en.md)
 
-Use an already authenticated official Grok Build account from DeepSeek Harness, with dynamic model discovery, streaming reasoning, tool calls, and an account quota/model capability dashboard.
+Use an already authenticated official Grok Build account from DeepSeek Harness, with dynamic model discovery, streaming reasoning, image input, optional Web/X Search, tool calls, and an account quota/model capability dashboard.
 
-> Unofficial community project; not affiliated with xAI or DeepSeek Harness. The current source version is `0.1.6`; published stable versions are identified by the npm Registry `latest` tag. The project no longer publishes prereleases; stable defects are fixed in a new incremented stable version.
+> Unofficial community project; not affiliated with xAI or DeepSeek Harness. The current source candidate is `0.1.9`. Version `0.1.8` was published and then withdrawn, and npm version numbers cannot be reused; npm Registry `latest` and the current installable stable baseline remain `0.1.7`. The project no longer publishes prereleases; stable defects are fixed in a new incremented stable version.
 
 ## What it provides
 
 | Capability | Current implementation |
 | --- | --- |
-| Sign-in | Invokes official `grok login --oauth`; the plugin does not implement an OAuth grant |
+| Sign-in | Invokes official `grok login --oauth`; the official CLI owns sign-in URL generation and external-browser launch, while the plugin does not implement an OAuth grant |
 | Credentials | Reuses official CLI session state without creating a second token store |
 | Models | Discovers every model visible to the account at runtime; no static model allowlist |
 | Conversations | Streaming Responses text, reasoning, encrypted reasoning replay, usage, and finish reasons |
 | Images | Only exact `grok-4.6` accepts bounded JPEG/PNG images from Harness attachments; `grok-4.5` and all other models remain text-only |
+| Search | The `0.1.9` candidate provides independent, default-off Web Search and X Search for exact `grok-4.6`; remote lifecycles are never misrepresented as local tools |
 | Tools | Returns function calls to the Harness permission layer; the provider never executes tools |
 | Account dashboard | Login status, weekly/monthly quota, reset time, dynamic model capabilities and reasoning efforts |
 | Surfaces | Bilingual Web settings and a closed `/grok` TUI command set |
@@ -35,14 +36,14 @@ grok --version
 grok models
 ```
 
-The official CLI opens a browser on first use. The provider supports only the official default `~/.grok` directory (`%USERPROFILE%\.grok` on Windows).
+When the network is reachable and OIDC discovery succeeds, the official CLI opens a browser on first use. The provider supports only the official default `~/.grok` directory (`%USERPROFILE%\.grok` on Windows).
 
 ### 2. Install the provider
 
-After `0.1.6` is published, install that exact version from npm:
+After `0.1.9` is published, install that exact version from npm:
 
