hellogrok ทุกเวอร์ชันและเวอร์ชันเก่า

Added
- Self-healing carrier for Chat tool calls whose name stays unresolved after shape inference. Parseable arguments are carried by run_terminal_command (command holds the raw text); corrupt non-JSON arguments are carried by read_file (target_file holds the raw text, (no arguments) when empty). The route is logged as unresolved-name-routed(name=…) with a valid JSON carrier payload, so the failure returns through a tool_result and the model regenerates the call. When neither carrier is declared on the request the call is left untouched.
Fixed
- Unnamed Chat tool calls that shape inference cannot name (for example an empty name plus arguments missing the opening { with trailing garbage) no longer reach Grok Build with an empty name and die as a silent terminal NotFound the model never sees fed back. The turn now recovers through the carrier path above instead of stalling.

Changed
- Managed inference_idle_timeout_secs lowered from 1800 to 900 seconds. The 30-minute ceiling traded too much failure-detection latency for stall tolerance; 15 minutes still covers twice DeepSeek's documented ten-minute queue and multiples of the observed three-minute relay stalls, and the downstream watchdog (deadline minus 30 seconds) already converts a true stall into a retryable proxy_stream_error, so the extra wait mostly delayed discovery.
- The managed idle timeout now applies to every proxied channel, including first-party api.deepseek.com routes. The resilience projection is no longer special-cased: an explicit value remains user-owned and wins on every channel alike, and the proxy's DeepSeek-specific 660-second upstream byte window is unaffected. The DeepSeek guard test now asserts the managed timeout is present instead of invented.

Added
- Managed inference_idle_timeout_secs for proxied channels: when a custom model does not configure Grok Build's per-chunk idle deadline, hellogrok temporarily materializes 1800 seconds (restored byte-for-byte on stop) so long relay stalls — queued generations that emit heartbeats but no content for many minutes — no longer hit the 600-second shell default. Explicit per-model or global [models] values remain user-owned and are never rewritten; first-party api.deepseek.com routes are excluded so their remote metadata stays authoritative (the watchdog below still protects them).
- Downstream content watchdog on every streaming path (native Chat/Messages/Responses passthrough and the translated Responses projections). It mirrors Grok Build's per-protocol "meaningful content" idle classification — text, reasoning, tool-call deltas, and terminal signals count; keepalive comments, usage-only chunks, empty deltas, and lifecycle bookkeeping events do not — and fires one 30-second margin before the client's own content-progress timer. On fire it closes the upstream body and emits a retryable proxy_stream_error, so a genuinely stalled stream re-enters Grok Build's native 15-attempt retry budget instead of dying on the client's non-retryable IdleTimeout. Watchdog activity is logged as SSE stalled: no content reached Grok Build for …; timeouts below 60 seconds disable the watchdog to respect explicit fast-fail choices.
Fixed
- A relay holding a stream with only keepalive bytes for longer than Grok Build's idle deadline (observed: GLM channels queuing for 3+ minutes with heartbeat-only frames) previously killed the turn permanently: the sampler's content-progress timer raises IdleTimeout, which is classified non-retryable, so neither the 15-attempt budget nor error-triggered compaction could save the turn. The turn now waits out stalls up to the managed deadline and degrades to a normal retryable failure past it.

Added
- Usage rectifier that repairs provider token-usage measurements before they reach Grok Build's token ledger and auto-compaction meter. Stringly-typed counts ("prompt_tokens": "12345"), whole floats, and json.Number values are normalized to integers; invalid optional decorations (null detail values, non-map detail containers, fractional cost_in_usd_ticks) are removed without poisoning the core measurement; unrecoverable core counts (negative, fractional, overflowing, non-numeric) are deleted so the downstream validator drops the measurement instead of trusting corrupt data. Applied across Chat Completions, Responses, and Messages, in streaming and non-streaming responses, and in protocol-translation paths, with repairs logged as usage rectified proxy notes.
- streamFrameRectifier interface unifying the three frame-rewriting stream rectifiers (Chat tool calls, Messages tool blocks, Responses function calls) under a single contract, so future protocol rectifiers plug into the same pipeline without touching dispatch logic.
Fixed
- Channels whose relays report usage with non-standard JSON types (GLM and potentially other one-api/new-api-style gateways) no longer have their entire usage measurement silently dropped on format defects. Grok Build now receives real provider token counts instead of falling back to a byte-based estimate that overshoots by 25% or more on Chinese and JSON-heavy content, which previously fired auto-compaction at roughly 50% real usage instead of the configured threshold. The premature compaction dropped all tool results, the model re-read files it had already processed, context ballooned again, and a second compaction stalled the session entirely.

