@aiwg/cli 2026.9.15 → 2026.9.17

package/dist/src/providers/grok-build-inspect.js

@@ -0,0 +1,245 @@
+/**
+ * Grok Build verification via `grok inspect` when the binary is available.
+ * Presence-only remediation when absent — never invents inspect output.
+ *
+ * @issue #2575
+ */
+import { accessSync, constants as fsConstants } from 'node:fs';
+import path from 'node:path';
+import { spawnSync } from 'node:child_process';
+export function grokExecutableCandidates(env, cwd, platform = process.platform) {
+    const pathApi = platform === 'win32' ? path.win32 : path.posix;
+    const pathDelimiter = platform === 'win32' ? ';' : ':';
+    const pathDirs = (env.PATH ?? env.Path ?? process.env.PATH ?? '')
+        .split(pathDelimiter)
+        // An empty PATH segment means the child cwd on POSIX and Windows.
+        .map((entry) => entry || '.');
+    const suffixes = platform === 'win32'
+        ? [...(env.PATHEXT || env.Pathext || '.COM;.EXE;.BAT;.CMD')
+                .split(';')
+                .map((entry) => entry.trim())
+                .filter(Boolean), '']
+        : [''];
+    const candidates = new Set();
+    for (const dir of pathDirs) {
+        const absoluteDir = pathApi.isAbsolute(dir) ? dir : pathApi.resolve(cwd, dir);
+        for (const suffix of suffixes)
+            candidates.add(pathApi.join(absoluteDir, `grok${suffix}`));
+    }
+    return [...candidates];
+}
+function whichGrok(env, cwd) {
+    // Resolve from the supplied environment and deployment cwd without a shell.
+    for (const candidate of grokExecutableCandidates(env, cwd)) {
+        try {
+            accessSync(candidate, process.platform === 'win32' ? fsConstants.F_OK : fsConstants.X_OK);
+            return candidate;
+        }
+        catch {
+            // try next
+        }
+    }
+    return null;
+}
+function tryParseJson(text) {
+    const trimmed = text.trim();
+    if (!trimmed)
+        return null;
+    try {
+        const value = JSON.parse(trimmed);
+        return value && typeof value === 'object' && !Array.isArray(value)
+            ? value
+            : null;
+    }
+    catch {
+        return null;
+    }
+}
+function asRecordArray(value) {
+    if (!Array.isArray(value))
+        return [];
+    return value.filter((entry) => Boolean(entry) && typeof entry === 'object' && !Array.isArray(entry));
+}
+function pathMentions(haystack, needle) {
+    const normalizedHay = haystack.replace(/\\/g, '/');
+    const normalizedNeedle = needle.replace(/\\/g, '/');
+    return normalizedHay.includes(normalizedNeedle);
+}
+/**
+ * Validate a `grok inspect --json` report against artifacts AIWG intended to deploy.
+ * Shape follows xAI InspectReport (camelCase): projectInstructions, skills, agents, configSources.
