@aiwg/cli 2026.9.12 → 2026.9.16

package/dist/src/providers/provider-definitions.js

@@ -2,6 +2,7 @@ import { z } from 'zod';
 import { homedir } from 'os';
 import { join } from 'path';
 import { resolveHermesHomePath } from './hermes-home.js';
+import { resolveGrokbotSkillsDir } from './grokbot-paths.js';
 import { getProviderCapabilities, } from './capability-matrix.js';
 const ArtifactPathsSchema = z.object({
     agents: z.string().nullable(),
@@ -19,6 +20,7 @@ const ProviderDefinitionSchema = z.object({
         'cursor',
         'deepseek-harness',
         'factory',
+        'grokbot',
         'hermes',
         'opencode',
         'openclaw',
@@ -140,6 +142,7 @@ export const PROVIDER_IDS = [
     'cursor',
     'deepseek-harness',
     'factory',
+    'grokbot',
     'hermes',
     'opencode',
     'openclaw',
@@ -204,6 +207,17 @@ const CONTEXT_CONTRACTS = {
         bootstrapTargets: ['AGENTS.md'], maxContextBytes: null, recommendedMaxLines: 150, nestedContext: true, support: 'supported',
         verification: { method: 'official Factory AGENTS.md discovery hierarchy', source: 'https://docs.factory.ai/cli/configuration/agents-md', lastVerified: VERIFIED_ON },
     },
+    grokbot: {
+        startupFiles: ['AGENTS.md'],
+        precedence: ['provider/system', 'project AGENTS.md when the host exposes it', 'explicit aiwg discover/show'],
+        loadMode: 'prose-directive', includeSyntax: null, configRegistration: null,
+        bootstrapTargets: ['AGENTS.md'], maxContextBytes: null, recommendedMaxLines: null, nestedContext: false, support: 'degraded',
+        verification: {
+            method: 'AIWG discover-first adapter contract; native Grok Bot startup/include path not yet verified — explicit-read guidance only',
+            source: 'docs/architecture/adr-grokbot-provider-target.md',
+            lastVerified: '2026-09-15',
+        },
+    },
     hermes: {
         startupFiles: ['.hermes.md', 'AGENTS.md'], precedence: ['provider/system', '.hermes.md', 'AGENTS.md'],
         loadMode: 'prose-directive', includeSyntax: null, configRegistration: null,
@@ -556,6 +570,68 @@ const BUILT_IN_SEEDS = [
         },
         matrixRef: 'factory',
     },
+    {
+        id: 'grokbot',
+        displayName: 'Grok Bot',
+        aliases: [],
+        // #210: promoted stable — Linux PUW + security + migration + maintainer Linux-only waiver 2026-09-16.
+        status: 'stable',
+        builtIn: true,
+        surfaces: {
+            primary: 'grokbot',
+            compatibility: [],
+            precedence: ['AGENTS.md', 'AIWG_GROKBOT_SKILLS_DIR when configured'],
+            related: [],
+        },
+        // Do not treat xAI API keys or generic GROK_* model env as Grok Bot evidence.
+        detection: { env: [], process: [], capabilityId: 'grokbot' },
+        paths: {
+            deployTarget: 'mixed',
+            artifacts: {
+                agents: null,
+                commands: null,
+                // Native skill copies only when AIWG_GROKBOT_SKILLS_DIR is set at deploy time.
+                skills: null,
+                rules: null,
+                behaviors: null,
+            },
+            kernelSkills: null,
+            contextDiscovery: {
+                agents: '.agents/agents',
+                skills: null,
+                rules: null,
+                behaviors: null,
+            },
+            configFile: 'AGENTS.md',
+            contextFiles: { aiwgMd: true, agentsMd: true, claudeMdHook: false, hookFile: null, contextFile: 'AGENTS.md' },
+        },
+        smithPaths: {
+            agents: null,
+            commands: null,
+            skills: null,
+            rules: null,
+            fileExtension: '.md',
+            configFile: 'AGENTS.md',
+            aggregated: false,
+        },
+        // Skills root is env-gated (AIWG_GROKBOT_SKILLS_DIR). skillsBaseDir is a
+        // documentation sentinel only — deployer resolves via resolveGrokbotSkillsDir
+        // and never joins ~/grokbot-skills.
+        skillNamespace: {
+            deploymentGroup: 'deep-recursion',
+            pathType: 'home-dir',
+            skillsBaseDir: 'AIWG_GROKBOT_SKILLS_DIR',
+            subdirLayout: true,
+        },
+        adapters: {
+            agentFormat: 'agents-md',
+            hookBridge: null,
+            mcpInjection: null,
+            contextAggregation: 'agents-md',
+            ruleFormat: 'agents-md-section',
+        },
+        matrixRef: 'grokbot',
+    },
     {
         id: 'hermes',
         aliases: [],
@@ -1137,10 +1213,18 @@ export function getProviderArtifactPathStrings(provider) {
     const definition = getProviderDefinition(provider);
     if (!definition)
         return undefined;
+    const normalized = normalizeProviderDefinitionId(provider);
+    // Grok Bot skills are env-gated (AIWG_GROKBOT_SKILLS_DIR). Resolve dynamically so
+    // deploy counting / user-scope same-path inventory can see the configured root
+    // without inventing ~/.grokbot (#210).
+    let skills = expandProviderHomePath(definition.paths.artifacts.skills);
+    if (normalized === 'grokbot' && !skills) {
+        skills = resolveGrokbotSkillsDir() ?? '';
+    }
     return {
         agents: expandProviderHomePath(definition.paths.artifacts.agents),
         commands: expandProviderHomePath(definition.paths.artifacts.commands),
-        skills: expandProviderHomePath(definition.paths.artifacts.skills),
+        skills,
         rules: expandProviderHomePath(definition.paths.artifacts.rules),
         behaviors: expandProviderHomePath(definition.paths.artifacts.behaviors),
     };

