# dsh-grok-provider v1.0.3

`1.0.3` 修复真实使用中偶发的认证拒绝与长时间流中断，同时坚持“已开始的请求绝不自动重放”。

## 主要变化

- 请求在任何响应内容到达前返回 401/403 时，由官方 Grok CLI 有界刷新共享会话、重新读取校验凭据，并且最多重试一次；持续拒绝仍明确失败。
- 同一凭据版本触发的并发拒绝共享一次刷新，避免多个 CLI 进程争用同一会话文件。
- 流开始后发生 transport failure 或干净的过早 EOF 时不重放。若只有安全的文本/reasoning，保留已收到内容并提示发送“继续”。
- 连续两分钟没有收到任何响应字节时主动结束等待；每个新字节 chunk 都会刷新空闲计时，因此持续有输出的长任务不会被总时长截断。
- 若已经观察到工具调用、未知 chunk、畸形协议或用户取消，继续失败关闭，避免重复工具副作用或掩盖真实协议缺陷。
- 修复不新增 API Key 模式，不读取 refresh token，也不改变固定 endpoint、模型、图片、Search、citation/URL 或 Harness 权限边界。

## 安装

```sh
dsh plugin --profile web add dsh-grok-provider@1.0.3
dsh web
```

安装后重启正在运行的 DeepSeek Harness / DeepSeek YukiRyou，再用 `grok-4.6` 完成普通对话和一次开启 Search 的多步任务。网络中断后的部分内容应保留并出现“发送继续”提示；这条路径不会自动再次执行工具。

## 验证

- 精确 Node `24.19.0` 全量测试：274 tests，272 pass，0 fail，2 platform skips。
- 聚焦回归覆盖一次性 401/403 恢复、持续拒绝、并发 single-flight、流开始后禁止重试、安全部分输出保留、干净 EOF 与部分工具调用失败关闭。
- 当前已登录账号完成一次脱敏 `grok-4.6` Low Effort 生产 Adapter 请求：2 block-start、14 reasoning-delta、2 block-end、1 text-delta、1 usage、1 finish。未保留回复正文、URL、身份、凭据或原始事件；该成功路径不能模拟未来的 401 或断流。
- 代码 PR [#37](https://github.com/yoshino-xiao7/dsh-grok-provider/pull/37) 已合并为 `9958f487abf8ebd062eecb4368689e4d049b1d35`；main CI run [`33377849906`](https://github.com/yoshino-xiao7/dsh-grok-provider/actions/runs/33377849906) 的 macOS 14 / Windows 2022 均通过。
- 精确 `dsh-grok-provider@1.0.3` 已发布并完成回读：final release commit `07ebd35c56348a1b3296bd46d1a69f5b0f430241`、annotated tag object `7ec8a8a1086749e7ac1dfb0ef2bd50c821838363`、final CI run `33378215345` 与 Trusted Publisher run `33379149158` attempt 1。唯一 77 文件制品为 267,403 bytes packed / 829,862 bytes unpacked，SHA-1 `6197c3d30ec1ef5f559371911d612f6236eee2f9`、SHA-256 `7f740c7258ab7eee0c96e1ddae3398b41a25e718cf267e244f8693c3c99aeb0d`、SRI `sha512-kJgN0NKKV7Te3oAgbPnEua/EQCLnj5S0KWAWrhP0ixudJBepplRFARYHCxwxOwbG87bnX07Mz/dxCoBiphWhqQ==`；本地、Release、Registry 三方字节一致，npm `latest=1.0.3`。锁定安装、0 漏洞审计、1 个 Registry signature、2 个 attestations、安装图 11 个 signed / 2 个 attested packages 和精确 provenance 均已验证；这些证据不替代真实网络故障或 Windows 外部浏览器验收。

<details>
<summary>English</summary>

Version `1.0.3` addresses intermittent authentication rejection and long-running stream interruption while preserving the rule that a started request is never replayed automatically.

## Highlights

- A 401/403 received before any response content triggers one bounded refresh through the official Grok CLI, validated credential reload, and at most one retry. Persistent rejection still fails explicitly.
- Concurrent rejections from the same credential revision share a single refresh.
- A transport failure or clean premature EOF after streaming starts is never replayed. Safe text/reasoning already received is preserved with a notice asking the user to send “continue.”
- Two continuous minutes without any response bytes ends the wait. Each new byte chunk refreshes the idle timer, so an actively streaming long task is not cut off by total duration.
- Any observed tool call, unknown chunk, malformed protocol, or user abort continues to fail closed, preventing duplicate tool side effects or hidden protocol defects.
- No API-key mode is added, refresh tokens remain unread, and fixed endpoints, models, images, Search, citation/URL handling, and Harness permissions are unchanged.

## Install

```sh
dsh plugin --profile web add dsh-grok-provider@1.0.3
dsh web
```

Restart any running DeepSeek Harness / DeepSeek YukiRyou process, then complete a normal `grok-4.6` conversation and a multi-step task with Search enabled. A safe partial response interrupted by the network should remain visible with a “continue” notice, and tools must not be executed again automatically.

## Verification

- Exact Node `24.19.0` full suite: 274 tests, 272 pass, 0 fail, and 2 platform skips.
- Focused regressions cover one-shot 401/403 recovery, persistent rejection, concurrent single-flight refresh, no retry after streaming starts, safe partial preservation, clean EOF, and partial tool-call rejection.
- One redacted real-account `grok-4.6` Low Effort request completed through the production adapter with 2 block starts, 14 reasoning deltas, 2 block ends, 1 text delta, 1 usage chunk, and 1 finish. No response text, URL, identity, credential, or raw event was retained; this success path does not simulate a future 401 or disconnect.
- Code PR [#37](https://github.com/yoshino-xiao7/dsh-grok-provider/pull/37) merged as `9958f487abf8ebd062eecb4368689e4d049b1d35`; main CI run [`33377849906`](https://github.com/yoshino-xiao7/dsh-grok-provider/actions/runs/33377849906) passed on macOS 14 and Windows 2022.
- Exact `dsh-grok-provider@1.0.3` is published with completed readback. Release commit `07ebd35c56348a1b3296bd46d1a69f5b0f430241`, annotated tag object `7ec8a8a1086749e7ac1dfb0ef2bd50c821838363`, final CI run `33378215345`, and Trusted Publisher run `33379149158` attempt 1 are verified. The unique 77-file artifact is 267,403 bytes packed and 829,862 bytes unpacked, with SHA-1 `6197c3d30ec1ef5f559371911d612f6236eee2f9`, SHA-256 `7f740c7258ab7eee0c96e1ddae3398b41a25e718cf267e244f8693c3c99aeb0d`, and the SRI listed above. Local, Release, and Registry bytes match and npm reports `latest=1.0.3`. Locked installation, zero-vulnerability audit, 1 Registry signature, 2 attestations, an installed graph of 11 signed / 2 attested packages, and exact provenance all verify. These checks do not substitute for a real network fault or physical Windows browser-launch acceptance.

</details>