+ */
+export function validateGrokInspectReport(parsed, expected = {}) {
+    const mismatches = [];
+    const instructions = asRecordArray(parsed.projectInstructions);
+    const skills = asRecordArray(parsed.skills);
+    const agents = asRecordArray(parsed.agents);
+    const configSources = parsed.configSources;
+    const layers = configSources && typeof configSources === 'object' && !Array.isArray(configSources)
+        ? asRecordArray(configSources.layers)
+        : [];
+    const hasReportShape = Array.isArray(parsed.projectInstructions)
+        || Array.isArray(parsed.skills)
+        || Array.isArray(parsed.agents)
+        || Boolean(configSources);
+    if (!hasReportShape) {
+        mismatches.push({
+            kind: 'shape',
+            expected: 'InspectReport fields (projectInstructions/skills/agents/configSources)',
+            detail: `parsed keys: ${Object.keys(parsed).slice(0, 20).join(',') || '(none)'}`,
+        });
+        return mismatches;
+    }
+    for (const instructionPath of expected.instructionPaths ?? []) {
+        const found = instructions.some((entry) => typeof entry.path === 'string' && pathMentions(entry.path, instructionPath));
+        if (!found) {
+            mismatches.push({
+                kind: 'instructions',
+                expected: instructionPath,
+                detail: `not listed in projectInstructions (${instructions.length} entries)`,
+            });
+        }
+    }
+    for (const skillName of expected.skillNames ?? []) {
+        const found = skills.some((entry) => (typeof entry.name === 'string' && entry.name === skillName)
+            || (typeof entry.source === 'object' && entry.source !== null
+                && typeof entry.source.path === 'string'
+                && pathMentions(String(entry.source.path), skillName)));
+        if (!found) {
+            mismatches.push({
+                kind: 'skills',
+                expected: skillName,
+                detail: `not listed in skills (${skills.length} entries)`,
+            });
+        }
+    }
+    for (const agentName of expected.agentNames ?? []) {
+        const found = agents.some((entry) => typeof entry.name === 'string' && entry.name === agentName);
+        if (!found) {
+            mismatches.push({
+                kind: 'agents',
+                expected: agentName,
+                detail: `not listed in agents (${agents.length} entries)`,
+            });
+        }
+    }
+    for (const substring of expected.configPathSubstrings ?? []) {
+        const found = layers.some((entry) => typeof entry.path === 'string' && pathMentions(entry.path, substring));
+        if (!found) {
+            mismatches.push({
+                kind: 'config',
+                expected: substring,
+                detail: `not listed in configSources.layers (${layers.length} entries)`,
+            });
+        }
+    }
+    return mismatches;
+}
+const ABSENT_REMEDIATION = 'Install the Grok Build CLI so `grok` is on PATH, then re-run verification. '
+    + 'Until then AIWG only confirms provider registration and on-disk .grok paths — it does not invent inspect output.';
+function isRunOptions(value) {
+    if (!value || typeof value !== 'object')
+        return false;
+    const keys = Object.keys(value);
+    if (keys.length === 0)
+        return false;
+    return keys.every((key) => key === 'env' || key === 'cwd' || key === 'expected');
+}
+/**
+ * Run `grok inspect` (prefer `--json` when the CLI accepts it).
+ * Accepts either a ProcessEnv (legacy) or an options bag with env/cwd/expected.
+ */
+export function runGrokInspect(envOrOptions = process.env) {
+    const options = isRunOptions(envOrOptions)
+        ? envOrOptions
+        : { env: envOrOptions };
+    const env = options.env ?? process.env;
+    const cwd = options.cwd ?? process.cwd();
+    const binary = whichGrok(env, cwd);
+    if (!binary) {
+        return { status: 'absent', remediation: ABSENT_REMEDIATION };
+    }
+    // Prefer machine-readable inspect; fall back to plain inspect if --json is rejected.
+    // Use length/index checks — tuple `includes()` narrows incorrectly under TS (TS2345).
+    const argSets = [
+        ['inspect', '--json'],
+        ['inspect'],
+    ];
+    for (let i = 0; i < argSets.length; i++) {
+        const args = argSets[i];
+        const wantsJson = args.length > 1 && args[1] === '--json';
+        const result = spawnSync(binary, [...args], {
+            encoding: 'utf8',
+            env,
+            cwd,
+            timeout: 15_000,
+            maxBuffer: 2_000_000,
+            // npm exposes Grok through a .cmd shim on Windows; Node requires a shell
+            // for .cmd/.bat launchers. Native .exe installs stay shell-free.