 ```sh
-dsh plugin --profile web add dsh-grok-provider@0.1.6
+dsh plugin --profile web add dsh-grok-provider@0.1.9
 dsh web
 ```
 
@@ -50,7 +51,7 @@ dsh web
 
 Open **Settings → Grok Build**:
 
-1. Select “Sign in with Grok.”
+1. Select “Sign in with browser.”
 2. Complete authorization in the page opened by the official Grok CLI.
 3. Return to Harness and refresh the account dashboard.
 4. Select any account-visible Grok model from the model picker.
@@ -61,25 +62,42 @@ The provider does not take over the login page or ask you to paste an access or
 
 The Web settings page shows:
 
-- login state and sign-in, cancel, and logout actions;
+- login state, Provider/Grok Build CLI versions, and sign-in, cancel, and logout actions;
+- the official installation link and “Check again” recovery when the CLI is missing or invalid;
 - used/remaining quota and the real billing-period reset time;
 - account-visible models, context windows, reasoning efforts, and image-input, streaming, and tool capabilities.
+- independent, default-off Web Search and X Search settings with nearby remote-query, additional-usage, citation, and prompt-injection disclosures.
 
 When protobuf-backed billing includes a complete weekly/monthly period but omits a zero-valued percentage, the page restores “0% used / 100% remaining.” Other incomplete responses remain unknown.
 
-## Plugin preview
-
-### Account quota and model capabilities
-
-![Grok Build account quota, reset time, and dynamic model capabilities](.github/assets/plugin-preview/account-dashboard.png)
-
-### Harness model picker
+Harness `0.1.1-rc.2` does not expose an icon field on `settings.section`. The Provider embeds the MIT-licensed `IconThinkOutline16` path geometry from `@deepseek-ai/dsh-client-ui-primitives@0.1.0-rc.7` and displays it only when the `Grok Build` label and settings-dialog DOM structure produce one exact match; otherwise it safely keeps the Host gear. The compatibility observer, marker, and style are all removed when the plugin unloads.
 
-![Selecting Grok 4.6 or Grok 4.5 in the DeepSeek Harness model picker](.github/assets/plugin-preview/model-picker.png)
-
-### Grok conversation context
+## Plugin preview
 
-![Context statistics and tool calls for a Grok 4.6 conversation](.github/assets/plugin-preview/grok-context.png)
+Select a preview to view the full-size image.
+
+<table>
+  <tr>
+    <td colspan="3" width="50%" valign="top" align="center">
+      <a href=".github/assets/plugin-preview/image-input.png"><img src=".github/assets/plugin-preview/image-input.png" alt="Grok 4.6 analyzing an image attached to a Harness conversation" width="100%"></a><br>
+      <sub><strong>Image input</strong> — Grok 4.6 analyzes Harness attachments directly</sub>
+    </td>
+    <td colspan="3" width="50%" valign="top" align="center">
+      <a href=".github/assets/plugin-preview/model-picker.png"><img src=".github/assets/plugin-preview/model-picker.png" alt="Selecting Grok 4.6 or Grok 4.5 in the DeepSeek Harness model picker" width="100%"></a><br>
+      <sub><strong>Model selection</strong> — Choose Grok 4.6 or Grok 4.5 based on account capabilities</sub>
+    </td>
+  </tr>
+  <tr>
+    <td colspan="4" width="66.67%" valign="top" align="center">
+      <a href=".github/assets/plugin-preview/grok-context.png"><img src=".github/assets/plugin-preview/grok-context.png" alt="Context statistics and tool calls for a Grok 4.6 conversation" width="100%"></a><br>
+      <sub><strong>Conversation context</strong> — Inspect context statistics and tool calls</sub>
+    </td>
+    <td colspan="2" width="33.33%" valign="top" align="center">
+      <a href=".github/assets/plugin-preview/account-dashboard.png"><img src=".github/assets/plugin-preview/account-dashboard.png" alt="Grok Build account quota, reset time, and dynamic model capabilities" width="100%"></a><br>
+      <sub><strong>Account dashboard</strong> — Quota, reset time, and dynamic model capabilities</sub>
+    </td>
+  </tr>
+</table>
 
 TUI commands:
 
@@ -112,8 +130,8 @@ Uninstalling the provider does not remove the official Grok CLI or directly modi
 
 ## Sources and discovery
 
-- npm `0.1.6` page (available after publication): [dsh-grok-provider@0.1.6](https://www.npmjs.com/package/dsh-grok-provider/v/0.1.6)
-- GitHub `0.1.6` release and integrity values (available after publication): [v0.1.6](https://github.com/yoshino-xiao7/dsh-grok-provider/releases/tag/v0.1.6)
+- Current npm stable release: [dsh-grok-provider@0.1.7](https://www.npmjs.com/package/dsh-grok-provider/v/0.1.7)
+- Most recent GitHub release and integrity values: [v0.1.7](https://github.com/yoshino-xiao7/dsh-grok-provider/releases/tag/v0.1.7)
 - GitHub community discovery: the repository carries the DeepSeek Harness-recommended `dsh-plugin` and `dsh` topics
 - YukiRyou managed source: [deepseek-yukiryou-plugin-catalog](https://github.com/yoshino-xiao7/deepseek-yukiryou-plugin-catalog), still pinned to the real-device-accepted `dsh-grok-provider@0.1.0` and marking only `darwin-arm64`
 
@@ -121,19 +139,21 @@ Directory inclusion is not an endorsement by xAI or DeepSeek Harness. [Listing P
 
 ## Compatibility and scope
 
-| Item | `0.1.6` status |
+| Item | `0.1.9` candidate status |
 | --- | --- |
 | DeepSeek Harness | Exact support for `0.1.1-rc.2` |
 | Node.js | `>=24.19.0` |
-| macOS arm64 | Real-network and isolated Harness acceptance completed |
-| Windows x64 | Code, slow-fake, and Windows CI supported; by owner decision, real browser launch is checked against the exact Registry version after publication |
+| macOS arm64 | The published `0.1.7` baseline completed real-network acceptance; `0.1.9` Search passed four isolated Web Harness cases under fail-closed fixtures |
+| Windows x64 | Covered by code, slow fakes, and passing `0.1.9` Windows 2022 CI. On a reachable network the official CLI generates the URL and opens the browser, and that path still lacks real-device Windows acceptance |
 | macOS x64 / Linux | Unsupported |
 | Grok CLI | No full-version lock; official path, `login --oauth` capability, and production OIDC credential contract are enforced |
 | Models | Every account catalog model whose backend has a strict codec in this release |
 
-`0.1.6` preserves the `0.1.4` image boundary: image input is enabled only for exact `grok-4.6`, while `grok-4.5` and every other dynamically discovered model remain text-only. The account dashboard projects capability badges from that same catalog, so only image-capable models show “Image input.” Images must be verified JPEG/PNG projections from the Harness attachment service. Ordinary user content and images nested one level inside a tool result are supported, with `detail:"high"` fixed to the official xAI Responses image example; URLs, filesystem paths, file IDs, and caller-supplied data URLs are rejected. Private reasoning in ordinary user/system history is omitted while adjacent visible text remains ordered, so `subagent-settled` history and same-message reasoning no longer block image requests.
+`0.1.9` preserves the image boundary of published `0.1.7`: image input is enabled only for exact `grok-4.6`, while `grok-4.5` and every other dynamically discovered model remain text-only. Image sending has been confirmed in a real Harness conversation. Images must be verified JPEG/PNG projections from the Harness attachment service. Ordinary user content and images nested one level inside a tool result are supported with fixed `detail:"high"`; URLs, filesystem paths, file IDs, and caller-supplied data URLs are rejected. Private reasoning in ordinary user/system history is omitted while adjacent visible text remains ordered.
+
+Each projected image is limited to 4 MiB, 16,777,216 pixels, and 8192px per side. A request retains at most eight images and 8 MiB of projected image bytes. When a limit is exceeded, the globally oldest images are offloaded to Harness text placeholders; the final JSON remains capped at 16 MiB.
 
-Each projected image is limited to 4 MiB, 16,777,216 pixels, and 8192px per side. A request retains at most eight images and 8 MiB of projected image bytes. When a limit is exceeded, the globally oldest images are offloaded to Harness text placeholders; the final JSON remains capped at 16 MiB. Web/X Search, image generation, arbitrary downloads, API-key mode, multiple accounts, enterprise OIDC, ACP, and Headless agent wrapping remain out of scope; see the [capability roadmap](docs/11-capability-roadmap.md).
