@aiwg/cli 2026.9.15 → 2026.9.17

package/dist/src/sessions/adapters/grokbot.js

@@ -0,0 +1,49 @@
+/**
+ * Grok Bot session adapter — manual-export only until product evidence exists
+ * for a native session filesystem or API locator.
+ *
+ * Auto-discover is unsupported and must never scrape invented ~/.grokbot,
+ * Cursor session paths, or other unverified roots.
+ *
+ * Authorized imports reuse the AIWG generic session interchange format so
+ * operators can supply an explicit export without inventing a Grok schema.
+ *
+ * @see docs/providers/grokbot-sessions.md
+ * @issue #215
+ */
+import { SessionContractError, } from '../contracts.js';
+import { GenericSessionInterchangeAdapter, } from './generic.js';
+export const GROKBOT_ADAPTER_VERSION = '1.0.0';
+export const GROKBOT_EXPORT_SCHEMA_VERSION = '1.0.0';
+export const GROKBOT_LOCATOR_CLASS = 'manual-export';
+export class GrokbotSessionAdapter {
+    provider = 'grokbot';
+    adapterVersion = GROKBOT_ADAPTER_VERSION;
+    disposition = 'manual-only';
+    supportedOperations = ['inspect', 'stream'];
+    acquisitionModes = ['manual-export'];
+    interchange;
+    constructor(limits) {
+        this.interchange = new GenericSessionInterchangeAdapter(limits);
+    }
+    async *discover(_scope) {
+        throw new SessionContractError('UNSUPPORTED_OPERATION', 'Grok Bot session auto-discover is unsupported until a verified native locator exists; '
+            + 'select an authorized manual export explicitly. AIWG does not scrape ~/.grokbot, '
+            + '~/grokbot-skills, or Cursor session paths.');
+    }
+    async inspect(source) {
+        this.assertManualExport(source);
+        return this.interchange.inspect(source);
+    }
+    async *stream(source, cursor) {
+        this.assertManualExport(source);
+        yield* this.interchange.stream(source, cursor);
+    }
+    assertManualExport(source) {
+        if (source.locatorClass !== GROKBOT_LOCATOR_CLASS) {
+            throw new SessionContractError('UNSUPPORTED_OPERATION', `Grok Bot supports only locatorClass "${GROKBOT_LOCATOR_CLASS}" until native session evidence exists `
+                + `(got "${source.locatorClass}"). Do not reuse Cursor session locators.`);
+        }
+    }
+}
+//# sourceMappingURL=grokbot.js.map

package/dist/src/sessions/adapters/hermes.js

@@ -4,23 +4,31 @@ import { readBoundedJsonLines, streamBoundedJsonLines, } from '../readers.js';
 export const HERMES_ADAPTER_VERSION = '1.0.0';
 export const HERMES_EXPORT_SCHEMA_VERSION = '1.0.0';
 export const HERMES_NATIVE_SCHEMA_VERSION = '23.0.0';
+const sqliteBoolean = z.union([z.boolean(), z.literal(0), z.literal(1)])
+    .transform((value) => Boolean(value));
+function nullableOptional(schema) {
+    return z.preprocess((value) => value === null ? undefined : value, schema.optional());
+}
 const MessageSchema = z.object({
     id: z.union([z.string(), z.number()]),
     role: z.string().min(1),
     content: z.unknown().optional(),
-    tool_call_id: z.string().optional(),
+    tool_call_id: nullableOptional(z.string()),
     tool_calls: z.unknown().optional(),
-    tool_name: z.string().optional(),
+    tool_name: nullableOptional(z.string()),
     timestamp: z.number().optional(),
-    token_count: z.number().optional(),
-    finish_reason: z.string().optional(),
-    reasoning: z.string().optional(),
-    reasoning_content: z.string().optional(),
+    token_count: nullableOptional(z.number()),
+    finish_reason: nullableOptional(z.string()),
+    reasoning: nullableOptional(z.string()),
+    reasoning_content: nullableOptional(z.string()),
     reasoning_details: z.unknown().optional(),
     codex_reasoning_items: z.unknown().optional(),
 }).passthrough();
 const ExportSchema = z.object({
-    schemaVersion: z.union([z.string(), z.number()]),
+    // Hermes CLI exports currently omit a schema marker. They use the same
+    // schema-23 record shape that the adapter already validates; explicit
+    // markers still pass through the major-version gate below.
+    schemaVersion: z.union([z.string(), z.number()]).default(HERMES_NATIVE_SCHEMA_VERSION),
     id: z.string().min(1),
     source: z.string().min(1),
     user_id: z.string().nullable().optional(),
@@ -31,8 +39,8 @@ const ExportSchema = z.object({
     started_at: z.number(),
     ended_at: z.number().nullable().optional(),
     end_reason: z.string().nullable().optional(),
-    archived: z.boolean().optional(),
-    inactive: z.boolean().optional(),
+    archived: sqliteBoolean.optional(),
+    inactive: sqliteBoolean.optional(),
     cwd: z.string().nullable().optional(),
     git_branch: z.string().nullable().optional(),
     routing_key: z.string().nullable().optional(),