+            shell: process.platform === 'win32' && /\.(?:cmd|bat)$/i.test(binary),
+        });
+        if (result.error && result.error.code === 'ENOENT') {
+            return { status: 'absent', remediation: ABSENT_REMEDIATION };
+        }
+        const stdout = result.stdout || '';
+        const stderr = result.stderr || '';
+        if (result.status === 0) {
+            const parsed = tryParseJson(stdout);
+            if (!parsed) {
+                return {
+                    status: 'failed',
+                    binary,
+                    exitCode: 0,
+                    stderr,
+                    stdout,
+                    cwd,
+                    mismatches: [{
+                            kind: 'shape',
+                            expected: 'JSON InspectReport',
+                            detail: 'exit 0 but stdout was not a JSON object',
+                        }],
+                };
+            }
+            const mismatches = validateGrokInspectReport(parsed, options.expected);
+            if (mismatches.length > 0) {
+                return {
+                    status: 'failed',
+                    binary,
+                    exitCode: 0,
+                    stderr,
+                    stdout,
+                    cwd,
+                    mismatches,
+                };
+            }
+            return {
+                status: 'ok',
+                binary,
+                stdout,
+                parsed,
+                cwd,
+                mismatches: [],
+            };
+        }
+        if (wantsJson && /unknown|unrecognized|invalid/i.test(`${stderr}\n${stdout}`)) {
+            continue;
+        }
+        return {
+            status: 'failed',
+            binary,
+            exitCode: result.status,
+            stderr,
+            stdout,
+            cwd,
+        };
+    }
+    return {
+        status: 'failed',
+        binary,
+        exitCode: null,
+        stderr: 'grok inspect did not succeed',
+        stdout: '',
+        cwd,
+    };
+}
+//# sourceMappingURL=grok-build-inspect.js.map

package/dist/src/providers/grok-build-paths.js

@@ -0,0 +1,92 @@
+/**
+ * Grok Build home/path resolution — documented defaults with fail-closed overrides.
+ *
+ * Default `$GROK_HOME` is `~/.grok` (absolute after expand). Relative overrides,
+ * bare `~`, root-only paths, and null bytes are rejected.
+ *
+ * Distinct from Grok Bot (`grokbot` / `AIWG_GROKBOT_SKILLS_DIR`): never share
+ * roots or invent `~/.grokbot` / `.cursor` paths.
+ *
+ * @see https://docs.x.ai/build/settings
+ * @issue #2575
+ */
+import { homedir } from 'node:os';
+import * as path from 'node:path';
+export const GROK_HOME_ENV = 'GROK_HOME';
+export function isGrokFilesystemRoot(resolved, pathFlavor = path) {
+    return pathFlavor.parse(resolved).root === resolved;
+}
+function expandHomePrefix(raw, userHome = homedir()) {
+    if (raw === '~')
+        return raw;
+    if (raw.startsWith('~/'))
+        return path.join(userHome, raw.slice(2));
+    return raw;
+}
+/**
+ * Resolve Grok Build home directory.
+ * When unset, defaults to `~/.grok` (expanded). Explicit env must be absolute or `~/…`.
+ */
+export function resolveGrokHomeResult(env = process.env, userHome = homedir()) {
+    const raw = (env[GROK_HOME_ENV] || '').trim();
+    const fromEnv = Boolean(raw);
+    const candidate = fromEnv ? raw : path.join(userHome, '.grok');
+    const expanded = expandHomePrefix(candidate, userHome);
+    if (expanded === '~' || expanded.startsWith('~')) {
+        return {
+            ok: false,
+            reason: 'not-absolute',
+            message: `${GROK_HOME_ENV} must be an absolute path or ~/… (got '${raw || '(default)'}'). Bare '~' is rejected.`,
+        };
+    }
+    if (!path.isAbsolute(expanded)) {
+        return {
+            ok: false,
+            reason: 'not-absolute',
+            message: `${GROK_HOME_ENV} must be an absolute path (got '${raw}'). Relative overrides are rejected.`,
+        };
+    }
+    if (raw.includes('\0') || expanded.includes('\0')) {
+        return {
+            ok: false,
+            reason: 'traversal',
+            message: `${GROK_HOME_ENV} contains an invalid path character.`,
+        };
+    }
+    const resolved = path.resolve(expanded);
+    if (!resolved || isGrokFilesystemRoot(resolved)) {
+        return {
+            ok: false,
+            reason: 'root',
+            message: `${GROK_HOME_ENV} resolves to filesystem root; refuse to deploy there.`,
+        };
+    }
+    return { ok: true, path: resolved, source: fromEnv ? 'env' : 'default' };
+}
+export function resolveGrokHome(env = process.env, userHome = homedir()) {
+    const result = resolveGrokHomeResult(env, userHome);
+    return result.ok ? result.path : null;
+}
+export function grokBuildProjectPaths() {
+    return {
+        skills: '.grok/skills',
+        agents: '.grok/agents',
+        rules: '.grok/rules',
+        hooks: '.grok/hooks',
+        config: '.grok/config.toml',
+        agentsMd: 'AGENTS.md',
+    };
+}
+export function grokBuildUserPaths(grokHome) {
+    return {
+        skills: path.join(grokHome, 'skills'),
+        agents: path.join(grokHome, 'agents'),
+    };
+}
+export function grokHomeRemediation(env = process.env) {
+    const result = resolveGrokHomeResult(env);
+    if (result.ok)
+        return `${GROK_HOME_ENV}=${result.path} (${result.source})`;
+    return result.message;
+}
+//# sourceMappingURL=grok-build-paths.js.map

package/dist/src/providers/grokbot-paths.js

@@ -0,0 +1,103 @@
+/**
+ * Grok Bot skill-root resolution — fail-closed until explicitly configured.