Fixed
- Quoted think tags are prose, not span delimiters: a <think> or </think> occurrence wrapped in backticks or double quotes no longer opens or closes an inline think span. Reasoning that discusses the tags keeps its full span in the reasoning channel instead of terminating early and leaking the remainder into the visible reply, and tags quoted inside visible text reach the client intact; only unquoted stray closing tags are still removed.
- The non-streaming content path classifies unbalanced closing-tag reasoning tails and removes stray closing tags only on complete message objects (those carrying a role); streaming deltas leave classification to the turn-level state machine, where a delta-level strip previously consumed a closing tag before the state machine saw it.

Added
- Head-truncation repair for tool calls whose first stream delta was lost in transit: arguments missing their opening {" are restored when the prefixed payload parses as exactly one complete JSON object, and empty function names are inferred from the argument key set against the tools declared on the request (the shared command+description shape resolves deterministically to run_terminal_command; remaining ties stay unrepaired). Applied in the shared tool-compatibility layer across chat_completions, messages, and responses, streaming and non-streaming, and on persisted history replayed in later requests, with the repaired name backfilled onto the matching tool-result message.
- Stream-terminal emission of Chat tool frames: the chat rectifier holds tool frames until [DONE], stream end, or an error frame instead of flushing at finish_reason, so argument fragments a relay emits after finish_reason merge into complete arguments instead of being discarded tail-truncated. Held inline reasoning still flushes at finish_reason.
- Hold rectifiers for name-less tool blocks: Messages tool_use blocks are held between content_block_start and content_block_stop and re-emitted as start (resolved name) + one complete input_json_delta + stop; Responses function_call items are held between response.output_item.added and response.output_item.done, with the done frame's complete item as a second source for name and arguments. Unclosed blocks and items flush at their protocol terminals.
- late-tool-deltas-discarded(index=N) proxy log note for tool-call deltas discarded after an early flush, making relays that emit finish_reason before their last argument fragments diagnosable.
Fixed
- Third-party relays that drop a tool call's first streamed delta no longer surface as Agent tried calling a tool that doesn't exist with head-truncated arguments; the damage is repaired before Grok Build dispatch, and broken records persisted in earlier turns are repaired on replay instead of reaching the upstream verbatim.

Added
- Responses absorb window for retryable response.failed SSE terminals. While nothing has been written to the client, a Responses stream whose only terminal is a retryable failure (rate limit, concurrency, overload) is withheld — response headers and early frames stay buffered up to 32 frames — and replayed inside the absorb window with the same backoff and Retry-After handling as HTTP soft failures. Grok Build keeps its full retry budget; an exhausted window passes the failure through retryable. absorb_retry_max_secs = 0 streams the failed event immediately; deterministic response.failed events pass through without retry.
- Structured upstream error summaries for HTTP errors and Responses response.failed/error events (type, code, message), with bearer tokens, key assignments, and sk- values redacted and long messages truncated. An official Grok catalog name (for example grok-4.6) observed on a non-xAI custom channel is logged with body size, tool count, and session presence to aid /resume diagnosis; first-party api.x.ai routes and custom IDs without the grok- prefix are excluded.
- Explicit non-retryable 502 responses for stream-shape mismatches: an SSE body answered to a non-streaming request, or a streaming body answered to Grok Build's fixed non-streaming WebSearchClient request.
Fixed
- Concurrency-limit rejections (concurrency, concurrency limit, and the corresponding Chinese phrases) classify as transient, and error envelopes nested under response.error are recognized the same as top-level error objects.
- Client disconnects no longer surface as upstream stream failures. Messages, Chat Completions, native, and Responses streams log a client abort and emit no proxy_stream_error when the client write fails or the request context is canceled; truly truncated upstream streams still emit the error.
- Benign upstream-model mismatches log once per channel/protocol/configured/upstream pair (bounded to 256 keys); conflicting and invalid declarations always log. Responses SSE headers are sent only after the hold decision, so an absorbed retry never emits partial headers.