+The `0.1.9` candidate adds two default-off Search settings only for exact `grok-4.6`. Once enabled, ordinary conversation content and model-derived queries are sent to xAI and may incur additional usage. Web/X activity is already executed server-side and is not projected as a Harness-local tool call. Citation Markdown remains ordinary assistant text; bounded structured URL metadata is discarded, and the plugin never opens or downloads a citation. Search results are untrusted remote data, so verify sources before commands or file changes. Image generation, arbitrary downloads, API-key mode, multiple accounts, enterprise OIDC, ACP, and Headless agent wrapping remain out of scope; see the [capability roadmap](docs/11-capability-roadmap.md).
 
 ## How it works
 
@@ -159,7 +179,7 @@ Model IDs come from the runtime catalog rather than a hardcoded list. Image moda
 - The Host must perform a bounded read of the official `auth.json`, whose raw file may contain a refresh token. The parser does not use, cache, or persist that refresh token; it retains only validation metadata and a short-lived access-token lease.
 - The provider does not implement a refresh grant. Near expiry it may invoke one bounded official `grok models`, then reread and revalidate the official credential file.
 - Login subprocesses use fixed argv, a scrubbed environment, output limits, deadlines, cancellation, and no shell.
-- Prompts, tool results, and image projections selected for a request are sent to the xAI Grok Build service; the provider itself does not log that content, source images, or projected bytes.
+- Prompts, tool results, image projections selected for a request, and Search queries when enabled are sent to the xAI Grok Build service; the provider itself does not log that content, source images, projected bytes, or citation URLs.
 
 See the full [threat model](docs/03-security-threat-model.md). For vulnerabilities, read the [security policy](SECURITY.md) and never post tokens, `auth.json`, personal data, or full diagnostic logs in a public issue.
 
@@ -167,12 +187,24 @@ See the full [threat model](docs/03-security-threat-model.md). For vulnerabiliti
 
 ### “Grok CLI not found”
 
-Confirm the official CLI is in its default location and run `grok --version`. The provider will not load an executable from PATH, the workspace, or a UI-selected arbitrary path.
+Install Grok Build CLI from the official link shown on the page, then click “Detect again.” Confirm that the CLI is in its default location and run `grok --version`. The provider does not install the CLI automatically and will not load an executable from PATH, the workspace, or a UI-selected arbitrary path. The settings page displays both the provider and verified CLI versions.
 
 ### The page asks you to sign in again
 
 Use the settings button or run `grok login --oauth` in a terminal. The provider does not lock the complete CLI version, but fails closed when the path, `--oauth` capability, or production OIDC credential contract does not match.
 
+### The browser does not open after clicking sign-in on Windows
+
+Run the official CLI directly first:
+
+```powershell
+& "$env:USERPROFILE\.grok\bin\grok.exe" login --oauth
+```
+
+If it times out at `auth.x.ai/.well-known/openid-configuration`, the failure occurs before a sign-in URL is generated; it is not a broken Provider browser button. Check Windows DNS, outbound HTTPS, firewall, VPN, and proxy settings—especially when the browser uses PAC/system proxy but the CLI process has no `HTTPS_PROXY`. Do not disable TLS verification or post proxy credentials, sign-in URLs, authorization codes, or tokens in an issue.
+
+The settings page promptly settles this known discovery timeout and says that browser sign-in has not started. An authentication flow that is still running within the five-minute deadline remains cancellable, while unknown CLI output is reduced to a redacted generic error. This is accurate diagnosis of the failure boundary: the Provider does not open the browser itself and does not repair Windows DNS, proxy, firewall, VPN, or official-CLI behavior.
+
 ### A model is missing
 
 Run `grok models` and verify that the same account can see it. The provider returns every valid catalog record; an unknown backend fails discovery rather than being silently filtered.
@@ -187,7 +219,7 @@ Versions through `0.1.2` could not convert some third-party tool-call histories
 
 ### Does Windows work?
 
-Windows x64 code and CI coverage are present. Ordinary later stable fixes do not repeat real-device acceptance; changes to authentication, the Harness subprocess seam, or platform security policy still require targeted validation.
+Windows x64 is covered by code, slow fakes, and passing `0.1.9` Windows 2022 CI. The official CLI still generates the sign-in URL and launches the external browser. Network-reachable browser launch has not yet been confirmed on a real Windows device, so it must not be described as fixed or verified.
 
 ## Development
 
@@ -221,8 +253,9 @@ Read the [contributing guide](CONTRIBUTING.md) before filing an issue or PR. Cha
 - [x] Publish the `0.1.3` cross-provider tool-history compatibility correction
 - [x] Publish `0.1.4`: image input only for exact `grok-4.6`; red/blue user/tool-result Proxy gates and final Harness attachment revalidation passed, while `grok-4.5` fails closed as text-only
 - [x] Publish `0.1.5`: maintenance for release binding, dashboard capability badges, and transactional Provider Runtime installation; the unique artifact, dual-platform CI, signatures, and SLSA provenance are verified
-- [ ] Publish `0.1.6`: image-history reasoning compatibility and per-stage official-CLI deadline repair for Windows
-- [ ] Independent `0.1.7` slice: opt-in, default-off Web Search / X Search
+- [x] Publish `0.1.6`: image-history reasoning compatibility and per-stage official-CLI deadline repair for Windows; image sending is confirmed in a real Harness conversation
+- [x] Publish `0.1.7`: Provider/CLI version diagnostics, CLI installation recovery, redacted OIDC discovery-timeout settlement, and the `IconThinkOutline16` settings-navigation compatibility layer
+- [ ] Publish `0.1.9`: opt-in, default-off Web Search / X Search; `0.1.8` was published and then withdrawn, and its npm version number cannot be reused
 - [ ] A subsequent slice: opt-in image generation (inline results only, committed through Harness attachments)
 - [ ] Complete independent Windows x64 acceptance and publish a later stable fix if needed
 
@@ -230,4 +263,4 @@ Slice details, gates, and permanent non-goals are in the [capability roadmap](do
 
 ## License
 
-[MIT](LICENSE)
+[MIT](LICENSE). See [`THIRD_PARTY_NOTICES.md`](THIRD_PARTY_NOTICES.md) for the reused Harness icon geometry and its license.

package/README.md

@@ -2,19 +2,20 @@
 
 [简体中文](README.md) | [English](README.en.md)
 
-让 DeepSeek Harness 使用你已登录的官方 Grok Build 账号：动态模型发现、流式推理、工具调用，以及账号额度与模型能力面板。
+让 DeepSeek Harness 使用你已登录的官方 Grok Build 账号：动态模型发现、流式推理、图片输入、可选 Web/X Search、工具调用，以及账号额度与模型能力面板。
 
-> 非官方社区项目，与 xAI 或 DeepSeek Harness 官方无隶属关系。当前源码版本为 `0.1.6`；npm 已发布稳定版本以 Registry 的 `latest` 标签为准。项目不再发行预发行版；正式版缺陷通过新的递增稳定版本修复。
+> 非官方社区项目，与 xAI 或 DeepSeek Harness 官方无隶属关系。当前源码候选版本为 `0.1.9`。`0.1.8` 曾发布后撤回，npm 版本号不可复用；npm Registry 的 `latest` 与当前可安装的稳定基线仍为 `0.1.7`。项目不再发行预发行版；正式版缺陷通过新的递增稳定版本修复。
 
 ## 它解决什么问题
 
 | 能力 | 当前实现 |
 | --- | --- |
-| 登录 | 调用官方 `grok login --oauth` 打开浏览器；插件不实现 OAuth grant |
+| 登录 | 调用官方 `grok login --oauth`；登录 URL 生成与外部浏览器打开均由官方 CLI 负责，插件不实现 OAuth grant |
 | 凭据 | 复用官方 CLI 的登录状态；插件不创建第二份 token 存储 |
 | 模型 | 运行时读取账号可见的全部 Grok Build 模型，不维护静态模型白名单 |
 | 对话 | Responses 流式文本、reasoning、加密 reasoning replay、usage 与 finish reason |
 | 图片 | 仅精确 `grok-4.6` 接收 Harness attachment 中有界的 JPEG/PNG 图片；`grok-4.5` 与其他模型保持 text-only |
+| 搜索 | `0.1.9` 候选为精确 `grok-4.6` 提供默认关闭、可分别开启的 Web Search / X Search；远端 lifecycle 不伪装成本地工具 |
 | 工具 | 将 function call 交回 Harness 权限层；Provider 本身不执行工具 |
 | 账户面板 | 登录状态、每周/月额度、重置时间、动态模型能力与 reasoning 档位 |
 | 界面 | Web 设置页中英文切换；TUI 提供闭合的 `/grok` 命令 |
@@ -35,14 +36,14 @@ grok --version
 grok models
 ```
 
