dsh-grok-provider 1.0.0 → 1.0.1

package/CHANGELOG.md

@@ -1,14 +1,22 @@
 # Changelog
 
-## 1.0.0 - 2026-08-30 (candidate)
+## 1.0.1 - Unreleased
+
+- Fix fixed-Proxy HTTP 400 failures when enabled xAI server `web_search` / `x_search` descriptors coexist with Harness function definitions using the same reserved names. Every source function is still fully validated first; only the definitions whose names collide with enabled server tools are omitted from the wire request. The same local functions remain available whenever the corresponding server Search setting is off.
+- Preserve historical `function_call` / `function_call_output` items, including prior `web_search` and `x_search` calls, so an existing conversation can continue without rewriting or discarding its tool history. Bind the response decoder to a receipt that rejects any function/server-tool name intersection.
+- Preserve transport failures raised while reading the SSE source instead of relabeling them as parser failures. Fixed-Proxy HTTP 400 maps to `PROVIDER_ERROR`; focused adapter coverage also locks 401/403 to `AUTH`, 429 to `RATE_LIMIT`, and `AbortError` to `ABORTED`, while malformed, truncated, or unsupported SSE continues to map to `INVALID_RESPONSE`.
+- Complete one redacted real-account replay of the original failing X-session structure: 8 messages and 40 source functions compiled to 38 function definitions plus 2 server Search descriptors while preserving 2 historical reserved-name calls. One models GET and one Responses POST yielded 314 events and `response.completed`. No message text, result text, URL, account identity, or credential was retained.
+- Set the source manifest and lockfile to the unpublished `1.0.1` candidate. The exact Node `24.19.0` local suite passes with 253 tests, 251 pass, 0 fail, and 2 platform skips; the production dependency audit reports zero vulnerabilities, an isolated-cache dry-run pack lists 73 files, and the secret-pattern scan finds only the explicit fixture canary and its checklist record. Code PR #31, its push/PR CI, merge commit `0c60200e12c3b8455331f31a317ece9b1945c458`, and main CI run `33312621786` passed on macOS 14 and Windows 2022. A fixed final release commit, frozen artifact, isolated installation, Registry publication, signatures, attestations, provenance, and real-device Windows validation remain pending and must not be inferred from local or code-merge gates.
+
+## 1.0.0 - 2026-08-30
 
 - Fix the remaining `INVALID_RESPONSE` failures observed with exact `grok-4.6` Search responses by accepting repeated, already Search-backed reasoning IDs only as strictly empty placeholders. "Strictly empty" means no visible summary/content and no summary/raw lifecycle; a bounded opaque `encrypted_content` field remains permitted for replay continuity.
 - Require every reused reasoning lifecycle to reach its own `response.output_item.done`. Incomplete lifecycles, cross-type reuse, reuse before the original item closes or before one completed server Search, non-empty summary/raw content, unknown terminal fields, and accessor-backed terminal fields continue to fail closed.
 - Accept the observed completed Web Search `open_page` action only as the exact bounded `{ type: "open_page", url }` shape, require the streamed and final action type/URL to agree, discard the URL after validation, and never open, fetch, preview, or replay it.
 - Capture Search terminal items and their response containers through own-data snapshots before dispatch or comparison, so self-replacing accessors cannot mutate IDs, inputs, action types, or `open_page` URLs during validation. Once an ID is Search-backed, later empty reuses also short-circuit the completed-Search scan.
 - Add focused protocol regressions for multiple empty reuses, Web/X Search-backed reuse, lifecycle completion, closed reuse followed by max-token completion, opaque encrypted content, nested/container accessor rejection, and `open_page` start/final consistency.
-- Complete two-layer redacted real-account verification without retaining prompts, results, URLs, account identity, or credentials: raw Web/X protocol probes each completed one 64-event response and observed the requested Search kind; the production adapter completed 5 Responses calls, with direct Web/X both ending in `stop` and a Harness-shaped same-name `x_search` flow ending `tool-calls`, `tool-calls`, then `stop`, with one local call in each of the first two turns.
-- Set the source manifest and lockfile to `1.0.0`; pass 245 Node 24 tests (243 pass, 0 fail, 2 platform skips), production audit, deterministic build/bundle comparison, 72-entry dry-run pack, secret scan, and diff check. Code PR #28 and main CI run `33308371009` pass on macOS 14 and Windows 2022. Keep npm `latest` and the supported stable release at `0.1.11` until the release-evidence commit's final CI, frozen artifact, exact owner authorization, publication, Registry readback, signatures, attestations, and provenance are complete. Real-device Windows external-browser launch remains unverified.
+- Complete two-layer redacted real-account verification without retaining prompts, results, URLs, account identity, or credentials: raw Web/X protocol probes each completed one 64-event response and observed the requested Search kind; the production adapter completed 5 Responses calls, with direct Web/X both ending in `stop` and a Harness-shaped local `x_search` call/result continuation ending `tool-calls`, `tool-calls`, then `stop`, with one local call in each of the first two turns. That continuation did not place a Harness `x_search` function definition beside an xAI `{ type: "x_search" }` server descriptor in the same wire request; `1.0.1` later isolated that combination as an HTTP 400 conflict.
+- Set the source manifest and lockfile to `1.0.0`; pass 245 Node 24 tests (243 pass, 0 fail, 2 platform skips), production audit, deterministic build/bundle comparison, 72-entry dry-run pack, secret scan, and diff check. Code PR #28 and main CI run `33308371009` passed on macOS 14 and Windows 2022. Release commit `c6548199582b122f1d285422eabea0205eaf602f` passed final dual-platform CI run `33308603394`; annotated tag object `192561cda1ac58cbc4077f0de8fa614dff9a5557` peels to that commit. Trusted Publisher run `33309083806` attempt 1 published the explicitly authorized unique 72-file artifact: 226,704 bytes packed, 715,014 bytes unpacked, SHA-1 `50e5d898dba241d1e19def7705db216e3060b892`, SHA-256 `30cd83dad77f7d2611126b3c4737c8fabffeae79f385fa623e61dcecfe39f5e2`, and SRI `sha512-WL2f6Kfg5yT5nNf1p4//mLSajCnZttL/pDR3BISrFgSGtZd9DEJlnibq08ETz503n1wHIdCBcU/ICMPG9K4vOw==`. The frozen candidate, GitHub Release, and npm tarballs are byte-identical; npm reports `latest=1.0.0`, the isolated Node 24 Host `name`/`apply` and client `id` smoke passed, package metadata exposes 1 signature and 2 attestations, `npm audit signatures` verified 11 signed packages and 2 attestations, and SLSA provenance binds the tag, workflow, commit, and publish run. Real-device Windows external-browser launch remains unverified.
 
 ## 0.1.11 - 2026-08-30
 

package/README.en.md

@@ -4,11 +4,11 @@
 
 Use an already authenticated official Grok Build account from DeepSeek Harness, with dynamic model discovery, streaming reasoning, image input, optional Web/X Search, tool calls, and an account quota/model capability dashboard.
 
-> Unofficial community project; not affiliated with xAI or DeepSeek Harness. The current stable release and npm Registry `latest` remain `0.1.11`. Version `1.0.0` is an in-development Search-response protocol repair candidate: it is not published, has no frozen unique artifact, and has not received exact-artifact publication authorization. Do not treat its candidate install command or real-account probes as Registry release evidence. Version `0.1.8` was published and then withdrawn and cannot be reused. The project no longer publishes prereleases; stable defects are fixed in a new incremented stable version.
+> Unofficial community project; not affiliated with xAI or DeepSeek Harness. The current stable release and npm Registry `latest` are both `1.0.0`. Source is preparing an unpublished `1.0.1` repair candidate; version `0.1.8` was published and then withdrawn and cannot be reused.
 
-The current source candidate is `1.0.0`; npm Registry `latest` remain `0.1.11` until publication and readback complete.
+The current source candidate is `1.0.1`; npm Registry `latest` is `1.0.0`. Continue installing `1.0.0` until a `1.0.1` artifact is frozen, receives separate exact publication authorization, and completes Registry readback.
 
-The `1.0.0` candidate addresses two real upstream shapes: after one completed Search, the same reasoning ID may continue through multiple strictly empty placeholder lifecycles; a completed Web Search may also return an `open_page` action. The candidate accepts only closed, Search-backed, strictly empty reuse and an exact bounded `{ type: "open_page", url }`; it never opens or downloads the URL.
+The `1.0.1` candidate fixes another real Search failure: when xAI server `web_search` / `x_search` is enabled, same-name Harness function definitions alongside those server tools cause fixed-Proxy HTTP 400. The candidate fully validates every function before omitting only enabled-name collisions from the wire definitions; historical function calls/results remain. The SSE layer also propagates transport errors, so HTTP 400 surfaces as `PROVIDER_ERROR` instead of a misleading `INVALID_RESPONSE`.
 
 ## What it provides
 
@@ -19,8 +19,8 @@ The `1.0.0` candidate addresses two real upstream shapes: after one completed Se
 | Models | Discovers every model visible to the account at runtime; no static model allowlist |
 | Conversations | Streaming Responses text, reasoning, encrypted reasoning replay, usage, and finish reasons |
 | Images | Only exact `grok-4.6` accepts bounded JPEG/PNG images from Harness attachments; `grok-4.5` and all other models remain text-only |
-| Search | Published `0.1.11` provides default-off Web/X Search for exact `grok-4.6`; the `1.0.0` candidate adds multiple strictly empty reasoning reuses and completed `open_page` actions, while remote lifecycles are never misrepresented as local tools |
-| Tools | Returns function calls to the Harness permission layer; the provider never executes tools |
+| Search | Published `1.0.0` provides default-off Web/X Search for exact `grok-4.6`; the `1.0.1` candidate resolves HTTP 400 conflicts between server Search and same-name Harness function definitions |
+| Tools | Returns function calls to the Harness permission layer; the provider never executes tools, and local `web_search` / `x_search` remain when the corresponding Search setting is off |
 | Account dashboard | Login status, weekly/monthly quota, reset time, dynamic model capabilities and reasoning efforts |
 | Surfaces | Bilingual Web settings and a closed `/grok` TUI command set |
 
@@ -46,20 +46,11 @@ When the network is reachable and OIDC discovery succeeds, the official CLI open
 
 Install the exact published version that has been read back from the Registry:
 
-```sh
-dsh plugin --profile web add dsh-grok-provider@0.1.11
-dsh web
-```
-
-After `1.0.0` is published and read back from the Registry, use:
-
 ```sh
 dsh plugin --profile web add dsh-grok-provider@1.0.0
 dsh web
 ```
 
-Do not treat that candidate command as currently installable; npm `latest` is still `0.1.11`.
-
 ### 3. Sign in and select a model
 