package/dist/src/sessions/adapters/opencode.js

@@ -343,7 +343,18 @@ function normalizeMessage(message, sequence, locatorClass, common) {
                 toolCallId: part.callID,
                 toolState: part.state,
                 attachment: part.type === 'file'
-                    ? { mime: part.mime, filename: part.filename, urlPresent: Boolean(part.url) }
+                    ? {
+                        mime: part.mime,
+                        filename: part.filename,
+                        displayName: part.filename,
+                        urlPresent: Boolean(part.url),
+                        // Preserve only locally recoverable byte locators. Remote URLs
+                        // remain presence-only metadata and are never fetched by export.
+                        dataBytes: part.url?.startsWith('data:')
+                            ? [...Buffer.from(part.url.slice(part.url.indexOf(',') + 1), part.url.includes(';base64,') ? 'base64' : 'utf8')]
+                            : undefined,
+                        fileUrl: part.url?.startsWith('file:') ? part.url : undefined,
+                    }
                     : undefined,
                 opaqueContent: !['text', 'reasoning', 'tool', 'file'].includes(part.type),
                 unknownFields: unknownFields(part, PART_KEYS),

package/dist/src/sessions/contracts.js

@@ -3,7 +3,7 @@ import { z } from 'zod';
 export const SESSION_CONTRACT_VERSION = '1.0.0';
 export const SESSION_PROVIDER_IDS = [
     'claude', 'codex', 'copilot', 'cursor', 'factory', 'hermes',
-    'opencode', 'openclaw', 'openhuman', 'pi', 'omp', 'deepseek-harness', 'warp', 'devin-desktop', 'generic',
+    'opencode', 'openclaw', 'openhuman', 'grokbot', 'pi', 'omp', 'deepseek-harness', 'warp', 'devin-desktop', 'generic',
 ];
 export const SessionProviderIdSchema = z.enum(SESSION_PROVIDER_IDS);
 export const SESSION_PROVIDER_ALIASES = Object.freeze({