-首次运行 Grok CLI 会打开浏览器登录。插件只支持官方默认的 `~/.grok`（Windows 为 `%USERPROFILE%\.grok`）目录。
+当网络可达且 OIDC discovery 成功时，首次运行 Grok CLI 会打开浏览器登录。插件只支持官方默认的 `~/.grok`（Windows 为 `%USERPROFILE%\.grok`）目录。
 
 ### 2. 安装 Provider
 
-`0.1.6` 发布后，从 npm 安装该精确版本：
+`0.1.9` 发布后，从 npm 安装该精确版本：
 
 ```sh
-dsh plugin --profile web add dsh-grok-provider@0.1.6
+dsh plugin --profile web add dsh-grok-provider@0.1.9
 dsh web
 ```
 
@@ -50,7 +51,7 @@ dsh web
 
 打开 **设置 → Grok Build**：
 
-1. 点击“使用 Grok 登录”；
+1. 点击“通过浏览器登录”；
 2. 在官方 Grok CLI 打开的浏览器页面完成授权；
 3. 返回 Harness，刷新账户面板；
 4. 在模型选择器中选择当前账号可见的 Grok 模型。
@@ -61,25 +62,42 @@ dsh web
 
 Web 设置页展示：
 
-- 当前登录状态及登录、取消、退出操作；
+- 当前登录状态、Provider/Grok Build CLI 版本及登录、取消、退出操作；
+- CLI 缺失或无效时的官方安装入口与“重新检测”操作；
 - 已使用/剩余额度和真实周期重置时间；
 - 当前账号可见模型、上下文窗口、reasoning 档位，以及图片输入、streaming 与 tool capability。
+- 默认关闭且相互独立的 Web Search / X Search 开关，以及远端检索、额外用量、citation 和 prompt injection 风险提示。
 
 当 protobuf-backed billing 返回完整的 weekly/monthly 周期但省略零值百分比时，页面会恢复为“已使用 0% / 剩余 100%”；其他不完整响应保持未知，不伪造额度。
 