 Open **Settings → Grok Build**:
@@ -143,9 +134,9 @@ Uninstalling the provider does not remove the official Grok CLI or directly modi
 
 ## Sources and discovery
 
-- Current npm stable release: [dsh-grok-provider@0.1.11](https://www.npmjs.com/package/dsh-grok-provider/v/0.1.11) (unique artifact, dual-platform CI, signatures, attestations, and provenance verified)
-- Most recent GitHub release and integrity values: [v0.1.11](https://github.com/yoshino-xiao7/dsh-grok-provider/releases/tag/v0.1.11)
-- Release evidence: release commit `2e5c6dbc8bb83377a4db4d8e31452b3ce96500c5`, annotated tag object `353bcd3717d4440ab20a2b05a5e9d51eef22fa7f` peeling to that commit, final CI run [`33303080849`](https://github.com/yoshino-xiao7/dsh-grok-provider/actions/runs/33303080849), and Trusted Publisher run [`33303631312`](https://github.com/yoshino-xiao7/dsh-grok-provider/actions/runs/33303631312). The repository owner explicitly authorized the unique 71-file artifact, which is 207,022 bytes packed and 656,139 bytes unpacked; SHA-256 is `8fca0eca86769ee9febd35606cc8c944a0ae968cec2937a30ccaf68d36d42b2d` and SRI is `sha512-2qInRIq5Dkf7CqXq8z1mVvMelStg3nZ1wuWEqsExgfm7iXF0Jn5f7d11IAtHRxdKdJm/j0s8tYT1Dx6IdtGNqg==`. Registry, Release, and local copies are byte-identical, and an isolated Registry install passed Host/client smoke. `npm audit signatures` confirmed verified Registry signatures for 9 packages and verified attestations for 3 packages; this package's public metadata exposes 1 Registry signature and 2 attestations, and provenance binds `release.yml`, `v0.1.11`, the release commit, and publish run exactly.
+- Current npm stable release: [dsh-grok-provider@1.0.0](https://www.npmjs.com/package/dsh-grok-provider/v/1.0.0) (unique artifact, dual-platform CI, signatures, attestations, and provenance verified)
+- Most recent GitHub release and integrity values: [v1.0.0](https://github.com/yoshino-xiao7/dsh-grok-provider/releases/tag/v1.0.0)
+- Release evidence: release commit `c6548199582b122f1d285422eabea0205eaf602f`, annotated tag object `192561cda1ac58cbc4077f0de8fa614dff9a5557` peeling to that commit, final CI run [`33308603394`](https://github.com/yoshino-xiao7/dsh-grok-provider/actions/runs/33308603394), and Trusted Publisher run [`33309083806` attempt 1](https://github.com/yoshino-xiao7/dsh-grok-provider/actions/runs/33309083806/attempts/1). The repository owner explicitly authorized the unique 72-file artifact, which is 226,704 bytes packed and 715,014 bytes unpacked; SHA-1 is `50e5d898dba241d1e19def7705db216e3060b892`, SHA-256 is `30cd83dad77f7d2611126b3c4737c8fabffeae79f385fa623e61dcecfe39f5e2`, and SRI is `sha512-WL2f6Kfg5yT5nNf1p4//mLSajCnZttL/pDR3BISrFgSGtZd9DEJlnibq08ETz503n1wHIdCBcU/ICMPG9K4vOw==`. Frozen-candidate, GitHub Release, and npm Registry copies are byte-identical; an isolated Node 24 install passed Host `name`/`apply` and client `id` smoke checks. `npm audit signatures` confirmed verified Registry signatures for 11 packages and verified attestations for 2 packages; this package's public metadata exposes 1 Registry signature and 2 attestations, and provenance binds `release.yml`, `v1.0.0`, the release commit, and publish run exactly.
 - GitHub community discovery: the repository carries the DeepSeek Harness-recommended `dsh-plugin` and `dsh` topics
 - YukiRyou managed source: [deepseek-yukiryou-plugin-catalog](https://github.com/yoshino-xiao7/deepseek-yukiryou-plugin-catalog), still pinned to the real-device-accepted `dsh-grok-provider@0.1.0` and marking only `darwin-arm64`
 
@@ -153,21 +144,29 @@ Directory inclusion is not an endorsement by xAI or DeepSeek Harness. [Listing P
 
 ## Compatibility and scope
 
-### `1.0.0` candidate repair boundary
+### `1.0.1` candidate repair boundary
+
+- The cause is not the model, account, Search response shape, or a 42-tool total. It is the coexistence of a same-name Harness function definition with `{ type: "web_search" }` / `{ type: "x_search" }` when server Search is enabled; the fixed Proxy returns HTTP 400 for that combination.
+- The compiler fully validates all 40 source functions before omitting only wire definitions that collide with an enabled server Search tool. Local tools remain unchanged when the corresponding setting is off, and historical `function_call` / `function_call_output` items are neither deleted nor renamed.
+- The final request receipt rejects every function/server-tool name intersection. The SSE parser preserves source transport errors, so HTTP 400 maps to `PROVIDER_ERROR` while genuine SSE/protocol faults remain `INVALID_RESPONSE`.
+- One explicitly authorized redacted real-account replay used the original failing X-session structure: 8 messages, 40 source functions, 38 wire functions + 2 server tools, with 2 historical reserved-name calls preserved. Exactly 1 models GET and 1 Responses POST yielded 314 events and `response.completed`. No message/response text, URL, identity, or credential was retained.
+- The exact Node `24.19.0` local suite reports 253 tests, 251 pass, 0 fail, and 2 platform skips; the production dependency audit reports zero vulnerabilities, an isolated-cache dry-run pack lists 73 files, and the secret-pattern scan finds only the explicit fixture canary and its checklist record. Code PR #31 push/PR CI, merge commit `0c60200e12c3b8455331f31a317ece9b1945c458`, and main CI run `33312621786` pass on macOS 14 and Windows 2022. This evidence still does not establish a fixed final release commit, frozen artifact, isolated installation, publication, supply-chain readback, or real-device Windows browser login. See [`docs/releases/v1.0.1.md`](docs/releases/v1.0.1.md) for candidate details.
+
+### `1.0.0` repair boundary
 
 - The original reasoning lifecycle must close, and one completed Web/X server Search must precede the first reuse of that ID. Later appearances are accepted only as strictly empty placeholders.
 - "Strictly empty" means empty visible summary/content and no summary/raw lifecycle. A bounded opaque `encrypted_content` value is allowed, but it is not exposed as visible reasoning and upstream plaintext is not retained.
 - Every reuse must receive its own `response.output_item.done`. If `response.incomplete` arrives while a reused lifecycle is still open, the stream maps to the generic invalid-response error; a later `max_output_tokens` terminal remains valid after every reused lifecycle has closed. Non-empty summary/raw data, cross-type reuse, unknown terminal fields, and accessor-backed fields remain rejected.
 - A completed `open_page` action accepts only exact `type + url`; streamed and final action type/URL must agree. The Provider discards the URL after validation and never visits, previews, downloads, or replays it.
-- Two-layer redacted real-account verification passed against the final source: raw Web/X probes each completed one 64-event response, observed the requested Search kind, and reached `completed`; the production adapter completed 5 Responses calls, with direct Web/X both ending in `stop` and a same-name Harness `x_search` flow ending `tool-calls`, `tool-calls`, then `stop`, with one local call in each of the first two turns. No results, URLs, prompts, identity, or credentials were retained; this is not publication, OAuth, or real-device Windows evidence.
-- The manifest and lockfile are synchronized at `1.0.0`; the Node 24 suite reports 245 tests, 243 pass, 0 fail, and 2 platform skips. Production audit reports zero vulnerabilities, and the deterministic build/bundle comparison, 72-entry dry-run pack, secret scan, and diff check pass. Code PR #28 is merged at `yukiryou/main@7a6364dd58f3c7e9e1ad68a3d0197a14254bcb8c`, and main CI run [`33308371009`](https://github.com/yoshino-xiao7/dsh-grok-provider/actions/runs/33308371009) passes on macOS 14 and Windows 2022. The release-evidence commit's final CI, frozen artifact, digest/SRI, exact authorization, publication, and Registry/signature/attestation/provenance readback remain pending.
+- Two-layer redacted real-account verification passed against the final source: raw Web/X probes each completed one 64-event response, observed the requested Search kind, and reached `completed`; the production adapter completed 5 Responses calls, with direct Web/X both ending in `stop` and a Harness-shaped local `x_search` call/result continuation ending `tool-calls`, `tool-calls`, then `stop`, with one local call in each of the first two turns. That continuation did not place a Harness `x_search` function definition beside an xAI `{ type: "x_search" }` server descriptor in the same wire request; `1.0.1` later isolated that combination as an HTTP 400 conflict. No results, URLs, prompts, identity, or credentials were retained; this is not publication, OAuth, or real-device Windows evidence.
+- The manifest and lockfile are synchronized at `1.0.0`; the Node 24 suite reports 245 tests, 243 pass, 0 fail, and 2 platform skips. Production audit reports zero vulnerabilities, and the deterministic build/bundle comparison, 72-entry dry-run pack, secret scan, and diff check pass. Code PR #28, main CI run [`33308371009`](https://github.com/yoshino-xiao7/dsh-grok-provider/actions/runs/33308371009), the final release commit, dual-platform final CI, unique artifact, exact authorization, and Registry/signature/attestation/provenance readback are complete.
 