package/dist/src/providers/provider-inventory.js

@@ -12,6 +12,7 @@ const PROVIDER_EXECUTABLES = {
     cursor: ['cursor'],
     'deepseek-harness': ['dsh'],
     factory: ['droid'],
+    // Grok Bot has no verified CLI executable name; omit rather than invent.
     hermes: ['hermes'],
     opencode: ['opencode'],
     openclaw: ['openclaw'],

package/dist/src/sessions/adapters/claude.js

@@ -3,9 +3,12 @@ import { basename, extname, resolve } from 'node:path';
 import { z } from 'zod';
 import { SessionContractError, assertSupportedSchemaMajor, sha256, } from '../contracts.js';
 import { redactSourceLocator } from '../discovery.js';
-import { readBoundedJsonLines, streamBoundedJsonLines, } from '../readers.js';
-export const CLAUDE_ADAPTER_VERSION = '1.0.0';
+import { readBoundedJson, readBoundedJsonLines, streamBoundedJsonLines, } from '../readers.js';
+export const CLAUDE_ADAPTER_VERSION = '1.1.0';
 export const CLAUDE_TRANSCRIPT_SCHEMA_VERSION = '1.0.0';
+/** AIWG's own understanding of the layout it supports; Claude web/account
+ *  exports carry no in-band schema version to read instead. */
+export const CLAUDE_WEB_EXPORT_SCHEMA_VERSION = '1.0.0';
 const ClaudeRecordSchema = z.object({
     type: z.string().min(1),
     subtype: z.string().optional(),
@@ -40,6 +43,43 @@ const ClaudeHookSchema = z.object({
     schemaVersion: z.string().optional(),
     timestamp: z.string().datetime({ offset: true }).optional(),
 }).passthrough();
+/**
+ * Claude.ai web/account data export (`conversations.json`): a JSON array of
+ * conversations, each carrying its own `chat_messages`. This is a distinct
+ * source format from local JSONL transcripts/hooks -- renaming the file does
+ * not make it one (#2565). Unrecognized fields are captured via unknownFields
+ * rather than dropped, and content the export marks as an attachment/file is
+ * recorded as a reference (bytes are not embedded in this export format).
+ */
+const ClaudeWebExportAttachmentSchema = z.object({
+    file_name: z.string().optional(),
+    file_type: z.string().optional(),
+    file_size: z.number().optional(),
+    extracted_content: z.string().optional(),
+}).passthrough();
+const ClaudeWebExportContentBlockSchema = z.object({
+    type: z.string().optional(),
+    text: z.string().optional(),
+}).passthrough();
+const ClaudeWebExportMessageSchema = z.object({
+    uuid: z.string().min(1),
+    text: z.string().optional(),
+    sender: z.enum(['human', 'assistant']),
+    created_at: z.string().optional(),
+    updated_at: z.string().optional(),
+    content: z.array(ClaudeWebExportContentBlockSchema).optional(),
+    attachments: z.array(ClaudeWebExportAttachmentSchema).optional(),
+    files: z.array(ClaudeWebExportAttachmentSchema).optional(),
+}).passthrough();
+const ClaudeWebExportConversationSchema = z.object({
+    uuid: z.string().min(1),
+    name: z.string().optional(),
+    created_at: z.string().optional(),
+    updated_at: z.string().optional(),
+    account: z.object({ uuid: z.string().optional() }).passthrough().optional(),
+    chat_messages: z.array(ClaudeWebExportMessageSchema),
+}).passthrough();
+const ClaudeWebExportSchema = z.array(ClaudeWebExportConversationSchema);
 export class ClaudeSessionAdapter {
     limits;
     discoveryLimits;
@@ -47,7 +87,7 @@ export class ClaudeSessionAdapter {
     adapterVersion = CLAUDE_ADAPTER_VERSION;
     disposition = 'implemented';
     supportedOperations = ['discover', 'inspect', 'stream'];
-    acquisitionModes = ['jsonl', 'hook'];
+    acquisitionModes = ['jsonl', 'hook', 'manual-export'];
     constructor(limits, discoveryLimits = { maxDepth: 8, maxFiles: 10_000 }) {
         this.limits = limits;
         this.discoveryLimits = discoveryLimits;
@@ -80,6 +120,13 @@ export class ClaudeSessionAdapter {
         };
     }
     async *stream(source, cursor) {
+        if (source.locatorClass === 'claude-web-export-json') {
+            const parsed = await this.readWebExportSource(source);
+            const start = parseRecordCursor(cursor?.value);
+            for (const record of parsed.records.slice(start))
+                yield record;
+            return;
+        }
         const start = parseRecordCursor(cursor?.value);
         const input = await streamBoundedJsonLines({
             selectedPath: source.locator,
@@ -112,6 +159,9 @@ export class ClaudeSessionAdapter {
         }
     }
     async readSource(source) {