-## 插件预览
-
-### 账户额度与模型能力
-
-![Grok Build 账户额度、重置时间和动态模型能力](.github/assets/plugin-preview/account-dashboard.png)
-
-### Harness 模型选择器
+当前 Harness `0.1.1-rc.2` 的 `settings.section` 没有插件图标字段。Provider 内嵌来自 `@deepseek-ai/dsh-client-ui-primitives@0.1.0-rc.7`、采用 MIT 许可的 `IconThinkOutline16` 路径几何；仅当设置对话框中的标签与 DOM 结构都精确且唯一匹配时，才用它显示 `Grok Build` 导航项，否则安全保留宿主齿轮。兼容层的观察器、标记和样式均随插件卸载清理。
 
-![在 DeepSeek Harness 模型选择器中选择 Grok 4.6 或 Grok 4.5](.github/assets/plugin-preview/model-picker.png)
-
-### Grok 对话上下文
+## 插件预览
 
-![Grok 4.6 对话的上下文统计与工具调用](.github/assets/plugin-preview/grok-context.png)
+点击预览图可查看原图。
+
+<table>
+  <tr>
+    <td colspan="3" width="50%" valign="top" align="center">
+      <a href=".github/assets/plugin-preview/image-input.png"><img src=".github/assets/plugin-preview/image-input.png" alt="Grok 4.6 分析 Harness 对话中的图片输入" width="100%"></a><br>
+      <sub><strong>图片输入</strong> — Grok 4.6 直接分析 Harness 附件</sub>
+    </td>
+    <td colspan="3" width="50%" valign="top" align="center">
+      <a href=".github/assets/plugin-preview/model-picker.png"><img src=".github/assets/plugin-preview/model-picker.png" alt="在 DeepSeek Harness 模型选择器中选择 Grok 4.6 或 Grok 4.5" width="100%"></a><br>
+      <sub><strong>模型选择</strong> — 按当前账户能力选择 Grok 4.6 或 Grok 4.5</sub>
+    </td>
+  </tr>
+  <tr>
+    <td colspan="4" width="66.67%" valign="top" align="center">
+      <a href=".github/assets/plugin-preview/grok-context.png"><img src=".github/assets/plugin-preview/grok-context.png" alt="Grok 4.6 对话的上下文统计与工具调用" width="100%"></a><br>
+      <sub><strong>对话上下文</strong> — 查看上下文统计与工具调用</sub>
+    </td>
+    <td colspan="2" width="33.33%" valign="top" align="center">
+      <a href=".github/assets/plugin-preview/account-dashboard.png"><img src=".github/assets/plugin-preview/account-dashboard.png" alt="Grok Build 账户额度、重置时间和动态模型能力" width="100%"></a><br>
+      <sub><strong>账户面板</strong> — 额度、重置时间与动态模型能力</sub>
+    </td>
+  </tr>
+</table>
 
 TUI 命令：
 
@@ -112,8 +130,8 @@ dsh web
 
 ## 项目来源与发现
 
-- npm `0.1.6` 页面（发布后可用）：[dsh-grok-provider@0.1.6](https://www.npmjs.com/package/dsh-grok-provider/v/0.1.6)
-- GitHub `0.1.6` 发行版与校验值（发布后可用）：[v0.1.6](https://github.com/yoshino-xiao7/dsh-grok-provider/releases/tag/v0.1.6)
+- npm 当前稳定版：[dsh-grok-provider@0.1.7](https://www.npmjs.com/package/dsh-grok-provider/v/0.1.7)
+- GitHub 最近发行版与校验值：[v0.1.7](https://github.com/yoshino-xiao7/dsh-grok-provider/releases/tag/v0.1.7)
 - GitHub 社区发现：仓库已添加 DeepSeek Harness 官方推荐的 `dsh-plugin` 与 `dsh` Topics
 - YukiRyou 受管来源：[deepseek-yukiryou-plugin-catalog](https://github.com/yoshino-xiao7/deepseek-yukiryou-plugin-catalog)，当前仍锁定已完成真机验收的 `dsh-grok-provider@0.1.0`，且只标记 `darwin-arm64`
 
@@ -121,19 +139,21 @@ dsh web
 
 ## 兼容性与范围
 
-| 项目 | `0.1.6` 状态 |
+| 项目 | `0.1.9` 候选状态 |
 | --- | --- |
 | DeepSeek Harness | 精确支持 `0.1.1-rc.2` |
 | Node.js | `>=24.19.0` |
-| macOS arm64 | 已完成真实网络与隔离 Harness 验收 |
-| Windows x64 | 代码、slow-fake 与 Windows CI 支持；按仓库所有者决定，发布 Registry 精确版本后验证真实浏览器弹出 |
+| macOS arm64 | 已发布的 `0.1.7` 基线已完成真实网络验收；`0.1.9` Search 已完成失败关闭 fixture 下的隔离 Web Harness 四场景验收 |
+| Windows x64 | 代码、slow-fake 与 `0.1.9` Windows 2022 CI 已通过；网络可达时由官方 CLI 生成 URL 并打开浏览器，该路径仍未完成 Windows 真机验收 |
 | macOS x64 / Linux | 不支持 |
 | Grok CLI | 不锁完整版本；严格校验官方路径、`login --oauth` 能力与生产 OIDC 凭据契约 |
 | 模型 | 当前账号目录中 backend 已被严格 codec 支持的全部模型 |
 