-| Item | Published `0.1.11` status |
+| Item | Published `1.0.0` status |
 | --- | --- |
 | DeepSeek Harness | Exact support for `0.1.1-rc.2` |
 | Node.js | `>=24.19.0` |
-| macOS arm64 | Image sending has real-Harness confirmation; focused `0.1.11` regressions, the redacted summary/Search probe, final macOS 14 CI, and unique-artifact acceptance all pass |
-| Windows x64 | Final `0.1.11` Windows 2022 CI and existing slow fakes pass. On a reachable network the official CLI generates the URL and opens the browser, and that path still lacks real-device Windows acceptance |
+| macOS arm64 | Image sending has real-Harness confirmation; focused `1.0.0` regressions, the redacted Search probes, final macOS 14 CI, and unique-artifact acceptance all pass |
+| Windows x64 | Final `1.0.0` Windows 2022 CI and existing slow fakes pass. On a reachable network the official CLI generates the URL and opens the browser, and that path still lacks real-device Windows acceptance |
 | macOS x64 / Linux | Unsupported |
 | Grok CLI | No full-version lock; official path, `login --oauth` capability, and production OIDC credential contract are enforced |
 | Models | Every account catalog model whose backend has a strict codec in this release |
@@ -281,7 +280,7 @@ Read the [contributing guide](CONTRIBUTING.md) before filing an issue or PR. Cha
 - [x] Publish `0.1.9`: added the Web/X Search protocol and settings page; the unique artifact, dual-platform CI, signatures, and SLSA provenance are verified; post-release verification found the missing Host settings namespace and unusable controls
 - [x] Publish `0.1.10`: `llm-grok` registration, per-call capture, unique artifact, dual-platform CI, signatures, and provenance are complete
 - [x] Publish `0.1.11`: repair High Effort + Web Search reasoning-lifecycle compatibility; the unique artifact, final dual-platform CI, exact authorization, Registry, signatures, attestations, and provenance readback are complete
-- [ ] Publish `1.0.0`: repair multiple strictly empty reasoning-ID reuses and completed Web Search `open_page` actions; the code PR and main dual-platform CI pass, while release-evidence final CI, the unique artifact, and exact authorization remain pending
+- [x] Publish `1.0.0`: repair multiple strictly empty reasoning-ID reuses and completed Web Search `open_page` actions; the unique artifact, final dual-platform CI, exact authorization, Registry, signatures, attestations, and provenance readback are complete
 - [ ] A subsequent slice: opt-in image generation (inline results only, committed through Harness attachments)
 - [ ] Complete independent Windows x64 acceptance and publish a later stable fix if needed
 

package/README.md

@@ -4,11 +4,11 @@
 
 让 DeepSeek Harness 使用你已登录的官方 Grok Build 账号：动态模型发现、流式推理、图片输入、可选 Web/X Search、工具调用，以及账号额度与模型能力面板。
 
-> 非官方社区项目，与 xAI 或 DeepSeek Harness 官方无隶属关系。当前稳定版及 npm Registry 的 `latest` 仍为 `0.1.11`。`1.0.0` 正在作为 Search 响应协议修复候选开发，尚未发布、尚未冻结唯一制品，也尚未获得精确制品发布授权；不得把候选安装命令或真实账号探针表述为 Registry 发布事实。`0.1.8` 曾发布后撤回且版本号不可复用。项目不再发行预发行版；正式版缺陷通过新的递增稳定版本修复。
+> 非官方社区项目，与 xAI 或 DeepSeek Harness 官方无隶属关系。当前稳定版及 npm Registry 的 `latest` 均为 `1.0.0`。源码正在准备尚未发布的 `1.0.1` 修复候选；`0.1.8` 曾发布后撤回且版本号不可复用。
 
-当前源码候选版本为 `1.0.0`；npm Registry 的 `latest` 仍为 `0.1.11`。
+当前源码候选版为 `1.0.1`；npm Registry 的 `latest` 为 `1.0.0`。在 `1.0.1` 制品冻结、另行获得精确发布授权并完成 Registry 回读前，请继续安装 `1.0.0`。
 
-`1.0.0` 候选解决两类真实上游形状：一次 Search 完成后，同一 reasoning ID 可能继续以多个严格空占位生命周期出现；已完成 Web Search 也可能返回 `open_page` action。候选只接受闭合、Search-backed、严格空的复用，以及精确且有界的 `{ type: "open_page", url }`，不会打开或下载 URL。
+`1.0.1` 候选修复另一类真实 Search 失败：启用 xAI server `web_search` / `x_search` 时，Harness 同名 function definitions 与 server tools 共存会被固定 Proxy 以 HTTP 400 拒绝。候选先完整验证全部 functions，再只过滤已启用的同名 wire definition；历史 function calls/results 保留。SSE 层也会透传 transport error，使 HTTP 400 显示为 `PROVIDER_ERROR`，而不是误报 `INVALID_RESPONSE`。
 
 ## 它解决什么问题
 
@@ -19,8 +19,8 @@
 | 模型 | 运行时读取账号可见的全部 Grok Build 模型，不维护静态模型白名单 |
 | 对话 | Responses 流式文本、reasoning、加密 reasoning replay、usage 与 finish reason |
 | 图片 | 仅精确 `grok-4.6` 接收 Harness attachment 中有界的 JPEG/PNG 图片；`grok-4.5` 与其他模型保持 text-only |
-| 搜索 | 已发布 `0.1.11` 提供精确 `grok-4.6` 的默认关闭 Web/X Search；`1.0.0` 候选补齐多次严格空 reasoning 复用与完成态 `open_page` action，远端 lifecycle 仍不伪装成本地工具 |
-| 工具 | 将 function call 交回 Harness 权限层；Provider 本身不执行工具 |
+| 搜索 | 已发布 `1.0.0` 为精确 `grok-4.6` 提供默认关闭的 Web/X Search；`1.0.1` 候选解决 server Search 与 Harness 同名 function definition 的 HTTP 400 冲突 |
+| 工具 | 将 function call 交回 Harness 权限层；Provider 本身不执行工具，关闭对应 Search 开关时保留本地 `web_search` / `x_search` |
 | 账户面板 | 登录状态、每周/月额度、重置时间、动态模型能力与 reasoning 档位 |
 | 界面 | Web 设置页中英文切换；TUI 提供闭合的 `/grok` 命令 |
 
@@ -46,20 +46,11 @@ grok models
 
 从 npm 安装已发布并完成 Registry 回读的精确版本：
 
-```sh
-dsh plugin --profile web add dsh-grok-provider@0.1.11
-dsh web
-```
-
-`1.0.0` 发布并完成 Registry 回读后，可改用：
-
 ```sh
 dsh plugin --profile web add dsh-grok-provider@1.0.0
 dsh web
 ```
 
-当前请不要把这条候选命令当作已可安装版本；npm `latest` 仍是 `0.1.11`。
-
 ### 3. 登录并选择模型
 
 打开 **设置 → Grok Build**：
@@ -143,9 +134,9 @@ dsh web
 
 ## 项目来源与发现
 
-- npm 当前稳定版：[dsh-grok-provider@0.1.11](https://www.npmjs.com/package/dsh-grok-provider/v/0.1.11)（唯一制品、双平台 CI、签名、attestations 与 provenance 已验证）
-- GitHub 最近发行版与校验值：[v0.1.11](https://github.com/yoshino-xiao7/dsh-grok-provider/releases/tag/v0.1.11)
-- 发布证据：release commit `2e5c6dbc8bb83377a4db4d8e31452b3ce96500c5`，annotated tag object `353bcd3717d4440ab20a2b05a5e9d51eef22fa7f` peel 至该提交，final CI run [`33303080849`](https://github.com/yoshino-xiao7/dsh-grok-provider/actions/runs/33303080849)，Trusted Publisher run [`33303631312`](https://github.com/yoshino-xiao7/dsh-grok-provider/actions/runs/33303631312)。仓库所有者明确授权的唯一 tarball 含 71 个文件、207,022 bytes，unpacked size 656,139 bytes；SHA-256 为 `8fca0eca86769ee9febd35606cc8c944a0ae968cec2937a30ccaf68d36d42b2d`，SRI 为 `sha512-2qInRIq5Dkf7CqXq8z1mVvMelStg3nZ1wuWEqsExgfm7iXF0Jn5f7d11IAtHRxdKdJm/j0s8tYT1Dx6IdtGNqg==`。Registry、Release 与本地制品逐字节一致，Registry 隔离安装及 Host/client smoke 通过；`npm audit signatures` 确认安装图中 9 个包具有已验证 Registry 签名、3 个包具有已验证 attestations，本包公开 metadata 包含 1 个 Registry signature、2 个 attestations，provenance 精确绑定 `release.yml`、`v0.1.11`、release commit 与 publish run。
+- npm 当前稳定版：[dsh-grok-provider@1.0.0](https://www.npmjs.com/package/dsh-grok-provider/v/1.0.0)（唯一制品、双平台 CI、签名、attestations 与 provenance 已验证）
+- GitHub 最近发行版与校验值：[v1.0.0](https://github.com/yoshino-xiao7/dsh-grok-provider/releases/tag/v1.0.0)
+- 发布证据：release commit `c6548199582b122f1d285422eabea0205eaf602f`，annotated tag object `192561cda1ac58cbc4077f0de8fa614dff9a5557` peel 至该提交，final CI run [`33308603394`](https://github.com/yoshino-xiao7/dsh-grok-provider/actions/runs/33308603394)，Trusted Publisher run [`33309083806` attempt 1](https://github.com/yoshino-xiao7/dsh-grok-provider/actions/runs/33309083806/attempts/1)。仓库所有者明确授权的唯一 tarball 含 72 个文件、226,704 bytes，unpacked size 715,014 bytes；SHA-1 为 `50e5d898dba241d1e19def7705db216e3060b892`，SHA-256 为 `30cd83dad77f7d2611126b3c4737c8fabffeae79f385fa623e61dcecfe39f5e2`，SRI 为 `sha512-WL2f6Kfg5yT5nNf1p4//mLSajCnZttL/pDR3BISrFgSGtZd9DEJlnibq08ETz503n1wHIdCBcU/ICMPG9K4vOw==`。冻结候选、GitHub Release 与 npm Registry 制品逐字节一致；Node 24 Registry 隔离安装的 Host `name`/`apply` 与 client `id` smoke 通过。`npm audit signatures` 确认安装图中 11 个包具有已验证 Registry 签名、2 个包具有已验证 attestations；本包公开 metadata 包含 1 个 Registry signature、2 个 attestations，provenance 精确绑定 `release.yml`、`v1.0.0`、release commit 与 publish run。
 - GitHub 社区发现：仓库已添加 DeepSeek Harness 官方推荐的 `dsh-plugin` 与 `dsh` Topics
 - YukiRyou 受管来源：[deepseek-yukiryou-plugin-catalog](https://github.com/yoshino-xiao7/deepseek-yukiryou-plugin-catalog)，当前仍锁定已完成真机验收的 `dsh-grok-provider@0.1.0`，且只标记 `darwin-arm64`
 
@@ -153,21 +144,29 @@ dsh web
 
 ## 兼容性与范围
 
-### `1.0.0` 候选修复边界
+### `1.0.1` 候选修复边界
+
+- 根因不是模型、账号、Search 响应形状或 42 项工具总数，而是启用 server Search 时，同名 Harness function definition 与 `{ type: "web_search" }` / `{ type: "x_search" }` 共存；固定 Proxy 对该组合返回 HTTP 400。
+- 编译器先完整验证 40 个源 functions，再仅过滤与已启用 server Search 同名的 wire definitions。关闭对应开关时，本地工具保持原样；已有会话中的历史 `function_call` / `function_call_output` 也不删除或改名。
+- 最终 request receipt 拒绝 function/server-tool 名称交集；SSE parser 保留 source transport error，HTTP 400 因而映射到 `PROVIDER_ERROR`，真正的 SSE/协议错误仍为 `INVALID_RESPONSE`。
+- 一次经明确授权的脱敏真实账号回放使用原失败 X 会话结构：8 条 messages、40 个 source functions、wire 38 functions + 2 server tools、保留 2 个历史 reserved-name calls；只执行 1 次 models GET 和 1 次 Responses POST，接收 314 events 并以 `response.completed` 闭合。未保存消息/回复正文、URL、身份或凭据。
+- 精确 Node `24.19.0` 本地全量门禁为 253 tests、251 pass、0 fail、2 platform skips；生产依赖审计为 0 漏洞，隔离 cache 的 dry-run pack 列出 73 个文件，秘密模式扫描只命中显式 fixture canary 及其检查表记录。代码 PR #31 的 push/PR CI、merge commit `0c60200e12c3b8455331f31a317ece9b1945c458` 及 main CI run `33312621786` 已在 macOS 14 / Windows 2022 全绿。上述证据仍不代表最终 release commit、冻结制品、隔离安装、发布、供应链回读或 Windows 真机浏览器登录已经完成。候选详情见 [`docs/releases/v1.0.1.md`](docs/releases/v1.0.1.md)。
+
+### `1.0.0` 修复边界
 