+        if (source.locatorClass === 'claude-web-export-json') {
+            return this.readWebExportSource(source);
+        }
         const result = await readBoundedJsonLines({
             selectedPath: source.locator,
             allowedRoots: source.authorizedScope.allowedRoots,
@@ -132,7 +182,81 @@ export class ClaudeSessionAdapter {
             consistency: normalized.complete ? 'complete' : 'provisional',
         };
     }
+    async readWebExportSource(source) {
+        const { value } = await readBoundedJson({ selectedPath: source.locator, allowedRoots: source.authorizedScope.allowedRoots }, this.limits);
+        const parsed = ClaudeWebExportSchema.safeParse(value);
+        if (!parsed.success) {
+            throw new SessionContractError('MALFORMED_SOURCE', 'Claude web/account export is not a recognized conversations.json layout');
+        }
+        if (parsed.data.length === 0) {
+            throw new SessionContractError('MALFORMED_SOURCE', 'Claude web/account export is empty');
+        }
+        return {
+            records: normalizeWebExport(parsed.data),
+            schemaVersion: CLAUDE_WEB_EXPORT_SCHEMA_VERSION,
+            // The export is a completed snapshot at request time, not a live tail.
+            consistency: 'complete',
+        };
+    }
 }
+function normalizeWebExport(conversations) {
+    const output = [];
+    const seenConversationIds = new Set();
+    for (const conversation of conversations) {
+        if (seenConversationIds.has(conversation.uuid)) {
+            throw new SessionContractError('DUPLICATE_NATIVE_ID', `Claude web export declares the same conversation uuid twice: ${conversation.uuid}`);
+        }
+        seenConversationIds.add(conversation.uuid);
+        const seenMessageIds = new Set();
+        for (const [index, message] of conversation.chat_messages.entries()) {
+            if (seenMessageIds.has(message.uuid)) {
+                throw new SessionContractError('DUPLICATE_NATIVE_ID', `Claude web export conversation ${conversation.uuid} declares the same message uuid twice: ${message.uuid}`);
+            }
+            seenMessageIds.add(message.uuid);
+            output.push(webExportProviderRecord(conversation, message, index));
+        }
+    }
+    return output;
+}
+function webExportProviderRecord(conversation, message, sequence) {
+    const text = message.text && message.text.length > 0
+        ? message.text
+        : (message.content ?? []).map((block) => block.text ?? '').filter(Boolean).join('\n');
+    const attachments = [...(message.attachments ?? []), ...(message.files ?? [])];
+    return {
+        nativeSessionId: conversation.uuid,
+        nativeEventId: message.uuid,
+        sequence,
+        kind: 'message',
+        role: message.sender,
+        participant: message.sender,
+        occurredAt: message.created_at,
+        text,
+        rawReference: { locatorClass: 'claude-web-export-json', sequence },
+        extensions: {
+            conversationName: conversation.name,
+            conversationCreatedAt: conversation.created_at,
+            conversationUpdatedAt: conversation.updated_at,
+            provenance: { acquisition: 'claude-web-export-json', schema: CLAUDE_WEB_EXPORT_SCHEMA_VERSION },
+            // Web/account exports reference attachments/files by metadata only; the
+            // export format does not embed original bytes, so this is a coverage
+            // note (#2565 acceptance criteria), not a loss AIWG introduced.
+            ...(attachments.length > 0 ? {
+                attachmentReferences: attachments.map((attachment) => ({
+                    fileName: attachment.file_name,
+                    fileType: attachment.file_type,
+                    fileSize: attachment.file_size,
+                    extractedContentAvailable: typeof attachment.extracted_content === 'string',
+                })),
+                metadataLoss: ['attachment bytes unavailable in web/account export format'],
+            } : {}),
+            unknownFields: unknownFields(message, WEB_EXPORT_MESSAGE_KEYS),
+        },
+    };
+}
+const WEB_EXPORT_MESSAGE_KEYS = new Set([
+    'uuid', 'text', 'sender', 'created_at', 'updated_at', 'content', 'attachments', 'files',
+]);
 function normalizeTranscript(records, locator) {
     const filenameSessionId = basename(locator, extname(locator));
     const output = [];