-`0.1.6` 沿用 `0.1.4` 的图片边界：只为精确的 `grok-4.6` 开启图片输入；`grok-4.5` 与其他动态发现的模型继续按 text-only 处理。账户面板从同一模型目录投影能力标签，因此只有图片模型显示“图片输入”。图片只能来自 Harness attachment service 的已验证 JPEG/PNG 投影，支持普通用户内容和一层工具结果中的图片，并按 xAI 官方 Responses 图片示例固定使用 `detail:"high"`；不接受 URL、文件路径、file ID 或调用方预制的 data URL。普通 user/system 历史中的私有 reasoning 会被省略并保留相邻可见文本，因此 `subagent-settled` 历史和同消息 reasoning 不再阻断图片请求。
+`0.1.9` 沿用已发布 `0.1.7` 的图片边界：只为精确的 `grok-4.6` 开启图片输入；`grok-4.5` 与其他动态发现的模型继续按 text-only 处理。图片发送已在真实 Harness 对话中确认可用。图片只能来自 Harness attachment service 的已验证 JPEG/PNG 投影，支持普通用户内容和一层工具结果中的图片，并固定使用 `detail:"high"`；不接受 URL、文件路径、file ID 或调用方预制的 data URL。普通 user/system 历史中的私有 reasoning 会被省略并保留相邻可见文本。
+
+每张投影图片最多 4 MiB、16,777,216 像素且任一边不超过 8192px；每次请求最多保留 8 张、投影字节合计最多 8 MiB。超限时按全局最旧优先移除图片并保留 Harness 的文本占位，最终 JSON 仍受 16 MiB 上限约束。
 
-每张投影图片最多 4 MiB、16,777,216 像素且任一边不超过 8192px；每次请求最多保留 8 张、投影字节合计最多 8 MiB。超限时按全局最旧优先移除图片并保留 Harness 的文本占位，最终 JSON 仍受 16 MiB 上限约束。Web/X Search、图片生成、任意文件下载、API Key 模式、多账号、企业 OIDC、ACP 与 Headless agent 封装仍不在本版本范围内；后续切片见[能力路线图](docs/11-capability-roadmap.md)。
+`0.1.9` 候选只为精确 `grok-4.6` 增加两个默认关闭的 Search 开关。开启后，普通对话内容以及模型据此生成的检索词会交给 xAI，并可能产生额外用量。Web/X 是服务端已执行的检索过程，不会变成 Harness 本地工具调用；回答中的 citation Markdown 保留为普通文本，结构化 URL 元数据有界校验后丢弃，插件不会打开或下载引用。搜索结果属于不可信远端数据，执行命令或修改文件前应核实来源。图片生成、任意文件下载、API Key 模式、多账号、企业 OIDC、ACP 与 Headless agent 封装仍不在本版本范围内；后续切片见[能力路线图](docs/11-capability-roadmap.md)。
 
 ## 工作原理
 
@@ -159,7 +179,7 @@ dsh-grok-provider Host
 - Host 必须有界读取官方 `auth.json`，其原始文件可能包含 refresh token；解析器不使用、不缓存、不持久化 refresh token，只保留闭合校验所需元数据与短期 access-token lease。
 - 插件不实现 refresh grant；凭据临近过期时，只能有界调用一次官方 `grok models`，再重新读取并验证官方文件。
 - 登录子进程使用固定 argv、过滤后的环境、输出上限、deadline 与取消处理，不通过 shell 启动。
-- 提示词、工具结果以及用户选择发送的图片投影会发往 xAI Grok Build 服务；插件本身不记录这些内容、原图或投影字节。
+- 提示词、工具结果、用户选择发送的图片投影，以及启用 Search 后的检索词会发往 xAI Grok Build 服务；插件本身不记录这些内容、原图、投影字节或 citation URL。
 
 完整边界见[威胁模型](docs/03-security-threat-model.md)。发现安全问题时，请阅读[安全策略](SECURITY.md)，不要在公开 Issue 中提交 token、`auth.json`、个人信息或完整诊断日志。
 
@@ -167,12 +187,24 @@ dsh-grok-provider Host
 
 ### 页面显示“找不到 Grok CLI”
 
-确认官方 CLI 位于默认路径，并在终端执行 `grok --version`。插件不会从 PATH、工作区或 UI 指定的任意路径加载可执行文件。
+按页面中的官方安装入口安装 Grok Build CLI，再点击“重新检测”。确认 CLI 位于默认路径，并在终端执行 `grok --version`。插件不会自动安装 CLI，也不会从 PATH、工作区或 UI 指定的任意路径加载可执行文件。设置页会同时显示 Provider 与已验证 CLI 的版本。
 
 ### 页面要求重新登录
 
 在设置页点击登录，或先在终端运行 `grok login --oauth`。插件不锁完整 CLI 版本，但路径、`--oauth` 能力或生产 OIDC 凭据契约不匹配时会失败关闭。
 
+### Windows 点击登录后没有弹出浏览器
+
+先直接运行官方 CLI：
+
+```powershell
+& "$env:USERPROFILE\.grok\bin\grok.exe" login --oauth
+```
+
+如果它在 `auth.x.ai/.well-known/openid-configuration` 超时，失败发生在生成登录链接之前，不是 Provider 的浏览器按钮失效。请检查 Windows 的 DNS、HTTPS 出站、防火墙、VPN 与代理；尤其是浏览器使用 PAC/系统代理、CLI 进程却没有 `HTTPS_PROXY` 的情况。不要关闭 TLS 校验，也不要把代理凭据、登录 URL、授权码或 token 提交到 Issue。
+
+设置页会及时结算这个已知 discovery 超时并显示“浏览器登录尚未开始”；实际仍在运行的五分钟登录流程可以取消，未知 CLI 输出只显示脱敏的通用错误。这是对失败边界的准确诊断，不是插件自行打开浏览器，也不修复 Windows 的 DNS、代理、防火墙、VPN 或官方 CLI 行为。
+
 ### 没有看到某个模型
 