 - 一个 reasoning ID 的原始生命周期必须先闭合，并且首次复用前必须已有一个完成的 Web/X server Search；之后只允许它以严格空占位再次出现。
 - “严格空”是指可见 summary/content 为空，且没有 summary/raw lifecycle；允许有界、不透明的 `encrypted_content`，但不会把它当作可见 reasoning 或保存上游明文。
 - 每次复用都必须收到独立的 `response.output_item.done`；若 `response.incomplete` 到来时仍有复用段未闭合，则返回通用非法响应错误，所有复用段已闭合后的 `max_output_tokens` 终态仍有效。非空 summary/raw、跨类型、未知 terminal 字段或 accessor 字段继续拒绝。
 - 完成态 `open_page` 只接受精确 `type + url`，streamed/final action 的类型与 URL 必须一致；Provider 校验后丢弃 URL，不会访问、预览、下载或回放。
-- 最终源码完成两层脱敏真实账号复验：原始 Web/X 协议探针各 1 次请求、各 64 events，分别观察到对应 Search 且终态 `completed`；生产 adapter 共完成 5 次 Responses，direct Web/X 均为 `stop`，Harness 同名 `x_search` 三轮依次为 `tool-calls`、`tool-calls`、`stop`，前两轮各 1 次本地调用。未保存结果、URL、prompt、身份或凭据；这些不是发布、OAuth 或 Windows 真机证据。
-- manifest/lock 已同步为 `1.0.0`；Node 24 全量测试为 245 项、243 pass、0 fail、2 项平台跳过，生产依赖审计为 0 漏洞，确定性 build/bundle、72 项 dry-run pack、秘密模式扫描与 diff 检查均通过。代码 PR #28 已合入 `yukiryou/main@7a6364dd58f3c7e9e1ad68a3d0197a14254bcb8c`，main CI run [`33308371009`](https://github.com/yoshino-xiao7/dsh-grok-provider/actions/runs/33308371009) 的 macOS 14 / Windows 2022 均通过；仍待发布证据提交的 final CI、冻结制品、摘要/SRI、精确授权、发布及 Registry/signature/attestation/provenance 回读。
+- 最终源码完成两层脱敏真实账号复验：原始 Web/X 协议探针各 1 次请求、各 64 events，分别观察到对应 Search 且终态 `completed`；生产 adapter 共完成 5 次 Responses，direct Web/X 均为 `stop`，Harness 形状的本地 `x_search` call/result 续跑三轮依次为 `tool-calls`、`tool-calls`、`stop`，前两轮各 1 次本地调用。该续跑没有在同一 wire request 中同时放入 Harness `x_search` function definition 与 xAI `{ type: "x_search" }` server descriptor；`1.0.1` 后续才隔离出这一 HTTP 400 冲突。未保存结果、URL、prompt、身份或凭据；这些不是发布、OAuth 或 Windows 真机证据。
+- manifest/lock 已同步为 `1.0.0`；Node 24 全量测试为 245 项、243 pass、0 fail、2 项平台跳过，生产依赖审计为 0 漏洞，确定性 build/bundle、72 项 dry-run pack、秘密模式扫描与 diff 检查均通过。代码 PR #28、main CI run [`33308371009`](https://github.com/yoshino-xiao7/dsh-grok-provider/actions/runs/33308371009)、最终 release commit、双平台 final CI、唯一制品、精确授权及 Registry/signature/attestation/provenance 回读均已完成。
 
-| 项目 | `0.1.11` 已发布状态 |
+| 项目 | `1.0.0` 已发布状态 |
 | --- | --- |
 | DeepSeek Harness | 精确支持 `0.1.1-rc.2` |
 | Node.js | `>=24.19.0` |
-| macOS arm64 | 图片发送已完成真实 Harness 验证；`0.1.11` 聚焦回归、脱敏真实 summary/Search 探针、final macOS 14 CI 与唯一制品验收均通过 |
-| Windows x64 | `0.1.11` final Windows 2022 CI 与现有 slow-fake 通过；网络可达时由官方 CLI 生成 URL 并打开浏览器，该路径仍未完成 Windows 真机验收 |
+| macOS arm64 | 图片发送已完成真实 Harness 验证；`1.0.0` 聚焦回归、脱敏真实 Search 探针、final macOS 14 CI 与唯一制品验收均通过 |
+| Windows x64 | `1.0.0` final Windows 2022 CI 与现有 slow-fake 通过；网络可达时由官方 CLI 生成 URL 并打开浏览器，该路径仍未完成 Windows 真机验收 |
 | macOS x64 / Linux | 不支持 |
 | Grok CLI | 不锁完整版本；严格校验官方路径、`login --oauth` 能力与生产 OIDC 凭据契约 |
 | 模型 | 当前账号目录中 backend 已被严格 codec 支持的全部模型 |
@@ -281,7 +280,7 @@ npm run pack:check
 - [x] 发布 `0.1.9`：加入 Web/X Search 协议与设置页，唯一制品、双平台 CI、签名与 SLSA provenance 均已验证；发布后确认 Host 设置 namespace 遗漏，开关不可用
 - [x] 发布 `0.1.10`：`llm-grok` 注册、按调用读取设置、唯一制品、双平台 CI、签名与 provenance 已完成
 - [x] 发布 `0.1.11`：修复 High Effort + Web Search reasoning 生命周期兼容；唯一制品、双平台 final CI、精确授权、Registry、签名、attestations 与 provenance 回读均已完成
-- [ ] 发布 `1.0.0`：修复多次严格空 reasoning ID 复用和完成态 Web Search `open_page` action；代码 PR 与 main 双平台 CI 已通过，发布证据 final CI、唯一制品与精确授权仍待完成
+- [x] 发布 `1.0.0`：修复多次严格空 reasoning ID 复用和完成态 Web Search `open_page` action；唯一制品、双平台 final CI、精确授权、Registry、签名、attestations 与 provenance 回读均已完成
 - [ ] 再后续独立切片：默认关闭的图片生成（只收内联结果，提交 Harness attachment）
 - [ ] 完成 Windows x64 独立真机验收并按需发布后续稳定修复版
 

package/SECURITY.md

@@ -4,11 +4,11 @@
 
 ## 支持范围
 
-本安全策略对应当前稳定版 `0.1.11`，npm Registry 的 `latest` 也指向 `0.1.11`。`0.1.8` 曾发布后撤回且版本号不可复用。`0.1.11` 在已发布 `0.1.10` 的 Web/X Search Host settings 修复基础上，收窄修复精确 `grok-4.6` 在 High Effort + Web Search 续跑时复用已关闭 reasoning ID 作为空占位的兼容缺口，并加入官方 raw reasoning 事件支持。最终 release commit 为 `2e5c6dbc8bb83377a4db4d8e31452b3ce96500c5`；annotated tag object `353bcd3717d4440ab20a2b05a5e9d51eef22fa7f` peel 到该提交，final CI run `33303080849` 双平台全绿，Trusted Publisher run `33303631312` 发布了仓库所有者明确授权的唯一 71 文件制品。该 tarball 为 207,022 bytes，unpacked size 656,139 bytes，SHA-256 为 `8fca0eca86769ee9febd35606cc8c944a0ae968cec2937a30ccaf68d36d42b2d`，SRI 为 `sha512-2qInRIq5Dkf7CqXq8z1mVvMelStg3nZ1wuWEqsExgfm7iXF0Jn5f7d11IAtHRxdKdJm/j0s8tYT1Dx6IdtGNqg==`；Registry、GitHub Release 与本地字节一致。Registry 隔离安装及 Host/client smoke 通过；`npm audit signatures` 确认安装图中 9 个包具有已验证 Registry 签名、3 个包具有已验证 attestations，本包公开 metadata 包含 1 个 Registry signature、2 个 attestations，provenance 精确绑定 `release.yml`、`v0.1.11`、release commit 与 publish run。DeepSeek Harness、Node.js 与操作系统按发布线明确维护；Grok CLI 不使用完整版本字符串作为信任门禁，而是严格校验官方默认路径、命令能力、生产 OIDC 凭据契约和固定服务端协议。图片发送已在真实 Harness 对话中确认可用；脱敏真实 Search 探针不保存 prompt、回复、检索词、citation URL 或凭据，但也不覆盖浏览器手工对话、OAuth、完整真实会话或网络可达 Windows 真机外部浏览器弹出。
+本安全策略对应当前稳定版 `1.0.0`，npm Registry 的 `latest` 也指向 `1.0.0`。最终 release commit 为 `c6548199582b122f1d285422eabea0205eaf602f`；annotated tag object `192561cda1ac58cbc4077f0de8fa614dff9a5557` peel 到该提交，final CI run `33308603394` 双平台全绿，Trusted Publisher run `33309083806` attempt 1 发布了仓库所有者明确授权的唯一 72 文件制品。该 tarball 为 226,704 bytes，unpacked size 715,014 bytes，SHA-1 为 `50e5d898dba241d1e19def7705db216e3060b892`，SHA-256 为 `30cd83dad77f7d2611126b3c4737c8fabffeae79f385fa623e61dcecfe39f5e2`，SRI 为 `sha512-WL2f6Kfg5yT5nNf1p4//mLSajCnZttL/pDR3BISrFgSGtZd9DEJlnibq08ETz503n1wHIdCBcU/ICMPG9K4vOw==`；冻结候选、GitHub Release 与 npm Registry 字节一致。Node 24 Registry 隔离安装的 Host `name`/`apply` 与 client `id` smoke 通过；`npm audit signatures` 确认安装图中 11 个包具有已验证 Registry 签名、2 个包具有已验证 attestations，本包公开 metadata 包含 1 个 Registry signature、2 个 attestations，provenance 精确绑定 `release.yml`、`v1.0.0`、release commit 与 publish run。`0.1.8` 曾发布后撤回且版本号不可复用。DeepSeek Harness、Node.js 与操作系统按发布线明确维护；网络可达 Windows 真机外部浏览器弹出仍未验收。
 