package/dist/src/sessions/export-plan.js

@@ -6,17 +6,68 @@
  * silently exporting drifted data.
  */
 import { createHash } from 'node:crypto';
+import { lstatSync, readFileSync, realpathSync } from 'node:fs';
+import { resolve, sep } from 'node:path';
+import { fileURLToPath } from 'node:url';
 import { SessionContractError } from './contracts.js';
 import { buildSessionAiwgFortemiIndexExport, SESSION_EXPORT_INDEX_SCHEMA_VERSION, } from './fortemi-export-mapping.js';
 import { discoverSessionOutputCandidates } from './output-lineage.js';
 import { FilesystemDerivedOutputIndex } from './output-registration.js';
-export const SESSION_EXPORT_PLAN_SCHEMA_VERSION = '1.0.0';
+export const SESSION_EXPORT_PLAN_SCHEMA_VERSION = '1.1.0';
 function eventDigestSummary(events) {
     const hash = createHash('sha256');
     for (const event of events)
         hash.update(event.digest);
     return `sha256:${hash.digest('hex')}`;
 }
+function sha256(value) {
+    return `sha256:${createHash('sha256').update(value).digest('hex')}`;
+}
+function sessionMetadataDigest(session, catalogTags) {
+    return sha256(JSON.stringify({ session, catalogTags: [...catalogTags].sort() }));
+}
+function localEventAttachment(event, projectRoot) {
+    const nativeEnvelope = Object.entries(event.extensions)
+        .find(([key, value]) => key.startsWith('native.') && value && typeof value === 'object')?.[1];
+    const attachment = event.extensions.attachment ?? nativeEnvelope?.attachment;
+    if (!attachment || typeof attachment !== 'object')
+        return null;
+    const value = attachment;
+    const filename = typeof value.displayName === 'string' && value.displayName.length > 0
+        ? value.displayName
+        : typeof value.filename === 'string' && value.filename.length > 0 && !value.filename.startsWith('[REDACTED:')
+            ? value.filename
+            : `${event.eventId}.bin`;
+    const mediaType = typeof value.mime === 'string' && value.mime.length > 0 ? value.mime : 'application/octet-stream';
+    if (Array.isArray(value.dataBytes)
+        && value.dataBytes.every((item) => Number.isInteger(item) && Number(item) >= 0 && Number(item) <= 255)) {
+        return { filename, mediaType, bytes: Uint8Array.from(value.dataBytes) };
+    }
+    if (typeof value.dataUrl === 'string') {
+        const match = /^data:([^;,]*)(;base64)?,(.*)$/s.exec(value.dataUrl);
+        if (!match)
+            throw new SessionContractError('MALFORMED_SOURCE', `invalid data URL attachment: ${event.eventId}`);
+        const bytes = match[2]
+            ? Buffer.from(match[3], 'base64')
+            : Buffer.from(decodeURIComponent(match[3]), 'utf8');
+        return { filename, mediaType: match[1] || mediaType, bytes };
+    }
+    if (typeof value.fileUrl === 'string') {
+        if (!projectRoot)
+            throw new SessionContractError('SOURCE_NOT_AUTHORIZED', 'project root is required for file attachments');
+        const root = realpathSync(projectRoot);
+        const candidate = fileURLToPath(value.fileUrl);
+        const stat = lstatSync(candidate);
+        if (stat.isSymbolicLink())
+            throw new SessionContractError('SOURCE_NOT_AUTHORIZED', `attachment is a symbolic link: ${event.eventId}`);
+        const actual = realpathSync(candidate);
+        if (actual !== root && !actual.startsWith(`${root}${sep}`)) {
+            throw new SessionContractError('SOURCE_OUTSIDE_ALLOWED_ROOT', `attachment resolves outside the project: ${event.eventId}`);
+        }
+        return { filename, mediaType, bytes: readFileSync(actual) };
+    }
+    return null;
+}
 /**
  * Selects the requested sessions from the repository and builds a plan.
  * Rejects an empty or duplicate selection, and any session id the
@@ -40,6 +91,7 @@ export function buildSessionExportPlan(repository, options) {
             throw new SessionContractError('SOURCE_NOT_AUTHORIZED', `session is unknown or not authorized for this workspace: ${sessionId}`);
         }
         const events = repository.listEvents(sessionId, options.workspaceId);
+        const catalogTags = repository.listTags(sessionId, options.workspaceId);
         sessions.push(session);
         eventsBySessionId.set(sessionId, events);
         entries.push({
@@ -48,6 +100,8 @@ export function buildSessionExportPlan(repository, options) {
             provider: session.provider,
             sourceId: session.sourceId,
             sourceDigest: session.sourceDigest,
+            metadataDigest: sessionMetadataDigest(session, catalogTags),
+            catalogTags,
             eventCount: events.length,
             eventDigestSummary: eventDigestSummary(events),
         });
@@ -61,11 +115,28 @@ export function buildSessionExportPlan(repository, options) {
         registrationId: candidate.registration.registrationId,
         outputLocator: candidate.registration.output.locator,
         outputDigest: candidate.registration.output.digest,
+        outputByteLength: candidate.registration.output.byteLength,
         mediaType: candidate.registration.output.mediaType,
         lineage: candidate.lineage,
         matchReason: candidate.matchReason,
     }));
-    const index = buildSessionAiwgFortemiIndexExport(options.workspaceId, sessions, eventsBySessionId, outputs);
+    const attachments = [];
+    for (const session of sessions) {
+        for (const event of eventsBySessionId.get(session.sessionId) ?? []) {
+            const attachment = localEventAttachment(event, options.projectRoot);
+            if (attachment)
+                attachments.push({
+                    sessionId: session.sessionId,
+                    eventId: event.eventId,
+                    filename: attachment.filename,