Changed
- Removed the implicit supports_backend_search = true default for models on the exact first-party api.deepseek.com endpoint. DeepSeek has retired its hosted web search — the current Responses API documents web_search and all other built-in tools as ignored — so the old default routed web_search to a channel that silently answers without search results, bypassing the client-search fallback chain ([models].web_search, GROK_WEB_SEARCH_MODEL, authenticated official fallback) with no error or sources. An omitted field now preserves Grok Build catalog behavior for every provider uniformly; explicit true/false values keep their meaning, and a channel explicitly set to true still works for relayed endpoints that implement a real search extension. DeepSeek-specific protocol handling (the [1m] Messages alias, thinking normalization, 660-second idle policy, and the Chat Responses bridge dialect) is unchanged.

Added
- Closed-Responses-schema negotiation for hosted web search. The standard web_search_call.action.sources include hint remains the default for compliant providers. Volcengine Ark (*.volces.com) — whose include is a closed enum rejecting unknown values with InvalidParameter, and whose tool schema rejects unknown declaration fields such as filters and the allowed_tools selector — is handled ahead of time: the hint is omitted and the hosted-search declaration is sanitized to the documented field set, with a pure hosted-search allowed_tools selection collapsed to required. Any other upstream that proves its schema closed with a 400 (include or tool-declaration rejection) triggers one in-request rewrite-and-replay; the rewrite is single-shot per request and no per-host, per-channel, or on-disk state is retained. A rejected request never executed a search, so the replay is side-effect free and consumes no billed search quota.
Fixed
- Hosted-search responses whose url_citation annotations omit start_index/end_index no longer fail Grok Build's annotation parser: missing indices are filled with 0 on every route, in non-streaming bodies and streaming terminal events alike, preserving search availability at the cost of citation highlight precision only.

Fixed
- Relays that answer a failure with HTTP 200 plus an error envelope no longer die as an opaque envelope-validation rejection. A transient envelope (rate limit, overloaded, timeout) now enters the absorb window and is retried inside the proxy; a deterministic envelope (authentication, billing, invalid request) passes through with the provider's explanation and a terminal disposition. Responses terminal bodies that carry their own error member keep the native failed-response path.
- A Cloudflare shield challenge in front of a relay (cf-mitigated: challenge or a Cloudflare-served challenge page) is treated as transient: absorbed inside the retry window, and passed through as a retryable 503 when it outlasts the window, because a bare 403 classifies terminal in Grok Build. A genuine origin 403 without Cloudflare markers is untouched.
- Non-streaming Chat Completions responses whose relay reuses one tool_call ID across calls are remapped to fresh unique IDs, matching the streaming rectifier's tolerance, instead of being rejected; the next round's tool history stays valid.
- Responses bodies that omit envelope bookkeeping (id, object, status) on an otherwise complete terminal payload get the missing markers synthesized instead of a 502 rejection; present-but-wrong values and a missing or malformed output remain rejections.
Added
- Regression coverage for wrapped-2xx absorb-then-recover and deterministic passthrough, Cloudflare challenge absorb/passthrough and origin-403 separation, envelope bookkeeping synthesis, and non-streaming duplicate call-ID remapping.

Fixed
- Responses streams no longer fail when an upstream reuses one item ID across output slots (observed on sub2api-style gateways that share a single reasoning ID per response). The colliding later slot is remapped to a fresh unique ID that keeps the provider's type prefix (rs_, ws_, msg_, …), and every later item_id event for that slot — reasoning summary deltas, function-call argument deltas, and the final response.completed snapshot — is rewritten consistently. Affected turns previously exhausted Grok Build's retry budget and ended as Server error (500).
- Chat Completions streams now assign a unique call_ ID to any tool_call whose upstream ID was already used by another call in the same response, keeping the next round's tool history valid instead of tripping request-side history validation.
- The per-stream remap count is logged (remapped N duplicate upstream item id(s)) so a defective upstream remains visible in diagnostics.
Changed
- Responses stream identity validation distinguishes two failure classes: cross-slot ID reuse (remapped, stream survives) and same-slot identity conflicts (still rejected). Request-side tool-history validation is unchanged.