package/dist/src/sessions/adapters/grokbot.js

@@ -0,0 +1,49 @@
+/**
+ * Grok Bot session adapter — manual-export only until product evidence exists
+ * for a native session filesystem or API locator.
+ *
+ * Auto-discover is unsupported and must never scrape invented ~/.grokbot,
+ * Cursor session paths, or other unverified roots.
+ *
+ * Authorized imports reuse the AIWG generic session interchange format so
+ * operators can supply an explicit export without inventing a Grok schema.
+ *
+ * @see docs/providers/grokbot-sessions.md
+ * @issue #215
+ */
+import { SessionContractError, } from '../contracts.js';
+import { GenericSessionInterchangeAdapter, } from './generic.js';
+export const GROKBOT_ADAPTER_VERSION = '1.0.0';
+export const GROKBOT_EXPORT_SCHEMA_VERSION = '1.0.0';
+export const GROKBOT_LOCATOR_CLASS = 'manual-export';
+export class GrokbotSessionAdapter {
+    provider = 'grokbot';
+    adapterVersion = GROKBOT_ADAPTER_VERSION;
+    disposition = 'manual-only';
+    supportedOperations = ['inspect', 'stream'];
+    acquisitionModes = ['manual-export'];
+    interchange;
+    constructor(limits) {
+        this.interchange = new GenericSessionInterchangeAdapter(limits);
+    }
+    async *discover(_scope) {
+        throw new SessionContractError('UNSUPPORTED_OPERATION', 'Grok Bot session auto-discover is unsupported until a verified native locator exists; '
+            + 'select an authorized manual export explicitly. AIWG does not scrape ~/.grokbot, '
+            + '~/grokbot-skills, or Cursor session paths.');
+    }
+    async inspect(source) {
+        this.assertManualExport(source);
+        return this.interchange.inspect(source);
+    }
+    async *stream(source, cursor) {
+        this.assertManualExport(source);
+        yield* this.interchange.stream(source, cursor);
+    }
+    assertManualExport(source) {
+        if (source.locatorClass !== GROKBOT_LOCATOR_CLASS) {
+            throw new SessionContractError('UNSUPPORTED_OPERATION', `Grok Bot supports only locatorClass "${GROKBOT_LOCATOR_CLASS}" until native session evidence exists `
+                + `(got "${source.locatorClass}"). Do not reuse Cursor session locators.`);
+        }
+    }
+}
+//# sourceMappingURL=grokbot.js.map