+                    mediaType: attachment.mediaType,
+                    digest: sha256(attachment.bytes),
+                    byteLength: attachment.bytes.length,
+                });
+        }
+    }
+    const catalogTagsBySessionId = new Map(entries.map((entry) => [entry.sessionId, entry.catalogTags]));
+    const index = buildSessionAiwgFortemiIndexExport(options.workspaceId, sessions, eventsBySessionId, outputs, catalogTagsBySessionId);
     const plan = {
         schemaVersion: SESSION_EXPORT_PLAN_SCHEMA_VERSION,
         indexSchemaVersion: SESSION_EXPORT_INDEX_SCHEMA_VERSION,
@@ -73,10 +144,12 @@ export function buildSessionExportPlan(repository, options) {
         workspaceId: options.workspaceId,
         sessions: entries,
         outputs,
+        attachments,
         totals: {
             sessionCount: sessions.length,
             eventCount: entries.reduce((sum, entry) => sum + entry.eventCount, 0),
             outputCount: outputs.length,
+            attachmentCount: attachments.length,
             recordCount: index.items.length,
         },
         preview: {
@@ -94,9 +167,10 @@ export function buildSessionExportPlan(repository, options) {
  * acceptance criteria: "Plans reject stale sources ... changed analysis
  * bytes").
  */
-export function reverifySessionExportPlan(repository, plan) {
+export function reverifySessionExportPlan(repository, plan, options = {}) {
     const sessions = [];
     const eventsBySessionId = new Map();
+    const catalogTagsBySessionId = new Map();
     for (const entry of plan.sessions) {
         const session = repository.getSession(entry.sessionId, plan.workspaceId);
         if (!session) {
@@ -105,13 +179,65 @@ export function reverifySessionExportPlan(repository, plan) {
         if (session.sourceDigest !== entry.sourceDigest) {
             throw new SessionContractError('SCHEMA_DRIFT', `session source changed since the plan was generated: ${entry.sessionId}`);
         }
+        const catalogTags = repository.listTags(entry.sessionId, plan.workspaceId);
+        if (entry.metadataDigest !== sessionMetadataDigest(session, catalogTags)
+            || JSON.stringify(entry.catalogTags) !== JSON.stringify(catalogTags)) {
+            throw new SessionContractError('SCHEMA_DRIFT', `session metadata or tags changed since the plan was generated: ${entry.sessionId}`);
+        }
         const events = repository.listEvents(entry.sessionId, plan.workspaceId);
         if (events.length !== entry.eventCount || eventDigestSummary(events) !== entry.eventDigestSummary) {
             throw new SessionContractError('SCHEMA_DRIFT', `session events changed since the plan was generated: ${entry.sessionId}`);
         }
         sessions.push(session);
         eventsBySessionId.set(entry.sessionId, events);
+        catalogTagsBySessionId.set(entry.sessionId, catalogTags);
+    }
+    const outputBytesByRegistrationId = new Map();
+    if (plan.outputs.length > 0) {
+        if (!options.projectRoot) {
+            throw new SessionContractError('SOURCE_NOT_AUTHORIZED', 'project root is required to verify planned outputs');
+        }
+        const root = realpathSync(options.projectRoot);
+        for (const output of plan.outputs) {
+            const candidate = resolve(root, output.outputLocator);
+            let stat;
+            try {
+                stat = lstatSync(candidate);
+            }
+            catch {
+                throw new SessionContractError('SCHEMA_DRIFT', `registered output is missing since the plan was generated: ${output.outputLocator}`);
+            }
+            if (stat.isSymbolicLink()) {
+                throw new SessionContractError('SOURCE_NOT_AUTHORIZED', `planned output is a symbolic link: ${output.outputLocator}`);
+            }
+            if (!stat.isFile()) {
+                throw new SessionContractError('SCHEMA_DRIFT', `planned output is no longer a regular file: ${output.outputLocator}`);
+            }
+            if (stat.size !== output.outputByteLength) {
+                throw new SessionContractError('SCHEMA_DRIFT', `registered output changed since the plan was generated: ${output.outputLocator}`);
+            }
+            const actual = realpathSync(candidate);
+            if (actual !== root && !actual.startsWith(`${root}${sep}`)) {
+                throw new SessionContractError('SOURCE_OUTSIDE_ALLOWED_ROOT', 'planned output resolves outside the project');
+            }
+            const bytes = readFileSync(actual);
+            if (sha256(bytes) !== output.outputDigest) {
+                throw new SessionContractError('SCHEMA_DRIFT', `registered output changed since the plan was generated: ${output.outputLocator}`);
+            }
+            outputBytesByRegistrationId.set(output.registrationId, bytes);
+        }
+    }
+    const attachmentBytesByEventId = new Map();
+    for (const planned of plan.attachments ?? []) {
+        const event = eventsBySessionId.get(planned.sessionId)?.find((candidate) => candidate.eventId === planned.eventId);
+        const attachment = event ? localEventAttachment(event, options.projectRoot) : null;
+        if (!attachment || attachment.bytes.length !== planned.byteLength || sha256(attachment.bytes) !== planned.digest) {
+            throw new SessionContractError('SCHEMA_DRIFT', `session attachment changed since the plan was generated: ${planned.eventId}`);
+        }
+        attachmentBytesByEventId.set(planned.eventId, attachment.bytes);
     }
-    return { sessions, eventsBySessionId };
+    return {
+        sessions, eventsBySessionId, catalogTagsBySessionId, outputBytesByRegistrationId, attachmentBytesByEventId,
+    };
 }
 //# sourceMappingURL=export-plan.js.map