Fixed
- Native Chat SSE no longer lets a later empty "name" overwrite a known tool name, and no longer rewrites incomplete argument JSON per frame. Grok Build's last-write-wins Chat accumulator therefore keeps list_dir / run_terminal_command instead of reporting NotFound.
- Empty or vendor finish_reason values ("", GLM sensitive / network_error / model_context_window_exceeded) are dropped or mapped onto Grok Build's Chat enum so serde no longer cancels the stream.
- Reasoning is forwarded only as a prefix sibling. Thought after visible text is dropped on Chat, Messages, and Responses; <think> blocks are peeled out of answer text; protocol self-talk such as reply only: / 任务已全部完成 is stripped from prefix CoT. Streaming reasoning_content deltas keep leading BPE spaces.
- Chat history no longer replays plaintext CoT across user turns except on DeepSeek and MiMo. Intra-turn tool-loop reasoning is kept. Encrypted or signed blobs are never removed, and "tool call" placeholders are never injected.
Changed
- Ordinary Chat and Messages channels stay on Grok Build's first-party mapper. Responses projection remains search-only.
- Upstream Chat tool lists keep Grok Build client_name values. Claude/Codex aliases are rewritten on inbound calls instead of being cloned into every tools array.
- Every upstream request is presented as Grok Build (grok-shell User-Agent and X-Grok-Client-Identifier). hellogrok's own product string is never forwarded.
- Streaming Chat keeps stream_options.include_usage=true. GLM Chat with tools also sets tool_stream=true when omitted.

Fixed
- Align Grok Build's local capability surface for every custom channel, including relayed grok-4.5/4.6 endpoints that arrive as Responses, Messages, or Chat Completions. Tool-call names and wire shapes are resolved back to the function tools declared on the current request: empty or top-level Chat names, legacy function_call, object-valued arguments, Claude/Codex/display aliases, argument-shape recovery, and common XML/JSON-in-content calls.
- Project Claude/Codex aliases (LS, Read, Bash, Task, …) onto coding-session tool lists so models can discover Grok Build tools under names they already know, then map those calls back to list_dir, read_file, run_terminal_command, spawn_subagent, and the rest before dispatch.
- Wrap direct MCP names (server__tool, mcp__server__tool) as use_tool when that meta-tool is declared. Convert Write-style full-file payloads to write or search_replace, Glob-style patterns to glob/grep/rg --files, and fill required description / subagent_type fields that Grok Build schemas reject when omitted.
- Repair request history and tool-result name fields so a mismatched alias call cannot poison the next thinking-model turn into a retryable stream error. Exact Grok Build names from relayed grok-4.5/4.6 sessions are left unchanged.

Fixed
- Normalize missing Chat and Messages local tool-call IDs before delivery; repair only unambiguous missing-ID pairs in existing Chat history.
- Preserve Responses output-item and function-call identities across stream events and reject conflicts. Assign tool indexes when converting buffered Chat responses to SSE.
- Extend OpenCode session projection to Go and Zen across all three protocols. Extract identity before conversion and reuse headers for retries; unidentified requests receive isolated operation IDs instead of being blocked locally. Cross-request affinity remains unavailable without client identity.
- Preserve configured or incoming OpenCode User-Agent headers; when absent, derive Grok Build identification from the installed executable instead of advertising hellogrok.
Added
- Display the running application version in the Windows status/log window title.
- Add opt-in live-provider read-tool verification and regression coverage for tool identity, parallel fallback calls, and OpenCode request headers.

Added
- Internal SessionIdentity normalization for Grok Build requests. Stable conversation identity can come from an existing upstream session header, Grok Build conversation/session headers, standard session headers, or metadata.session_id.
- OpenCode Go upstream projection: custom routes under opencode.ai/zen/go now receive x-opencode-session when the incoming request supplies a stable identity. Existing non-empty values remain authoritative, and requests without a stable identity are not assigned a random per-request ID.
Fixed
- OpenCode Go custom channels no longer lose Grok Build's conversation affinity when hellogrok rebuilds the upstream request for protocol conversion.