+ *
+ * Unlike Hermes (HERMES_HOME with a documented default) or Pi
+ * (PI_CODING_AGENT_DIR with ~/.pi/agent fallback), Grok Bot's native skill
+ * filesystem root is not yet verified in AIWG. This module therefore:
+ *
+ *   1. Honors AIWG_GROKBOT_SKILLS_DIR when set to an absolute path
+ *   2. Rejects relative paths, `~`-only values that would invent a home layout,
+ *      and path segments that attempt traversal after resolution
+ *   3. Returns null when unset — callers MUST fail closed for user-scope writes
+ *
+ * Never invent ~/.grokbot or ~/.cursor as a fallback.
+ *
+ * @see docs/architecture/adr-grokbot-provider-target.md
+ * @issue #205 #207
+ */
+import { homedir } from 'node:os';
+import * as path from 'node:path';
+export const GROKBOT_SKILLS_DIR_ENV = 'AIWG_GROKBOT_SKILLS_DIR';
+/**
+ * Expand a leading `~/` against the operator home directory.
+ * Bare `~` is rejected — it would invent a home skill root.
+ */
+function expandHomePrefix(raw, userHome = homedir()) {
+    if (raw === '~')
+        return raw;
+    if (raw.startsWith('~/'))
+        return path.join(userHome, raw.slice(2));
+    return raw;
+}
+/**
+ * Validate and resolve the configured Grok Bot skills directory.
+ * Returns a structured result so CLI/doctor can print actionable remediation.
+ */
+export function resolveGrokbotSkillsDirResult(env = process.env, userHome = homedir()) {
+    const raw = (env[GROKBOT_SKILLS_DIR_ENV] || '').trim();
+    if (!raw) {
+        return {
+            ok: false,
+            reason: 'unset',
+            message: `Grok Bot user-scope skill root is not configured. Set ${GROKBOT_SKILLS_DIR_ENV} to the absolute path of the Grok Bot skills/workflows directory before using --scope user or --global. AIWG does not invent ~/.grokbot.`,
+        };
+    }
+    const expanded = expandHomePrefix(raw, userHome);
+    if (expanded === '~' || expanded.startsWith('~')) {
+        return {
+            ok: false,
+            reason: 'not-absolute',
+            message: `${GROKBOT_SKILLS_DIR_ENV} must be an absolute path (got '${raw}'). Bare '~' is rejected so AIWG never invents a Grok home layout.`,
+        };
+    }
+    if (!path.isAbsolute(expanded)) {
+        return {
+            ok: false,
+            reason: 'not-absolute',
+            message: `${GROKBOT_SKILLS_DIR_ENV} must be an absolute path (got '${raw}'). Relative values are rejected.`,
+        };
+    }
+    const resolved = path.resolve(expanded);
+    // After resolve(), reject any attempt to escape via .. that still looks suspicious
+    // relative to a normalized absolute root — path.resolve already collapses '..',
+    // so the main remaining check is that we did not start relative.