package/dist/src/sessions/fortemi-export-mapping.js

@@ -17,7 +17,7 @@ export function sessionRecordLocator(session) {
 export function sessionEventRecordLocator(session, event) {
     return `${sessionRecordLocator(session)}/event/${event.eventId}`;
 }
-export function sessionToAiwgFortemiRecord(session) {
+export function sessionToAiwgFortemiRecord(session, catalogTags = []) {
     const locator = sessionRecordLocator(session);
     const updatedAt = session.updatedAt ?? session.startedAt ?? new Date(0).toISOString();
     return {
@@ -39,7 +39,11 @@ export function sessionToAiwgFortemiRecord(session) {
         title: session.intent.title ?? `${session.provider} session ${session.nativeSessionId}`,
         text: session.intent.summary ?? `AIWG session ${session.sessionId} (${session.provider}, ${session.lifecycle})`,
         facets: {},
-        tags: [tag('provider', session.provider), tag('lifecycle', session.lifecycle)],
+        tags: [
+            tag('provider', session.provider),
+            tag('lifecycle', session.lifecycle),
+            ...catalogTags.map((value) => tag('catalogTag', value)),
+        ],
         concepts: [],
         relationships: [],
         provenance: [{
@@ -174,7 +178,7 @@ export function sessionOutputToAiwgFortemiRecord(session, output) {
         },
         title: `registered output for ${session.sessionId}`,
         text: `${output.mediaType} output registered at ${output.outputLocator} (${output.matchReason}); `
-            + 'bytes not embedded -- reference and digest only.',
+            + (output.bytesEmbedded ? 'original bytes embedded as a native attachment.' : 'bytes not embedded -- reference and digest only.'),
         facets: {},
         tags: [tag('mediaType', output.mediaType), tag('lineage', 'registered')],
         concepts: [],
@@ -206,7 +210,7 @@ export function sessionOutputToAiwgFortemiRecord(session, output) {
                     registrationId: output.registrationId,
                     outputLocator: output.outputLocator,
                     matchReason: output.matchReason,
-                    bytesEmbedded: false,
+                    bytesEmbedded: output.bytesEmbedded === true,
                 },
             }],
         privacy: { classification: 'private', pii: false },
@@ -271,11 +275,11 @@ function exportManifestRecord(repoRef, generatedAt) {
  * session catalog's workspace id, not a git repo -- the field is repurposed
  * honestly rather than left to imply something untrue).
  */
-export function buildSessionAiwgFortemiIndexExport(repoRef, sessions, eventsBySessionId, outputs = []) {
+export function buildSessionAiwgFortemiIndexExport(repoRef, sessions, eventsBySessionId, outputs = [], catalogTagsBySessionId = new Map()) {
     const generatedAt = new Date().toISOString();
     const items = [exportManifestRecord(repoRef, generatedAt)];
     for (const session of sessions) {
-        items.push(sessionToAiwgFortemiRecord(session));
+        items.push(sessionToAiwgFortemiRecord(session, catalogTagsBySessionId.get(session.sessionId) ?? []));
         for (const event of eventsBySessionId.get(session.sessionId) ?? []) {
             items.push(sessionEventToAiwgFortemiRecord(session, event));
         }