Added
- Per-channel absorb layer for transient upstream soft failures. While the upstream response headers have not been sent, retryable failures (busy/overloaded 503, 429, retryable 5xx, response-header timeouts) are retried inside the proxy with exponential backoff (2s–30s, honoring an upstream Retry-After up to 60s) for up to 90 seconds by default (absorb_retry_max_secs, absorb_retry_backoff_cap_secs). Grok Build's native 15-attempt retry budget stays untouched during the window; only when the window is exhausted does the failure pass through, still retryable. Transport errors are not absorbed so Grok Build's first-retry HTTP/1.1 client rebuild keeps working. UP absorb log lines record each wait.
- Synthesized 30-second Retry-After on retryable busy/overloaded 5xx passthroughs that carried none, pacing Grok Build's own retries. Upstream Retry-After headers are preserved.
- Opt-in dead-channel breaker (dead_channel_fail_fast, default off; dead_channel_fail_threshold, default 6). Only dial-level failures (connection refused, DNS, TLS handshake) count, because those can never succeed on retry; after the streak the proxy answers a non-retryable 503 proxy_circuit_open with X-Should-Retry: false, with one probe allowed after a 5-minute cooldown and any upstream response closing the breaker.
Changed
- The circuit breaker no longer fast-fails soft failures. Busy 503, 429, timeouts, transport resets, and error-body read failures pass through as retryable (or are absorbed first), so Grok Build keeps its complete native retry budget. X-Should-Retry: false is reserved for deterministic failures whose retries cannot succeed (authentication, permission, billing, quota, invalid request/model).

Fixed
- Provider token counts larger than the known context_window are no longer forwarded as Grok Build live context. Hosted-search billing totals, oversized context_details, and translated Messages/Chat measurements that cannot be the prompt of a successful request become usage: null, so Grok keeps the previous baseline instead of compacting on a 1.7M / 1.0M display. Ordinary in-window usage is unchanged.

Added
- Per-channel upstream failure circuit breaker. Grok Build retries retryable statuses up to 15 times (≈5.5 minutes per turn), so a channel whose relay is down leaves the user stuck in the "retrying" phase until every attempt fails. After 4 consecutive retryable upstream failures (5xx, transport errors, or error-body read failures) the proxy now answers immediately with a non-retryable 503 proxy_circuit_open and X-Should-Retry: false, so the turn fails fast instead of burning the retry budget. A single probe request is allowed through after a 90-second cooldown: success closes the breaker automatically, failure re-arms it. Any non-5xx upstream response (including 429) resets the failure streak, and each channel has an independent breaker. Streaming failures that occur after headers are sent are unaffected. 10→

Added
- Explicit search model selection via [models].web_search config key and GROK_WEB_SEARCH_MODEL environment variable, with env taking precedence over config.
- Hosted search capability auto-detection for Grok relay channels at startup (web_search + x_search probing).
- Chat Completions search dialect auto-detection (search_parameters vs web_search_options).
- CC Switch takeover detection before config rewrite — start is refused when CC Switch already owns Grok Build.
- Single-instance enforcement for both tray and foreground modes via OS-level lock.
- Windows log window application icon display in title bar and taskbar.
- Search route resolution logging at startup, visible in hellogrok routes and the log window.
Changed
- Tray now defaults to proxy-enabled on first launch.
- Tray quit defers exit when a config-ownership conflict exists, preventing orphaned proxy URLs.
- SIGINT/SIGTERM handlers retry stop on deferred errors instead of leaving the process inconsistent.
- BackendSearchSet field distinguishes explicit supports_backend_search declarations from Build's false default, enabling runtime probing for unset values.
- Route now carries HostedSearchKnown, HostedWebSearch, HostedXSearch, and HostedChatSearchDialect for capability-aware request normalization.
- Tool choice normalization is now capability-aware — only confirmed hosted search declarations are injected.
Fixed
- Managed search flag now placed after channel settings in config rewrites, preventing key-ordering issues.
- Client search wire alias properly hidden from upstream requests.