 先运行 `grok models`，确认该模型对同一账号可见。Provider 动态返回全部合法目录记录；未知 backend 会让发现失败，而不会被静默过滤。
@@ -187,7 +219,7 @@ dsh-grok-provider Host
 
 ### Windows 能用吗
 
-代码和 Windows CI 覆盖 Windows x64。普通后续稳定修复不重复要求真机验收；认证流程、Harness subprocess seam 或平台安全策略发生变化时仍会定向验证。
+代码、slow-fake 与 `0.1.9` Windows 2022 CI 已覆盖 Windows x64。官方 CLI 仍负责生成登录 URL 与打开外部浏览器；网络可达的 Windows 真机浏览器弹出尚未确认，因此不能表述为该问题已经修复或验证。
 
 ## 开发
 
@@ -221,8 +253,9 @@ npm run pack:check
 - [x] 发布 `0.1.3` 跨 Provider 工具调用历史兼容性修正版
 - [x] 发布 `0.1.4`：仅精确 `grok-4.6` 图片输入；user/tool-result 红蓝语义 Proxy 门禁与最终 Harness attachment 复验通过，`grok-4.5` 失败关闭为 text-only
 - [x] 发布 `0.1.5`：发布链路、账户面板能力标签与 Provider Runtime 安装回滚维护版；唯一制品、双平台 CI、签名与 SLSA provenance 均已验证
-- [ ] 发布 `0.1.6`：图片历史 reasoning 兼容与 Windows 官方 CLI 分阶段 deadline 修复版
-- [ ] `0.1.7` 独立切片：默认关闭、用户分别开启的 Web Search / X Search
+- [x] 发布 `0.1.6`：图片历史 reasoning 兼容与 Windows 官方 CLI 分阶段 deadline 修复版；图片发送已完成真实 Harness 验证
+- [x] 发布 `0.1.7`：Provider/CLI 双版本诊断、CLI 安装恢复、OIDC discovery 超时脱敏结算与 `IconThinkOutline16` 设置导航兼容层
+- [ ] 发布 `0.1.9`：默认关闭、用户分别开启的 Web Search / X Search；`0.1.8` 已发布后撤回且 npm 版本号不可复用
 - [ ] 再后续独立切片：默认关闭的图片生成（只收内联结果，提交 Harness attachment）
 - [ ] 完成 Windows x64 独立真机验收并按需发布后续稳定修复版
 
@@ -230,4 +263,4 @@ npm run pack:check
 
 ## 许可证
 
-[MIT](LICENSE)
+[MIT](LICENSE)。复用的 Harness 图标几何及其许可见 [`THIRD_PARTY_NOTICES.md`](THIRD_PARTY_NOTICES.md)。

package/SECURITY.md

@@ -4,11 +4,13 @@
 
 ## 支持范围
 
-本安全策略对应源码版本 `0.1.6`；当前已发布稳定版本以 npm Registry 的 `latest` 标签为准。DeepSeek Harness、Node.js 与操作系统按发布线明确维护；Grok CLI 不使用完整版本字符串作为信任门禁，而是严格校验官方默认路径、命令能力、生产 OIDC 凭据契约和固定服务端协议。macOS arm64 已完成真实验收；Windows x64 有代码、slow-fake 与 CI 覆盖，外部浏览器弹出由仓库所有者在 Registry 精确 `0.1.6` 发布后验证。
+本安全策略对应源码候选版本 `0.1.9`。`0.1.8` 曾发布后撤回，npm 版本号不可复用；npm Registry 的 `latest` 与当前可安装的稳定基线仍为 `0.1.7`。DeepSeek Harness、Node.js 与操作系统按发布线明确维护；Grok CLI 不使用完整版本字符串作为信任门禁，而是严格校验官方默认路径、命令能力、生产 OIDC 凭据契约和固定服务端协议。已发布的 `0.1.7` 基线在 macOS arm64 完成真实验收，图片发送也已在真实 Harness 对话中确认可用；`0.1.9` Search 已完成失败关闭 fixture 下的隔离 Web Harness `ctx.llm` 四场景验收。macOS 14 / Windows 2022 CI 已通过，但浏览器手工对话、OAuth、真实账号/真实 xAI Search 请求和网络可达 Windows 真机外部浏览器弹出不在该隔离验收覆盖范围内。
 
-`0.1.6` 沿用 `0.1.4` 的图片边界：只为精确 `grok-4.6` 提供有界图片输入；`grok-4.5` 与所有其他模型保持 text-only。普通 user/system 历史中的私有 reasoning 会被省略并保留相邻可见 text/image；只有有效的同 Provider assistant 历史可进入加密 reasoning replay，一层 tool-result 仍只接受公开 text/image。图片只能来自 Harness attachment service 的已验证 JPEG/PNG 投影，以 `detail:"high"` 发送，并受单图字节、像素、边长、数量、总字节与最终 JSON 上限约束；URL、路径、file ID 和调用方预制 data URL 都会被拒绝。
+`0.1.9` 沿用已发布 `0.1.7` 的图片边界：只为精确 `grok-4.6` 提供有界图片输入；`grok-4.5` 与所有其他模型保持 text-only。普通 user/system 历史中的私有 reasoning 会被省略并保留相邻可见 text/image；只有有效的同 Provider assistant 历史可进入加密 reasoning replay，一层 tool-result 仍只接受公开 text/image。图片只能来自 Harness attachment service 的已验证 JPEG/PNG 投影，以 `detail:"high"` 发送，并受单图字节、像素、边长、数量、总字节与最终 JSON 上限约束；URL、路径、file ID 和调用方预制 data URL 都会被拒绝。
 