-`1.0.0` 是尚未发布的候选修复，不属于当前支持稳定版，也未获得精确制品发布授权。候选把 reasoning ID 复用收窄为 Search-backed 且严格空的完整生命周期：可见 summary/content 及 summary/raw lifecycle 必须为空，允许有界 opaque `encrypted_content`；每次复用都必须到达自己的 `response.output_item.done`，仅当 `response.incomplete` 到来时仍有复用段未闭合才失败关闭，所有复用段闭合后的 `max_output_tokens` 终态仍有效。非空、跨类型、未知 terminal 字段或 accessor 字段继续拒绝。完成态 Web Search `open_page` 只允许精确且有界的 `type + url`，streamed/final action 的类型与 URL 必须一致，校验后 URL 被丢弃且不会被访问、预览、下载或回放。最终源码的真实账号复验只记录计数与终态：原始 Web/X 协议各完成 1 次、各 64 events，并观察到对应 Search；生产 adapter 共完成 5 次 Responses，direct Web/X 均为 `stop`，Harness 同名 `x_search` 三轮为 `tool-calls`、`tool-calls`、`stop`。未保存结果、URL、prompt、身份或凭据。代码 PR #28 与 main CI run `33308371009` 的双平台门禁已完成；发布证据 final CI、唯一制品、摘要/SRI、授权、发布与 Registry/signature/attestation/provenance 回读仍待完成。
+`1.0.0` 把 reasoning ID 复用收窄为 Search-backed 且严格空的完整生命周期：可见 summary/content 及 summary/raw lifecycle 必须为空，允许有界 opaque `encrypted_content`；每次复用都必须到达自己的 `response.output_item.done`，仅当 `response.incomplete` 到来时仍有复用段未闭合才失败关闭，所有复用段闭合后的 `max_output_tokens` 终态仍有效。非空、跨类型、未知 terminal 字段或 accessor 字段继续拒绝。完成态 Web Search `open_page` 只允许精确且有界的 `type + url`，streamed/final action 的类型与 URL 必须一致，校验后 URL 被丢弃且不会被访问、预览、下载或回放。脱敏真实账号复验未保存结果、URL、prompt、身份或凭据；供应链回读也不构成 OAuth、完整桌面会话或 Windows 真机浏览器验收。
 
-当前源码候选版本为 `1.0.0`；npm Registry 的 `latest` 仍为 `0.1.11`。
+当前 npm Registry `latest` 与稳定发布版均为 `1.0.0`；源码 manifest/lock 已进入尚未发布的 `1.0.1` 候选。候选在启用 server Search 时先完整验证全部 Harness functions，再只从最终 wire definitions 过滤与已启用 `web_search` / `x_search` 精确同名的 callable definition；历史 function call/result 保留，关闭对应开关时本地 function 保留。request 与 decoder receipt 都拒绝 function/server-tool 名称交集。SSE source transport error 原样上抛并保持既有认证、限流、中止与 `PROVIDER_ERROR` 映射，只有 framing、JSON 或协议错误归类为 `INVALID_RESPONSE`；失败后不自动降级或重放 POST。一次授权的脱敏原失败会话结构回放已完成，但没有保存正文、URL、身份、凭据或原始响应，也不构成制品、CI、发布或 Windows 真机浏览器登录证据。
 
 `0.1.11` 沿用已发布版本的图片边界：只为精确 `grok-4.6` 提供有界图片输入；`grok-4.5` 与所有其他模型保持 text-only。普通 user/system 历史中的私有 reasoning 会被省略并保留相邻可见 text/image；只有有效的同 Provider assistant 历史可进入加密 reasoning replay，一层 tool-result 仍只接受公开 text/image。图片只能来自 Harness attachment service 的已验证 JPEG/PNG 投影，以 `detail:"high"` 发送，并受单图字节、像素、边长、数量、总字节与最终 JSON 上限约束；URL、路径、file ID 和调用方预制 data URL 都会被拒绝。
 
@@ -42,8 +42,8 @@
 
 ---
 
-Candidate security note: `1.0.0` is not yet a supported or published release and has no exact-artifact authorization. Its Search-response repair accepts only complete Search-backed strictly empty reasoning reuse (empty visible summary/content and no summary/raw lifecycle, with bounded opaque `encrypted_content` allowed) and exact bounded completed `open_page` type/URL pairs whose streamed and final values agree. Every reuse requires its own `response.output_item.done`; an open/incomplete reused lifecycle, non-empty or cross-type reuse, unknown terminal fields, and accessor-backed Search items or response containers fail closed. A later max-token response remains valid after every reused lifecycle has closed. Final-source redacted probes retained only counts and terminal status, never results, URLs, prompts, identity, or credentials. Code PR #28 and main CI run `33308371009` complete the dual-platform code gate; release-evidence final CI, artifact freezing, publication, and Registry integrity/provenance readback remain pending.
+Release security note: `1.0.0` accepts only complete Search-backed strictly empty reasoning reuse (empty visible summary/content and no summary/raw lifecycle, with bounded opaque `encrypted_content` allowed) and exact bounded completed `open_page` type/URL pairs whose streamed and final values agree. Every reuse requires its own `response.output_item.done`; an open/incomplete reused lifecycle, non-empty or cross-type reuse, unknown terminal fields, and accessor-backed Search items or response containers fail closed. A later max-token response remains valid after every reused lifecycle has closed. Redacted probes retained no results, URLs, prompts, identity, or credentials. Release commit `c6548199582b122f1d285422eabea0205eaf602f`, final CI run `33308603394`, the unique artifact, explicit authorization, Trusted Publisher run `33309083806` attempt 1, Registry integrity, signatures, attestations, and provenance are verified.
 
-The current source candidate is `1.0.0`; npm Registry `latest` remain `0.1.11` until publication and readback complete.
+The current stable release and npm Registry `latest` are both `1.0.0`; the source manifest and lockfile now describe an unpublished `1.0.1` candidate. When server Search is enabled, the candidate fully validates every Harness function before omitting only callable definitions whose names exactly collide with enabled `web_search` / `x_search` server descriptors. Historical calls/results remain, local functions remain when the matching switch is off, and request/decoder receipts reject every function/server-tool intersection. SSE source transport errors retain their existing auth, rate-limit, abort, and `PROVIDER_ERROR` mappings; only framing, JSON, and protocol failures become `INVALID_RESPONSE`, and failures are never silently retried without Search. One authorized redacted replay of the original failing session structure completed without retaining text, URLs, identity, credentials, or raw responses. This is not artifact, CI, publication, or real-device Windows login evidence.
 
-English summary: GitHub Private vulnerability reporting is enabled and preferred. The current stable release and npm Registry `latest` are both `0.1.11`; version `0.1.8` was published and then withdrawn, and npm version numbers cannot be reused. `0.1.11` repairs the High Effort + Web Search empty reasoning-ID reuse compatibility gap and adds a mutually exclusive official raw `reasoning_text` lifecycle. Annotated tag object `353bcd3717d4440ab20a2b05a5e9d51eef22fa7f` peels to release commit `2e5c6dbc8bb83377a4db4d8e31452b3ce96500c5`; final dual-platform CI run `33303080849` and Trusted Publisher run `33303631312` bind the explicitly authorized artifact. The unique tarball contains 71 files, is 207,022 bytes packed and 656,139 bytes unpacked, has SHA-256 `8fca0eca86769ee9febd35606cc8c944a0ae968cec2937a30ccaf68d36d42b2d` and SRI `sha512-2qInRIq5Dkf7CqXq8z1mVvMelStg3nZ1wuWEqsExgfm7iXF0Jn5f7d11IAtHRxdKdJm/j0s8tYT1Dx6IdtGNqg==`, and is byte-identical across local, GitHub Release, and Registry copies. The exact Registry install passed Host/client smoke; `npm audit signatures` confirmed verified Registry signatures for 9 packages and verified attestations for 3 packages, while public metadata for this package exposes 1 Registry signature and 2 attestations. Provenance exactly binds `release.yml`, `v0.1.11`, the release commit, and publish run. Replay metadata does not retain raw plaintext; later requests carry only `encrypted_content` plus `summary: []`, while live raw deltas remain visible to Harness. A redacted real probe produced one POST, 68 events, 34 summary deltas, zero raw deltas, and one finish, so it verifies only the summary/Search path; raw reasoning remains fixture-verified. Authentication, settings, image input, citations, endpoints, and platform support are unchanged. Network-reachable external-browser launch remains unverified on a real Windows device. Search results and citations remain untrusted remote data. Never send credentials, identity data, prompts, tool arguments, cookies, image bytes, Search contents, or unreviewed diagnostics.
+English summary: GitHub Private vulnerability reporting is enabled and preferred. The current stable release and npm Registry `latest` are both `1.0.0`; version `0.1.8` was published and then withdrawn, and npm version numbers cannot be reused. Release commit `c6548199582b122f1d285422eabea0205eaf602f`, annotated tag object `192561cda1ac58cbc4077f0de8fa614dff9a5557`, final dual-platform CI run `33308603394`, and Trusted Publisher run `33309083806` attempt 1 bind the explicitly authorized unique 72-file artifact. The tarball is 226,704 bytes packed and 715,014 bytes unpacked, with SHA-1 `50e5d898dba241d1e19def7705db216e3060b892`, SHA-256 `30cd83dad77f7d2611126b3c4737c8fabffeae79f385fa623e61dcecfe39f5e2`, and SRI `sha512-WL2f6Kfg5yT5nNf1p4//mLSajCnZttL/pDR3BISrFgSGtZd9DEJlnibq08ETz503n1wHIdCBcU/ICMPG9K4vOw==`. Frozen-candidate, GitHub Release, and Registry copies are byte-identical; the isolated Node 24 Host/client smoke and `npm audit signatures` passed. Public metadata exposes 1 Registry signature and 2 attestations, and provenance exactly binds `release.yml`, `v1.0.0`, the release commit, and publish run. The release accepts only complete Search-backed strictly empty reasoning reuse and exact bounded completed `open_page` pairs, discards validated URLs without visiting them, and retains the fixed-origin, credential, settings, model, image, and platform boundaries. Network-reachable external-browser launch remains unverified on a physical Windows device. Search results and citations remain untrusted remote data. Never send credentials, identity data, prompts, tool arguments, cookies, image bytes, Search contents, or unreviewed diagnostics.