package/dist/src/sessions/fortemi-shard-blobs.js

@@ -0,0 +1,78 @@
+import { computeBlobHash, packTarGz, sha256Hex, unpackTarGz, validateFullV1ShardArchive, } from '@fortemi/core';
+function jsonLines(values) {
+    return new TextEncoder().encode(`${values.map((value) => JSON.stringify(value)).join('\n')}\n`);
+}
+export async function embedAttachmentsInFullV1Shard(archive, attachments) {
+    if (attachments.length === 0)
+        return archive;
+    const files = unpackTarGz(archive);
+    const notesBytes = files.get('notes.jsonl');
+    const manifestBytes = files.get('manifest.json');
+    if (!notesBytes || !manifestBytes)
+        throw new Error('full-v1 shard is missing notes.jsonl or manifest.json');
+    const notes = new TextDecoder().decode(notesBytes).split('\n').filter(Boolean)
+        .map((line) => JSON.parse(line));
+    const byRecordId = new Map(notes.map((note) => [note.metadata?.aiwg_source?.record_id, note]));
+    for (const entry of attachments) {
+        const note = byRecordId.get(entry.recordId);
+        if (!note)
+            throw new Error(`cannot attach bytes: shard record is missing: ${entry.recordId}`);
+        const checksum = computeBlobHash(entry.bytes);
+        note.attachments ??= [];
+        note.attachments.push({
+            extracted_text: null,
+            extraction_status: 'deferred',
+            reason: 'no_extracted_text',
+            attachment: {
+                id: entry.attachmentId,
+                path: entry.filename,
+                mime: entry.mimeType,
+                checksum,
+                bytes: entry.bytes.length,
+            },
+        });
+        files.set(`blobs/${checksum.slice('blake3:'.length)}`, entry.bytes);
+    }
+    const updatedNotes = jsonLines(notes);
+    files.set('notes.jsonl', updatedNotes);
+    const manifest = JSON.parse(new TextDecoder().decode(manifestBytes));
+    manifest.checksums['notes.jsonl'] = await sha256Hex(updatedNotes);
+    files.set('manifest.json', new TextEncoder().encode(JSON.stringify(manifest, null, 2)));
+    const packed = packTarGz(files);
+    const validation = await validateFullV1ShardArchive(packed);
+    if (!validation.valid)
+        throw new Error(`embedded shard failed validation: ${validation.errors.join('; ')}`);
+    return packed;
+}
+export function recoverEmbeddedAttachments(archive) {
+    const files = unpackTarGz(archive);
+    const notesBytes = files.get('notes.jsonl');
+    if (!notesBytes)
+        return [];
+    const notes = new TextDecoder().decode(notesBytes).split('\n').filter(Boolean)
+        .map((line) => JSON.parse(line));
+    const recovered = [];
+    for (const note of notes) {
+        const recordId = note.metadata?.aiwg_source?.record_id;
+        if (!recordId)
+            continue;
+        for (const projection of note.attachments ?? []) {
+            const ref = projection.attachment;
+            const bytes = files.get(`blobs/${ref.checksum.replace(/^blake3:/, '')}`);
+            if (!bytes)
+                continue;
+            if (bytes.length !== ref.bytes || computeBlobHash(bytes) !== ref.checksum) {
+                throw new Error(`embedded attachment failed size/hash verification: ${ref.id}`);
+            }
+            recovered.push({
+                recordId,
+                attachmentId: ref.id,
+                filename: ref.path,
+                mimeType: ref.mime,
+                bytes,
+            });
+        }
+    }
+    return recovered;
+}
+//# sourceMappingURL=fortemi-shard-blobs.js.map