-CLI executable 解析、只读验证、`--version`、`login --help` 与最终 action 各自拥有 deadline；direct-process completion 观察同一取消，whole-tree teardown 另有有界 wait。登录 starting、confirmed logout 与 credential refresh 共享 controller-owned single-flight、shutdown fence 和 driver-generation 门禁；清理失败会隔离当前认证 driver 直到 Host 重启或 subprocess driver replacement，旧代际操作不能迟发 CLI 动作或报告成功。固定路径/argv、最小环境、无 shell、输出上限、取消和登录后凭据重验边界不变；本版不新增认证模式、Search、生成或 endpoint。项目不再发行预发行版，安全或兼容性缺陷使用新的递增稳定版本修复。
+`0.1.7` 的闭合运行时诊断、CLI 安装恢复、OIDC timeout 脱敏结算和 `IconThinkOutline16` 兼容层在本版保持不变。官方 CLI 仍负责生成登录 URL 与打开外部浏览器；插件不修复系统 DNS、代理、防火墙、VPN 或 CLI 行为。
+
+`0.1.9` 只为精确 `grok-4.6` 增加两个默认关闭的 Web/X Search 开关。启用后，普通对话内容与模型生成的检索词会交给 xAI，并可能产生额外用量；结果和 citation 属于可能错误或含提示注入的不可信远端数据。Provider 只允许固定 Proxy 实测的 Web lifecycle 与四项 X custom-tool 名称，不把它们映射为 Harness 本地工具，不跟随或下载 citation URL，并在观察到 Search 后放弃该响应的 encrypted reasoning replay。后台 purpose、未验证模型、未启用类别、未知事件和未闭合 lifecycle 均失败关闭。固定路径/argv、最小环境、无 shell、输出上限、凭据、固定 origin 与 URL 拒绝边界不变；本版不新增生成、认证模式或 endpoint。
 
 ## 私下报告漏洞
 
@@ -25,7 +27,7 @@ CLI executable 解析、只读验证、`--version`、`login --help` 与最终 ac
 
 ## 不属于漏洞的情况
 
-- Windows x64 在 `0.1.0` 发布后仍未完成首次 Registry 真机验证这一已披露状态；
+- 网络可达 Windows 真机外部浏览器弹出尚未完成验收这一已披露状态；
 - 上游未提供额度字段时 UI 显示 unknown；
 - 不受支持的 CLI/Harness/平台版本被明确拒绝；
 - 官方 CLI 或 xAI 服务自身的行为，且无法由本插件边界缓解的问题。
@@ -36,4 +38,4 @@ CLI executable 解析、只读验证、`--version`、`login --help` 与最终 ac
 
 ---
 
-English summary: GitHub Private vulnerability reporting is enabled and is the preferred reporting channel. Version `0.1.6` preserves bounded JPEG/PNG attachment input with `detail:"high"` only for exact `grok-4.6`; `grok-4.5` and all other models remain text-only. It omits schema-valid private reasoning from ordinary user/system history while preserving visible text/images, gives each official-CLI preparation/action stage an independent deadline, and bounds direct-process/tree settlement. Login start, confirmed logout, and credential refresh share controller-owned single-flight, a shutdown fence, and driver-generation guards. Cleanup failure quarantines the current authentication driver until Host restart or subprocess-driver replacement, and stale operations cannot dispatch or report success. Fixed path/argv, no-shell, credential, origin, and URL-rejection boundaries remain unchanged; no Search, generation, new auth mode, or custom endpoint is added. Never send credentials, identity data, prompts, tool arguments, cookies, image bytes, or unreviewed diagnostics.
+English summary: GitHub Private vulnerability reporting is enabled and preferred. The current source candidate is `0.1.9`. Version `0.1.8` was published and then withdrawn, and npm version numbers cannot be reused; npm Registry `latest` and the current installable stable baseline remain `0.1.7`. Bounded JPEG/PNG input with fixed `detail:"high"` remains enabled only for exact `grok-4.6`; browser sign-in diagnostics remain closed and redacted, and the official CLI still owns URL generation and browser launch. The `0.1.9` candidate adds independent, default-off Web/X Search only for exact `grok-4.6`. Its four isolated Web Harness `ctx.llm` cases and macOS 14 / Windows 2022 CI have passed under fail-closed fixtures; this does not cover manual browser conversations, OAuth, a real account, real xAI Search requests, or network-reachable Windows browser launch. When enabled, prompts and model-derived queries reach xAI and may incur additional usage; results and citations are untrusted remote data. The provider accepts only the fixed-Proxy Web lifecycle and four verified X custom-tool names, emits no Harness-local tool calls for server search, never follows citation URLs, and suppresses encrypted reasoning replay after Search. Background-purpose calls, unverified models, disabled categories, unknown events, and incomplete lifecycles fail closed. Fixed path/argv, no-shell, credential, origin, and URL-rejection boundaries remain unchanged; no image generation, new auth mode, or custom endpoint is added. Never send credentials, identity data, prompts, tool arguments, cookies, image bytes, Search contents, or unreviewed diagnostics.

package/THIRD_PARTY_NOTICES.md

@@ -0,0 +1,30 @@
+# Third-Party Notices
+
+The Web client includes SVG path geometry from `IconThinkOutline16` in
+`@deepseek-ai/dsh-client-ui-primitives@0.1.0-rc.7`, part of
+[DeepSeek Harness](https://github.com/deepseek-ai/deepseek-harness/tree/master/packages/client/ui-primitives).
+The following license applies to that portion:
+
+## @deepseek-ai/dsh-client-ui-primitives
+
+MIT License
+
+Copyright (c) 2026 DeepSeek
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.