package/dist/internal/responses-codec.mjs

@@ -439,6 +439,7 @@ function captureResponseReceipt(receipt) {
     if (
       !SERVER_TOOL_NAMES.has(name) ||
       serverTools.has(name) ||
+      functionNames.has(name) ||
       (name === "web_search" && sawXSearch)
     ) fail()
     serverTools.add(name)

package/dist/internal/responses-request-compiler.mjs

@@ -289,6 +289,7 @@ function deriveReceipt(request) {
       if (
         Reflect.ownKeys(tool).length !== 1 ||
         serverTools.includes(type) ||
+        functionNames.includes(type) ||
         (type === "web_search" && sawXSearch)
       ) throw new UnsupportedResponsesRequestError()
       sawServerTool = true

package/dist/internal/responses-request.mjs

@@ -409,11 +409,13 @@ function captureServerTools(serverTools) {
 
 function encodeWireTools(functionTools, serverTools) {
   const encodedFunctions = functionTools === undefined ? undefined : encodeTools(functionTools)
-  const functionCount = encodedFunctions?.length ?? 0
+  const enabledServerTools = new Set(serverTools)
+  const callableFunctions = encodedFunctions?.filter((tool) => !enabledServerTools.has(tool.name))
+  const functionCount = callableFunctions?.length ?? 0
   if (functionCount + serverTools.length > MAX_TOOLS) fail()
   if (encodedFunctions === undefined && serverTools.length === 0) return undefined
 
-  const encoded = encodedFunctions === undefined ? [] : encodedFunctions
+  const encoded = callableFunctions === undefined ? [] : callableFunctions
   for (let index = 0; index < serverTools.length; index += 1) {
     const kind = serverTools[index]
     if (kind === "web_search") encoded.push({ type: "web_search" })

package/dist/internal/responses-sse.mjs

@@ -9,6 +9,12 @@ export class InvalidResponsesSseError extends Error {
   }
 }
 
+class ResponsesSseSourceError {
+  constructor(sourceError) {
+    this.sourceError = sourceError
+  }
+}
+
 export async function* parseResponsesSse(source) {
   if (source === null || source === undefined || typeof source[Symbol.asyncIterator] !== "function") {
     throw new TypeError("Responses SSE source must be an async iterable")
@@ -78,7 +84,7 @@ export async function* parseResponsesSse(source) {
   }
 
   try {
-    for await (const chunk of source) {
+    for await (const chunk of preserveSourceErrors(source)) {
       if (!(chunk instanceof Uint8Array)) fail()
       totalBytes += chunk.byteLength
       if (totalBytes > MAX_STREAM_BYTES) fail()
@@ -102,6 +108,7 @@ export async function* parseResponsesSse(source) {
       if (value !== undefined) yield value
     }
   } catch (error) {
+    if (error instanceof ResponsesSseSourceError) throw error.sourceError
     if (error instanceof InvalidResponsesSseError || error instanceof TypeError) throw error
     if (error?.name === "AbortError") throw error
     throw new InvalidResponsesSseError()
@@ -112,6 +119,14 @@ export async function* parseResponsesSse(source) {
   }
 }
 
+async function* preserveSourceErrors(source) {
+  try {
+    for await (const chunk of source) yield chunk
+  } catch (error) {
+    throw new ResponsesSseSourceError(error)
+  }
+}
+
 function fail() {
   throw new InvalidResponsesSseError()
 }

package/docs/01-product-requirements.md

@@ -21,7 +21,7 @@
 - Web 设置页能区分官方 CLI 缺失、无效、检测不可用、OIDC discovery 网络超时与真人授权超时，并显示 Provider/已验证 CLI 版本；这些诊断不得暴露路径、stderr、代理配置或 OAuth URL。
 - 首版只接受与发布绑定 CLI 版本的 xAI 第一方 OIDC schema 相符的候选。CLI 有效配置若选择外部 auth provider、企业 OIDC、API key 或无法判定的凭据结构，插件必须显示“不受支持的认证配置”并拒绝由本插件把该 token 发给 xAI CLI Chat Proxy；这不把未签名 metadata 宣称成来源证明。
 - 支持多轮文本对话、reasoning 增量、流式文本、工具调用、usage 和明确 finish 原因。
-- `0.1.9` 引入精确 `grok-4.6` 的 Web/X Search 协议与页面，`0.1.10` 补齐可写 Host settings 集成，`0.1.11` 首次兼容 High Effort + Web Search 的 reasoning 续跑；`1.0.0` 候选继续兼容已实测的 completed `open_page` 与同一 Search-backed reasoning ID 的多段严格空占位：两个开关仍独立、默认关闭，后台/派生 purpose 不启用 Search，远端 server-tool lifecycle 不得投影为 Harness 本地工具。
+- `0.1.9` 引入精确 `grok-4.6` 的 Web/X Search 协议与页面，`0.1.10` 补齐可写 Host settings 集成，`0.1.11` 首次兼容 High Effort + Web Search 的 reasoning 续跑；已发布 `1.0.0` 继续兼容实测的 completed `open_page` 与同一 Search-backed reasoning ID 的多段严格空占位：两个开关仍独立、默认关闭，后台/派生 purpose 不启用 Search，远端 server-tool lifecycle 不得投影为 Harness 本地工具。
 - Harness 中止请求时，网络流和解析器都能及时终止。
 - 热更新设置或重新认证不会让同一调用混用两组路由或凭据。
 - 凭据不进入 renderer、RPC、settings、workspace、本插件日志、错误详情、诊断包或 npm tarball；官方 CLI 自身的日志、网络与遥测属于独立 vendor boundary。
@@ -71,7 +71,7 @@
 - Grok ACP 或 `grok -p` headless 代理。
 - 厂商侧 Web Search、X Search、远程抓取。
 - 图片生成、图片 URL 下载或文件落盘。
-- 图片输入（`0.1.0`–`0.1.3`）；已发布 `0.1.4` 按[能力路线图](./11-capability-roadmap.md)与 [ADR-0008](./adr/0008-image-input-request-compiler.md)只为精确 `grok-4.6` 独立引入，`grok-4.5` 与所有其他模型继续 text-only；维护版 `0.1.5`–`0.1.7`、发布后撤回的 sidebar quota `0.1.8`、已发布 `0.1.9`–`0.1.11` 与 `1.0.0` 候选均不扩大该图片集合。
+- 图片输入（`0.1.0`–`0.1.3`）；已发布 `0.1.4` 按[能力路线图](./11-capability-roadmap.md)与 [ADR-0008](./adr/0008-image-input-request-compiler.md)只为精确 `grok-4.6` 独立引入，`grok-4.5` 与所有其他模型继续 text-only；维护版 `0.1.5`–`0.1.7`、发布后撤回的 sidebar quota `0.1.8` 与已发布 `0.1.9`–`1.0.0` 均不扩大该图片集合。
 - 自定义 endpoint、企业 OIDC、自定义代理或多账号。
 - 自动安装或更新 Grok CLI。
 - 在远程 Web/headless 主机自动打开浏览器或无人值守登录的承诺。
@@ -120,8 +120,9 @@ Web 的“退出”或 TUI `/grok logout` 先中止本插件所有在途 Grok
 - `0.1.10` 的真实 SettingsProvider 与隔离 Web Harness 验收已证明唯一可写 `llm-grok` namespace、两个开关默认关闭且可操作；设置更新只影响首次 await 之后尚未开始的新调用，已准备或在途调用保持原快照。
 - `0.1.11` 已验证只在一个已完成 server Search 位于两段 reasoning 之间时允许已关闭 reasoning ID 一次性复用为严格空项；raw `reasoning_text` 与 summary lifecycle 互斥，replay 元数据不保存 raw 明文，后续请求只发送 encrypted content 与空 summary，当前流中的 raw delta 仍作为 Harness 可见 reasoning 输出。脱敏真实 probe 只观察到 summary/Search（34 个 summary delta、0 个 raw delta），因此 raw reasoning 仍只有协议 fixture 证据。
 - `0.1.11` 已从 release commit `2e5c6dbc8bb83377a4db4d8e31452b3ce96500c5` 正式发布：final CI run `33303080849` 的 macOS 14 / Windows 2022 全绿；Trusted Publisher run `33303631312` 发布唯一 71 文件、207,022-byte packed / 656,139-byte unpacked 制品。SHA-256 为 `8fca0eca86769ee9febd35606cc8c944a0ae968cec2937a30ccaf68d36d42b2d`，SRI 为 `sha512-2qInRIq5Dkf7CqXq8z1mVvMelStg3nZ1wuWEqsExgfm7iXF0Jn5f7d11IAtHRxdKdJm/j0s8tYT1Dx6IdtGNqg==`；npm `latest=0.1.11`，Registry、Release 与本地制品逐字节一致。本包 1 个 Registry signature、2 个 package attestations 与精确绑定 `release.yml` / `v0.1.11` / release commit / 发布 run 的 SLSA provenance 均已验证。该供应链证据不构成网络可达 Windows 真机浏览器弹出验收。
-- `1.0.0` 候选必须新增失败关闭回归：completed Web `open_page` 只接受 own-data 精确 `{type:"open_page",url}`，其中 URL 为非空且不超过 16 KiB UTF-8；streamed `output_item.done` 与 final `response.output` 必须逐项绑定 action type 和 URL。验证后仅丢弃该动作，不 fetch、不生成 Harness tool chunk、不进入 replay；未知键、accessor、空/超限/非字符串 URL、非 completed `open_page` 或前后不一致均返回 `INVALID_RESPONSE`。
-- `1.0.0` 候选还必须证明：reasoning ID 的首次复用仍要求旧段已 `output_item.done` 且两段之间存在 completed Web/X Search；一旦该 ID 被 Search-backed 证明，后续只允许相同 ID/type 逐段以严格空 visible summary/content、无 summary/raw lifecycle 的完整 `added → output_item.done` 占位继续出现。terminal 只接受既定 own-data 字段，可选 encrypted content 仅作为有界 opaque 字符串处理；未知键、accessor、任一非空可见内容，以及 `response.incomplete` 发生时仍未 `output_item.done` 的复用段全部失败关闭；所有复用段已闭合后的 max-token 终态仍按既有契约接受。
+- `1.0.0` 已新增失败关闭回归：completed Web `open_page` 只接受 own-data 精确 `{type:"open_page",url}`，其中 URL 为非空且不超过 16 KiB UTF-8；streamed `output_item.done` 与 final `response.output` 必须逐项绑定 action type 和 URL。验证后仅丢弃该动作，不 fetch、不生成 Harness tool chunk、不进入 replay；未知键、accessor、空/超限/非字符串 URL、非 completed `open_page` 或前后不一致均返回 `INVALID_RESPONSE`。
+- `1.0.0` 已证明：reasoning ID 的首次复用仍要求旧段已 `output_item.done` 且两段之间存在 completed Web/X Search；一旦该 ID 被 Search-backed 证明，后续只允许相同 ID/type 逐段以严格空 visible summary/content、无 summary/raw lifecycle 的完整 `added → output_item.done` 占位继续出现。terminal 只接受既定 own-data 字段，可选 encrypted content 仅作为有界 opaque 字符串处理；未知键、accessor、任一非空可见内容，以及 `response.incomplete` 发生时仍未 `output_item.done` 的复用段全部失败关闭；所有复用段已闭合后的 max-token 终态仍按既有契约接受。
+- `1.0.0` 最终 release commit `c6548199582b122f1d285422eabea0205eaf602f` 的双平台 CI、唯一 72 文件制品、精确授权、Trusted Publisher run `33309083806` attempt 1、Registry 字节、签名、attestations 与 SLSA provenance 回读均已完成；npm `latest=1.0.0`。这些供应链证据不构成网络可达 Windows 真机浏览器弹出验收。
 