+    if (raw.includes('\0') || resolved.includes('\0')) {
+        return {
+            ok: false,
+            reason: 'traversal',
+            message: `${GROKBOT_SKILLS_DIR_ENV} contains an invalid path character.`,
+        };
+    }
+    // Defensive: if the pre-resolve value contained '..' segments that would
+    // escape a declared parent, surface traversal. Absolute resolve is fine;
+    // we still refuse paths that are only '..' noise without a real root.
+    const normalizedInput = path.normalize(expanded);
+    if (normalizedInput === path.sep || normalizedInput === '') {
+        return {
+            ok: false,
+            reason: 'empty',
+            message: `${GROKBOT_SKILLS_DIR_ENV} resolves to an empty or root-only path; refuse to deploy there.`,
+        };
+    }
+    return { ok: true, path: resolved, source: 'env' };
+}
+/** Absolute skills dir when configured; otherwise null (fail closed). */
+export function resolveGrokbotSkillsDir(env = process.env, userHome = homedir()) {
+    const result = resolveGrokbotSkillsDirResult(env, userHome);
+    return result.ok ? result.path : null;
+}
+/** True when user-scope skill writes are allowed. */
+export function isGrokbotUserScopeConfigured(env = process.env, userHome = homedir()) {
+    return resolveGrokbotSkillsDir(env, userHome) !== null;
+}
+/**
+ * User-facing remediation for missing/invalid Grok Bot skill root.
+ * Shared by `aiwg use`, doctor, and the provider writer.
+ */
+export function grokbotMissingRootRemediation(env = process.env, userHome = homedir()) {
+    const result = resolveGrokbotSkillsDirResult(env, userHome);
+    if (result.ok)
+        return '';
+    return result.message;
+}
+//# sourceMappingURL=grokbot-paths.js.map

package/dist/src/providers/provider-definitions.js

@@ -2,6 +2,7 @@ import { z } from 'zod';
 import { homedir } from 'os';
 import { join } from 'path';
 import { resolveHermesHomePath } from './hermes-home.js';
+import { resolveGrokbotSkillsDir } from './grokbot-paths.js';
 import { getProviderCapabilities, } from './capability-matrix.js';
 const ArtifactPathsSchema = z.object({
     agents: z.string().nullable(),
@@ -19,6 +20,8 @@ const ProviderDefinitionSchema = z.object({
         'cursor',
         'deepseek-harness',
         'factory',
+        'grokbot',
+        'grok-build',
         'hermes',
         'opencode',
         'openclaw',
@@ -36,7 +39,7 @@ const ProviderDefinitionSchema = z.object({
     upstream: z.object({
         source: z.string().url(),
         version: z.string().min(1),
-        revision: z.string().regex(/^[0-9a-f]{40}$/),
+        revision: z.string().regex(/^[0-9a-f]{40}$/).refine((value) => value !== '0'.repeat(40), { message: 'upstream.revision must be a real reviewed SHA, not all-zero' }),
         runtime: z.string().min(1),
         lastVerified: z.string().regex(/^\d{4}-\d{2}-\d{2}$/),
     }).optional(),
@@ -140,6 +143,8 @@ export const PROVIDER_IDS = [
     'cursor',
     'deepseek-harness',
     'factory',
+    'grokbot',
+    'grok-build',
     'hermes',
     'opencode',
     'openclaw',
@@ -204,6 +209,35 @@ const CONTEXT_CONTRACTS = {
         bootstrapTargets: ['AGENTS.md'], maxContextBytes: null, recommendedMaxLines: 150, nestedContext: true, support: 'supported',
         verification: { method: 'official Factory AGENTS.md discovery hierarchy', source: 'https://docs.factory.ai/cli/configuration/agents-md', lastVerified: VERIFIED_ON },
     },
+    grokbot: {
+        startupFiles: ['AGENTS.md'],
+        precedence: ['provider/system', 'project AGENTS.md when the host exposes it', 'explicit aiwg discover/show'],
+        loadMode: 'prose-directive', includeSyntax: null, configRegistration: null,
+        bootstrapTargets: ['AGENTS.md'], maxContextBytes: null, recommendedMaxLines: null, nestedContext: false, support: 'degraded',
+        verification: {
+            method: 'AIWG discover-first adapter contract; native Grok Bot startup/include path not yet verified — explicit-read guidance only',
+            source: 'docs/architecture/adr-grokbot-provider-target.md',
+            lastVerified: '2026-09-15',
+        },
+    },
+    'grok-build': {
+        // config.toml is configuration (MCP/plugins/permissions), not a startup/context file.