package/dist/src/sessions/adapters/hermes.js

@@ -4,23 +4,31 @@ import { readBoundedJsonLines, streamBoundedJsonLines, } from '../readers.js';
 export const HERMES_ADAPTER_VERSION = '1.0.0';
 export const HERMES_EXPORT_SCHEMA_VERSION = '1.0.0';
 export const HERMES_NATIVE_SCHEMA_VERSION = '23.0.0';
+const sqliteBoolean = z.union([z.boolean(), z.literal(0), z.literal(1)])
+    .transform((value) => Boolean(value));
+function nullableOptional(schema) {
+    return z.preprocess((value) => value === null ? undefined : value, schema.optional());
+}
 const MessageSchema = z.object({
     id: z.union([z.string(), z.number()]),
     role: z.string().min(1),
     content: z.unknown().optional(),
-    tool_call_id: z.string().optional(),
+    tool_call_id: nullableOptional(z.string()),
     tool_calls: z.unknown().optional(),
-    tool_name: z.string().optional(),
+    tool_name: nullableOptional(z.string()),
     timestamp: z.number().optional(),
-    token_count: z.number().optional(),
-    finish_reason: z.string().optional(),
-    reasoning: z.string().optional(),
-    reasoning_content: z.string().optional(),
+    token_count: nullableOptional(z.number()),
+    finish_reason: nullableOptional(z.string()),
+    reasoning: nullableOptional(z.string()),
+    reasoning_content: nullableOptional(z.string()),
     reasoning_details: z.unknown().optional(),
     codex_reasoning_items: z.unknown().optional(),
 }).passthrough();
 const ExportSchema = z.object({
-    schemaVersion: z.union([z.string(), z.number()]),
+    // Hermes CLI exports currently omit a schema marker. They use the same
+    // schema-23 record shape that the adapter already validates; explicit
+    // markers still pass through the major-version gate below.
+    schemaVersion: z.union([z.string(), z.number()]).default(HERMES_NATIVE_SCHEMA_VERSION),
     id: z.string().min(1),
     source: z.string().min(1),
     user_id: z.string().nullable().optional(),
@@ -31,8 +39,8 @@ const ExportSchema = z.object({
     started_at: z.number(),
     ended_at: z.number().nullable().optional(),
     end_reason: z.string().nullable().optional(),
-    archived: z.boolean().optional(),
-    inactive: z.boolean().optional(),
+    archived: sqliteBoolean.optional(),
+    inactive: sqliteBoolean.optional(),
     cwd: z.string().nullable().optional(),
     git_branch: z.string().nullable().optional(),
     routing_key: z.string().nullable().optional(),

package/dist/src/sessions/adapters/opencode.js

@@ -343,7 +343,18 @@ function normalizeMessage(message, sequence, locatorClass, common) {
                 toolCallId: part.callID,
                 toolState: part.state,
                 attachment: part.type === 'file'
-                    ? { mime: part.mime, filename: part.filename, urlPresent: Boolean(part.url) }
+                    ? {
+                        mime: part.mime,
+                        filename: part.filename,
+                        displayName: part.filename,
+                        urlPresent: Boolean(part.url),
+                        // Preserve only locally recoverable byte locators. Remote URLs
+                        // remain presence-only metadata and are never fetched by export.
+                        dataBytes: part.url?.startsWith('data:')
+                            ? [...Buffer.from(part.url.slice(part.url.indexOf(',') + 1), part.url.includes(';base64,') ? 'base64' : 'utf8')]
+                            : undefined,
+                        fileUrl: part.url?.startsWith('file:') ? part.url : undefined,
+                    }
                     : undefined,
                 opaqueContent: !['text', 'reasoning', 'tool', 'file'].includes(part.type),
                 unknownFields: unknownFields(part, PART_KEYS),

package/dist/src/sessions/contracts.js

@@ -3,7 +3,7 @@ import { z } from 'zod';
 export const SESSION_CONTRACT_VERSION = '1.0.0';
 export const SESSION_PROVIDER_IDS = [
     'claude', 'codex', 'copilot', 'cursor', 'factory', 'hermes',
-    'opencode', 'openclaw', 'openhuman', 'pi', 'omp', 'deepseek-harness', 'warp', 'devin-desktop', 'generic',
+    'opencode', 'openclaw', 'openhuman', 'grokbot', 'pi', 'omp', 'deepseek-harness', 'warp', 'devin-desktop', 'generic',
 ];
 export const SessionProviderIdSchema = z.enum(SESSION_PROVIDER_IDS);
 export const SESSION_PROVIDER_ALIASES = Object.freeze({