 ## 8. `0.1.0` 历史发布阻断项
 
@@ -149,7 +150,7 @@ Web 的“退出”或 TUI `/grok logout` 先中止本插件所有在途 Grok
 - `0.1.9`：已为精确 `grok-4.6` 发布默认关闭、设计为可独立开启的 Web Search / X Search 协议与页面，但遗漏 Host `llm-grok` namespace，真实页面开关不可用。
 - `0.1.10` 已发布：补齐 canonical settings namespace 与按调用动态快照，使 `0.1.9` 的两个开关真正可写。
 - `0.1.11` 已发布：修复 High Effort + Web Search reasoning 生命周期兼容并支持官方 raw reasoning 事件；不改变 Search descriptor、支持模型、认证或图片边界。
-- `1.0.0` 候选：接受 fixed Proxy 已实测的 completed `open_page` 精确动作，并把 Search-backed reasoning ID 从“一次复用”收窄调整为“可多段复用、每段必须严格空且闭合”；不执行 URL、不新增本地工具、不扩大模型、认证、图片或 origin 边界。
+- `1.0.0` 已发布：接受 fixed Proxy 已实测的 completed `open_page` 精确动作，并把 Search-backed reasoning ID 从“一次复用”收窄调整为“可多段复用、每段必须严格空且闭合”；不执行 URL、不新增本地工具、不扩大模型、认证、图片或 origin 边界。
 - 再后续独立切片：默认关闭的图片生成（内联结果 → Harness attachment）。
 
 `prompt_cache_key` 不与图片输入捆绑；若以后排期，需独立分析会话标识隐私和 POST 不自动重放边界。任意 URL 下载、API Key、企业 OIDC、ACP、Headless 和 Linux 仍不在路线内。公开协议可驱动隔离原型，但每个切片在声明能力、合并发布基线前必须有独立 ADR 与固定 CLI Chat Proxy spike；`0.1.4` 的 `grok-4.6` user/tool-result 红蓝语义门禁已于 2026-08-28 通过，`grok-4.5` 因语义不可靠失败关闭，最终 Harness attachment 复验见[上游证据页](./12-upstream-image-input-evidence.md)。

package/docs/03-security-threat-model.md

@@ -11,7 +11,7 @@
 
 `0.1.11` 已从 release commit `2e5c6dbc8bb83377a4db4d8e31452b3ce96500c5` 正式发布；final CI run `33303080849` 的 macOS 14 / Windows 2022 全绿。唯一 71 文件制品为 207,022 bytes packed、656,139 bytes unpacked，SHA-256 为 `8fca0eca86769ee9febd35606cc8c944a0ae968cec2937a30ccaf68d36d42b2d`，npm SRI 为 `sha512-2qInRIq5Dkf7CqXq8z1mVvMelStg3nZ1wuWEqsExgfm7iXF0Jn5f7d11IAtHRxdKdJm/j0s8tYT1Dx6IdtGNqg==`；Trusted Publisher run `33303631312` 完成，Registry、GitHub Release 与本地制品逐字节一致，npm `latest=0.1.11`。本包公开 metadata 中的 1 个 Registry signature 与 2 个 package attestations 已验证，SLSA provenance 精确绑定 `release.yml`、`v0.1.11`、上述 release commit 与该发布 run。sidebar quota `0.1.8` 曾发布后撤回且不能复用。`0.1.9` 发布精确 `grok-4.6` 的默认关闭 Web/X Search 协议与页面，`0.1.10` 补齐 Host `llm-grok` namespace 与按调用快照，`0.1.11` 修复 High Effort + Web Search 续跑的 Responses reasoning 生命周期并加入官方 raw reasoning 事件支持；它不改变推理 Bearer 的固定 origin、Search descriptor、支持模型、官方 CLI OAuth 所有权或系统网络/代理边界。供应链回读不构成网络可达 Windows 真机浏览器弹出验收。
 
-`1.0.0` 当前仍是未发布候选；npm 稳定版仍为 `0.1.11`。该候选只收窄扩展固定 Proxy 响应解码：接受 completed `open_page` 精确动作，并允许已由 completed Web/X Search 证明的 reasoning ID 继续出现多个逐段严格空且闭合的占位。它不打开或下载 URL，不生成 Harness 本地工具调用，不保存 Search/reasoning replay，也不改变固定 origin、凭据、设置、模型或图片能力边界。
+`1.0.0` 已正式发布，npm `latest=1.0.0`。最终 release commit `c6548199582b122f1d285422eabea0205eaf602f`、双平台 final CI、仓库所有者明确授权的唯一 72 文件制品、Trusted Publisher run `33309083806` attempt 1、Registry 字节、签名、attestations 与 SLSA provenance 回读均已关闭。该版本只收窄扩展固定 Proxy 响应解码：接受 completed `open_page` 精确动作，并允许已由 completed Web/X Search 证明的 reasoning ID 继续出现多个逐段严格空且闭合的占位。它不打开或下载 URL，不生成 Harness 本地工具调用，不保存 Search/reasoning replay，也不改变固定 origin、凭据、设置、模型或图片能力边界；供应链证据不构成网络可达 Windows 真机浏览器弹出验收。
 
 ## 2. 信任边界
 
@@ -244,7 +244,7 @@ TUI 通过 Harness 的 human-command registry 注册一个全局 `/grok`，只
 - 最终 JSON 超限继续逐张淘汰最旧图片；缺服务、projection unsupported、源图片位置/引用/MIME 不支持在 Responses POST 前以 `UNSUPPORTED_CONTENT` 拒绝。store 返回损坏或不自洽的投影、超过含图编译 block 预算、更深 tool-result，以及图片全部淘汰后剩余非图片请求仍不合法，都保持通用 `INVALID_RESPONSE`。
 - AbortSignal 在查询服务前检查并传给所有投影读取；编译失败时 Responses POST 调用必须为 0，但模型目录 GET 可能已发生。
 
-`0.1.9` 按 [ADR-0010](./adr/0010-default-off-web-x-search.md) 独立增加 Search 协议与页面；`0.1.10` 补齐真实 Host settings 集成；`0.1.11` 首次收窄兼容 Search 之后的 reasoning lifecycle；`1.0.0` 候选继续兼容实测的 `open_page` 与多段 Search-backed reasoning 占位，且不扩大图片或 origin 边界：
+`0.1.9` 按 [ADR-0010](./adr/0010-default-off-web-x-search.md) 独立增加 Search 协议与页面；`0.1.10` 补齐真实 Host settings 集成；`0.1.11` 首次收窄兼容 Search 之后的 reasoning lifecycle；已发布 `1.0.0` 继续兼容实测的 `open_page` 与多段 Search-backed reasoning 占位，且不扩大图片或 origin 边界：
 
 - Web Search 与 X Search 在唯一 `llm-grok` namespace 中默认关闭并独立持久化；无 settings service 时回退组合配置。每个调用在首次 await 前冻结一次 policy，热更新只影响后续调用；两项全关时不读取 `purpose`，最终 request wire 与 `0.1.7` 保持一致。
 - 只为固定 Proxy 已验证的精确 `grok-4.6` route 编译 `{type:"web_search"}` / `{type:"x_search"}`；不支持模型在 Responses POST 前返回 `UNSUPPORTED_CONTENT`。
@@ -252,7 +252,7 @@ TUI 通过 Harness 的 human-command registry 注册一个全局 `/grok`，只
 - Web 与 X 都是 xAI 已执行的 server tool，产生零个 Harness `tool-call` chunk；X 只接受四个实测 custom-tool 名称。未启用类别、未知、重复、乱序或未闭合生命周期全部失败关闭。
 - citation URL 不被打开、下载或重新请求；结构化 annotation/citations 只做有界验证后丢弃。观察到任何 Search 后不保存本响应的 encrypted reasoning replay。
 - Search 关闭不代表服务商内部绝不检索；开启后提示词与模型生成的检索词会到达 xAI，且结果可能错误、含提示注入并产生额外用量。
-- `1.0.0` 候选只在 completed Web `web_search_call` 中接受 own-data 精确 `{type:"open_page",url}`：URL 必须为非空且不超过 16 KiB UTF-8。streamed `output_item.done` 与 final `response.output` 必须绑定相同 action type 与逐字相同 URL；验证后动作被丢弃，不 fetch、不形成 Harness tool chunk、不进入 replay。非 completed 形状、未知键、accessor、错误类型、空值、超限或前后不一致均失败关闭。
+- `1.0.0` 只在 completed Web `web_search_call` 中接受 own-data 精确 `{type:"open_page",url}`：URL 必须为非空且不超过 16 KiB UTF-8。streamed `output_item.done` 与 final `response.output` 必须绑定相同 action type 与逐字相同 URL；验证后动作被丢弃，不 fetch、不形成 Harness tool chunk、不进入 replay。非 completed 形状、未知键、accessor、错误类型、空值、超限或前后不一致均失败关闭。
 - reasoning ID 的首次复用仍要求旧段已闭合、completed Web/X Search 位于新旧 output index 之间且新段严格为空。Search-backed 证明建立后，同一 ID 只可继续作为相同 reasoning type 的逐段严格空占位；每段必须无 summary/raw lifecycle、visible `summary`/`content` 为空并收到 `output_item.done`。terminal 仅允许既定 own-data 字段；可选 `encrypted_content` 只作为有界 opaque 字符串校验，不解密、不记录。跨类型、非空、未闭合、未知键、accessor，以及 `response.incomplete` 仍有未闭合复用段时均失败关闭；复用段全部闭合后允许后续 max-token 终态。raw `reasoning_text` 与 summary lifecycle 仍互斥；观察到 Search 后仍不保存任何 reasoning replay。
 