+        // Hierarchical instructions: AGENTS.md + .grok/rules/*.md, root-to-cwd, deeper wins.
+        startupFiles: ['AGENTS.md', '.grok/rules/*.md'],
+        precedence: [
+            'provider/system',
+            'global ~/.grok instruction sources',
+            'root-to-cwd AGENTS.md and .grok/rules/*.md (deeper files win on conflicts)',
+            '$GROK_HOME for user skills and user config',
+        ],
+        loadMode: 'prose-directive', includeSyntax: null, configRegistration: null,
+        bootstrapTargets: ['AGENTS.md'], maxContextBytes: null, recommendedMaxLines: null, nestedContext: true, support: 'supported',
+        verification: {
+            method: 'xAI project-rules docs (AGENTS.md + .grok/rules hierarchical discovery); grok inspect when installed',
+            source: 'https://docs.x.ai/build/features/project-rules',
+            lastVerified: '2026-09-20',
+        },
+    },
     hermes: {
         startupFiles: ['.hermes.md', 'AGENTS.md'], precedence: ['provider/system', '.hermes.md', 'AGENTS.md'],
         loadMode: 'prose-directive', includeSyntax: null, configRegistration: null,
@@ -556,6 +590,134 @@ const BUILT_IN_SEEDS = [
         },
         matrixRef: 'factory',
     },
+    {
+        id: 'grokbot',
+        displayName: 'Grok Bot',
+        aliases: [],
+        // #210: promoted stable — Linux PUW + security + migration + maintainer Linux-only waiver 2026-09-16.
+        status: 'stable',
+        builtIn: true,
+        surfaces: {
+            primary: 'grokbot',
+            compatibility: [],
+            precedence: ['AGENTS.md', 'AIWG_GROKBOT_SKILLS_DIR when configured'],
+            related: [],
+        },
+        // Do not treat xAI API keys or generic GROK_* model env as Grok Bot evidence.
+        detection: { env: [], process: [], capabilityId: 'grokbot' },
+        paths: {
+            deployTarget: 'mixed',
+            artifacts: {
+                agents: null,
+                commands: null,
+                // Native skill copies only when AIWG_GROKBOT_SKILLS_DIR is set at deploy time.
+                skills: null,
+                rules: null,
+                behaviors: null,
+            },
+            kernelSkills: null,
+            contextDiscovery: {
+                agents: '.agents/agents',
+                skills: null,
+                rules: null,
+                behaviors: null,
+            },
+            configFile: 'AGENTS.md',
+            contextFiles: { aiwgMd: true, agentsMd: true, claudeMdHook: false, hookFile: null, contextFile: 'AGENTS.md' },
+        },
+        smithPaths: {
+            agents: null,
+            commands: null,
+            skills: null,
+            rules: null,
+            fileExtension: '.md',
+            configFile: 'AGENTS.md',
+            aggregated: false,
+        },
+        // Skills root is env-gated (AIWG_GROKBOT_SKILLS_DIR). skillsBaseDir is a
+        // documentation sentinel only — deployer resolves via resolveGrokbotSkillsDir
+        // and never joins ~/grokbot-skills.
+        skillNamespace: {
+            deploymentGroup: 'deep-recursion',
+            pathType: 'home-dir',
+            skillsBaseDir: 'AIWG_GROKBOT_SKILLS_DIR',
+            subdirLayout: true,
+        },
+        adapters: {
+            agentFormat: 'agents-md',
+            hookBridge: null,
+            mcpInjection: null,
+            contextAggregation: 'agents-md',
+            ruleFormat: 'agents-md-section',
+        },
+        matrixRef: 'grokbot',
+    },
+    {
+        id: 'grok-build',
+        displayName: 'Grok Build',
+        aliases: [],
+        status: 'experimental',
+        builtIn: true,
+        upstream: {
+            source: 'https://github.com/xai-org/grok-build',
+            version: '1.0.38',
+            // Reviewed public tree (docs + inspect schema), not an all-zero placeholder.