 公开 xAI 文档、离线测试与真机验证继续作为三类独立证据。[图片证据页](./12-upstream-image-input-evidence.md)记录的固定 Proxy 门禁已对 `grok-4.6` 的普通 user 与一层 tool-result 分别发送红/蓝合成图：4 次均为 HTTP 200、`text/event-stream`、completed，规范化整段回复只含正确颜色词和可选句末标点。`grok-4.5` 的受控红图语义不可靠，因此即使公开模型页声明图片能力也不进入本插件图片集合。图片固定使用 `detail:"high"`。Harness `0.1.1-rc.2` attachment-local/LlmRuntime 已复验 `grok-4.6` image、`grok-4.5`/未知模型 text-only，候选门禁随后关闭并完成 `0.1.4` 发布。已发布 `0.1.6` 只允许普通 user/system 历史省略通过闭合字符串/长度校验的私有 reasoning 并保留相邻可见 text/image。sidebar quota `0.1.8` 发布后已撤回，Search 的四组固定 Proxy 观察归属已发布 `0.1.9`，`0.1.10` 修复真实设置入口。`0.1.11` 的脱敏真实 probe 经生产 decoder 完成 1 次 POST、68 个事件、34 个 summary delta、0 个 raw delta与 1 个 finish，只验证 summary/Search 路径；raw reasoning 仍只有协议 fixture 证据。`1.0.0` 的补充真实观察只保存事件类别、计数、闭合结果和错误位置，不保存 URL、检索/回复内容、prompt 或任何凭据。隔离验收与制品回读不覆盖浏览器手工对话、Agent/session loop、OAuth、完整真实账号会话或 Windows 真机。任意 URL 下载与把 Authorization 带到第二个 origin 在所有版本仍永久禁止。

package/docs/05-test-plan.md

@@ -145,9 +145,13 @@
 - Search 两项全关时不读取 `purpose`，request wire 与 `0.1.7` 一致；任一开关启用时，非空后台 purpose 关闭 Search，空字符串、错误类型或 accessor 在 POST 前失败。
 - 真实 `SettingsProvider` + `LlmRuntime` 必须描述唯一 `llm-grok` namespace，默认值为两项关闭且 `applies:"live"`；用户层更新进入后续请求，插件卸载清理 namespace，无 settings service 时回退组合配置。
 - Adapter 必须在每个调用开始且首次模型目录 await 前冻结 Search policy；用延迟目录证明等待期间的设置更新不改变该 prepared call，而下一调用读取新值。
-- 只有精确 `grok-4.6` route 可接收 Search descriptor；`grok-4.5`、未知模型、缺 capability 或 capability 顺序/值异常均在 POST 前失败。Harness functions → Web → X 的顺序、128 项共享上限和 16 MiB JSON 上限必须锁定。
-- Web lifecycle、四项 X custom-tool 名称、Web+X 交错与 Web+function 混合都必须闭合；未启用类别、未知 name/event/annotation、重复 output index、乱序、截断或未闭合状态失败关闭。结构化 citation 有界校验后丢弃，任一 Search 出现后 encrypted reasoning replay 为空。`0.1.11` 历史回归继续锁定首次 Search-backed reasoning ID 复用与 raw `reasoning_text` / summary lifecycle 互斥；`1.0.0` 候选再锁定同一 ID 的后续多段复用：首次仍要求旧段已 `output_item.done` 且两段间有 completed Web/X Search，后续只允许相同 ID/type 的严格空 visible summary/content、无 summary/raw lifecycle、逐段 `output_item.done` 占位。可选 `encrypted_content` 只接受有界 opaque 字符串；terminal 未知键、accessor、非空内容、未闭合段，以及 `response.incomplete` 仍有 open 复用段时全部失败关闭；另以正例锁定闭合复用段后的 max-token 终态。
+- 只有精确 `grok-4.6` route 可接收 Search descriptor；`grok-4.5`、未知模型、缺 capability 或 capability 顺序/值异常均在 POST 前失败。过滤后的 Harness functions → Web → X 顺序、128 项共享上限和 16 MiB JSON 上限必须锁定。
+- `1.0.1` 同名冲突回归必须证明：全部源 functions 先完成 schema、own-data、名称、单项和共享资源验证，不能用随后过滤隐藏非法输入；只过滤与本次已启用 server Search 精确同名的 wire definition；对应开关关闭时本地 `web_search` / `x_search` 保留；非 reserved function 不受影响。
+- 保留历史 function call/result：即使本次过滤同名 definition，先前消息中的 `web_search` / `x_search` `function_call` 与按 `call_id` 关联的 output 仍保持顺序、名称和关联；不得删除、改名或投影成 server-tool lifecycle。request 反向 receipt 与 codec 外部 receipt 都必须拒绝 function/server-tool 名称交集。
+- Web lifecycle、四项 X custom-tool 名称、Web+X 交错与 Web+function 混合都必须闭合；未启用类别、未知 name/event/annotation、重复 output index、乱序、截断或未闭合状态失败关闭。结构化 citation 有界校验后丢弃，任一 Search 出现后 encrypted reasoning replay 为空。`0.1.11` 历史回归继续锁定首次 Search-backed reasoning ID 复用与 raw `reasoning_text` / summary lifecycle 互斥；`1.0.0` 发布回归锁定同一 ID 的后续多段复用：首次仍要求旧段已 `output_item.done` 且两段间有 completed Web/X Search，后续只允许相同 ID/type 的严格空 visible summary/content、无 summary/raw lifecycle、逐段 `output_item.done` 占位。可选 `encrypted_content` 只接受有界 opaque 字符串；terminal 未知键、accessor、非空内容、未闭合段，以及 `response.incomplete` 仍有 open 复用段时全部失败关闭；另以正例锁定闭合复用段后的 max-token 终态。
 - `1.0.0` 的 completed Web `open_page` 正例必须精确覆盖 `{type:"open_page",url}`，其中 URL 非空且 UTF-8 不超过 16 KiB；streamed `output_item.done` 与 final `response.output` 的 action type/URL 必须逐项一致，并断言结果被丢弃、Harness tool chunks 为 0、fetch 为 0、replay 为 0。额外键、accessor（且 getter 不应被调用）、空/非字符串/超限 URL、unknown action、非 completed `open_page`、stream/final 不一致全部为 `INVALID_RESPONSE`。
+- SSE source-error 回归必须用抛出同一 sentinel/transport error 的 async iterable 证明异常对象逐字保持；framing、UTF-8、JSON、event/schema、截断和超限仍归一为 `INVALID_RESPONSE`。Adapter 集成需锁定 fixed-Proxy HTTP 400 → `PROVIDER_ERROR`，并确认认证、429、中止映射不回退。
+- `1.0.1` 的脱敏真实账号门禁只允许记录结构与计数：原失败 X 会话应为 8 messages、40 source functions、38 wire functions + 2 server tools、2 historical reserved calls、1 models GET、1 Responses POST、314 events、`response.completed`；禁止保存正文、URL、身份、凭据或原始响应。该门禁不替代 fixture、全量测试、CI 或制品验收。
 
 ### Web RPC 与 TUI
 
@@ -254,4 +258,6 @@ Web 与 TUI 分别验证：
 
 `0.1.11` 的发布验收已关闭：release commit `2e5c6dbc8bb83377a4db4d8e31452b3ce96500c5` 的 final CI run `33303080849` 在 macOS 14 / Windows 2022 全绿，Trusted Publisher run `33303631312` 发布唯一 71 文件、207,022-byte packed / 656,139-byte unpacked 制品。SHA-256 为 `8fca0eca86769ee9febd35606cc8c944a0ae968cec2937a30ccaf68d36d42b2d`，SRI 为 `sha512-2qInRIq5Dkf7CqXq8z1mVvMelStg3nZ1wuWEqsExgfm7iXF0Jn5f7d11IAtHRxdKdJm/j0s8tYT1Dx6IdtGNqg==`；npm `latest=0.1.11`，Registry、Release 与本地制品逐字节一致。1 个 Registry signature、2 个 package attestations 与精确绑定 `release.yml` / `v0.1.11` / release commit / 发布 run 的 SLSA provenance 已验证。脱敏真实 probe 只验证 1 POST、68 events、34 summary deltas、0 raw deltas、decoder accepted 与 1 finish 的 summary/Search 路径；raw reasoning 仍只有协议 fixture 证据。
 
-`1.0.0` 仍为候选，不能把上述 `0.1.11` 供应链证据复用为其发布证据。新增 open-page/reasoning 聚焦回归 40/40、完整 Node 24 suite（245 项、243 pass、0 fail、2 项平台跳过）、生产依赖审计与 72 项干净 dry-run pack 已通过；代码 PR #28 已合入 `yukiryou/main@7a6364dd58f3c7e9e1ad68a3d0197a14254bcb8c`，main CI run `33308371009` 的 macOS/Windows 均全绿。发布证据 final CI、最终提交与唯一制品仍需关闭。脱敏真实 Web/X 探针只记录事件类别、计数、闭合结果与错误位置，不保存 URL、检索/回复内容、prompt 或凭据。冻结精确 tarball 后仍需单独取得该制品的发布授权，再验证 Registry、GitHub Release、签名与 provenance 逐字节绑定。
+`1.0.0` 的发布验收也已独立关闭，没有复用 `0.1.11` 供应链证据。新增 open-page/reasoning 聚焦回归 40/40、完整 Node 24 suite（245 项、243 pass、0 fail、2 项平台跳过）、生产依赖审计与 72 项干净 dry-run pack 均通过；最终 release commit `c6548199582b122f1d285422eabea0205eaf602f` 的 final CI run `33308603394` 双平台全绿。Trusted Publisher run `33309083806` attempt 1 发布仓库所有者明确授权的唯一 72 文件制品；冻结候选、GitHub Release 与 npm Registry tarball 逐字节一致，npm `latest=1.0.0`，隔离安装、Registry signature、2 个 attestations 与精确 SLSA provenance 绑定均已验证。脱敏真实 Web/X 探针只记录事件类别、计数、闭合结果与错误位置，不保存 URL、检索/回复内容、prompt 或凭据；这些证据仍不替代 OAuth 或网络可达 Windows 真机浏览器弹出验收。
+
+`1.0.1` 当前只是源码候选。上述同名冲突、receipt、SSE 错误归因、一次脱敏真实结构回放、精确 Node `24.19.0` 本地全量测试（253 tests、251 pass、0 fail、2 platform skips）、生产依赖审计（0 漏洞）、确定性 build、隔离 cache 的 73 文件 dry-run pack 与秘密模式扫描已完成；扫描只命中显式 fixture canary 及其检查表记录。代码 PR #31 的 push/PR CI、merge commit `0c60200e12c3b8455331f31a317ece9b1945c458` 及 main CI run `33312621786` 也已在 macOS 14 / Windows 2022 全绿。进入发布授权前仍必须形成固定 final release commit，完成其双平台 CI、候选 tarball 冻结与 Node 24 隔离安装。随后向仓库所有者展示固定 commit、文件数/大小、SHA-1/SHA-256/SRI 和测试证据，并另行取得对该精确制品的发布授权；GitHub Release、Trusted Publisher、Registry 字节回读、signature、attestations 与 provenance 均须在发布后独立关闭。Windows 真机浏览器登录仍是单独边界，不得从该修复或 CI 推断。