+            revision: '4247f661689354b831191f11eeeac8424993fe3d',
+            runtime: 'Grok Build CLI',
+            lastVerified: '2026-09-20',
+        },
+        surfaces: {
+            primary: 'grok-build',
+            compatibility: [],
+            // Agents/rules native writers deferred #2577; host still discovers those dirs.
+            precedence: ['AGENTS.md', '.grok/skills/', '.grok/rules/ (host; AIWG writer deferred #2577)', '.grok/config.toml (config only)', '$GROK_HOME'],
+            related: [],
+        },
+        detection: { env: ['GROK_HOME'], process: ['grok'], capabilityId: 'grok-build' },
+        paths: {
+            deployTarget: 'mixed',
+            artifacts: {
+                // Wave 1 writes skills + AGENTS.md only; agents/rules indexed until #2577.
+                agents: null,
+                commands: null,
+                skills: '.grok/skills',
+                rules: null,
+                behaviors: null,
+            },
+            kernelSkills: '.grok/skills',
+            contextDiscovery: {
+                agents: '.grok/agents',
+                skills: '.grok/skills',
+                rules: '.grok/rules',
+                behaviors: null,
+            },
+            configFile: '.grok/config.toml',
+            contextFiles: { aiwgMd: true, agentsMd: true, claudeMdHook: false, hookFile: null, contextFile: 'AGENTS.md' },
+        },
+        smithPaths: {
+            agents: null,
+            commands: null,
+            skills: '.grok/skills',
+            rules: null,
+            fileExtension: '.md',
+            configFile: '.grok/config.toml',
+            aggregated: false,
+        },
+        skillNamespace: {
+            deploymentGroup: 'deep-recursion',
+            pathType: 'project',
+            skillsBaseDir: '.grok/skills',
+            subdirLayout: true,
+        },
+        adapters: {
+            agentFormat: 'agents-md',
+            hookBridge: null,
+            mcpInjection: null,
+            contextAggregation: 'agents-md',
+            ruleFormat: 'agents-md-section',
+        },
+        matrixRef: 'grok-build',
+    },
     {
         id: 'hermes',
         aliases: [],
@@ -1137,10 +1299,18 @@ export function getProviderArtifactPathStrings(provider) {
     const definition = getProviderDefinition(provider);
     if (!definition)
         return undefined;
+    const normalized = normalizeProviderDefinitionId(provider);
+    // Grok Bot skills are env-gated (AIWG_GROKBOT_SKILLS_DIR). Resolve dynamically so
+    // deploy counting / user-scope same-path inventory can see the configured root
+    // without inventing ~/.grokbot (#210).
+    let skills = expandProviderHomePath(definition.paths.artifacts.skills);
+    if (normalized === 'grokbot' && !skills) {
+        skills = resolveGrokbotSkillsDir() ?? '';
+    }
     return {
         agents: expandProviderHomePath(definition.paths.artifacts.agents),
         commands: expandProviderHomePath(definition.paths.artifacts.commands),
-        skills: expandProviderHomePath(definition.paths.artifacts.skills),
+        skills,
         rules: expandProviderHomePath(definition.paths.artifacts.rules),
         behaviors: expandProviderHomePath(definition.paths.artifacts.behaviors),
     };

package/dist/src/providers/provider-inventory.js

@@ -12,6 +12,8 @@ const PROVIDER_EXECUTABLES = {
     cursor: ['cursor'],
     'deepseek-harness': ['dsh'],
     factory: ['droid'],
+    // Grok Bot has no verified CLI executable name; omit rather than invent.
+    'grok-build': ['grok'],
     hermes: ['hermes'],
     opencode: ['opencode'],
     openclaw: ['openclaw'],