package/dist/src/sessions/index.js

@@ -9,6 +9,7 @@ export * from './optional-backends.js';
 export * from './knowledge-shard.js';
 export * from './fortemi-export-mapping.js';
 export * from './fortemi-shard-recovery.js';
+export * from './fortemi-shard-blobs.js';
 export * from './output-lineage.js';
 export * from './export-plan.js';
 export * from './candidates.js';
@@ -32,6 +33,7 @@ export * from './adapters/hermes.js';
 export * from './adapters/opencode.js';
 export * from './adapters/openclaw.js';
 export * from './adapters/openhuman.js';
+export * from './adapters/grokbot.js';
 export * from './adapters/pi.js';
 export * from './adapters/deepseek-harness.js';
 export * from './adapters/warp.js';

package/dist/src/sessions/workspace-discovery.js

@@ -16,7 +16,7 @@ import { redactSourceLocator } from './discovery.js';
 import { fingerprintSourceFile } from './readers.js';
 export const DISCOVERY_MANIFEST_VERSION = '1.0.0';
 const MANUAL_EXPORT_PROVIDERS = new Set([
-    'copilot', 'hermes', 'opencode', 'openclaw', 'openhuman',
+    'copilot', 'hermes', 'opencode', 'openclaw', 'openhuman', 'grokbot',
     'warp', 'devin-desktop', 'generic',
 ]);
 export async function discoverWorkspaceHistories(options) {

package/dist/src/skills/deployer.js

@@ -16,6 +16,7 @@ import { AGENT_SKILLS_SIDECAR_SCHEMA, AIWG_SKILL_CONTROL_FIELDS, createAgentSkil
 import { getImportedAgentSkill } from './importer.js';
 import { validateAgentSkillContent } from './validator.js';
 import { resolveHermesHomePath } from '../providers/hermes-home.js';
+import { GROKBOT_SKILLS_DIR_ENV, grokbotMissingRootRemediation, resolveGrokbotSkillsDir, } from '../providers/grokbot-paths.js';
 export const AGENT_SKILL_MANAGED_MARKER = '.aiwg-managed';
 export const AGENT_SKILL_DEPLOYMENT_SIDECAR = '.aiwg-agent-skill.json';
 const MARKER_CONTENT = 'aiwg-agent-skill-v1\n';
@@ -78,6 +79,22 @@ function resolvePolicy(target, options) {
             appendToDescription = namespace.appendToDescription;
             reasons.push('applies the Factory description guidance before strict validation');
             break;
+        case 'grokbot': {
+            // Fail closed: never invent ~/grokbot-skills or ~/.grokbot.
+            const configured = resolveGrokbotSkillsDir(process.env);
+            if (!configured) {
+                root = '';
+                status = 'unsupported';
+                supported = false;
+                reasons.push(grokbotMissingRootRemediation(process.env));
+                warnings.push(`Agent Skills deploy for grokbot requires absolute ${GROKBOT_SKILLS_DIR_ENV}; no filesystem root was invented`);
+            }
+            else {
+                root = configured;
+                reasons.push(`uses the operator-configured ${GROKBOT_SKILLS_DIR_ENV} skills root with strict managed ownership markers`);
+            }
+            break;
+        }
         case 'hermes':
             if (options.homeDir === undefined) {
                 root = resolveHermesHomePath('skills');

package/dist/src/smiths/skillsmith/collision-detector.js

@@ -36,6 +36,7 @@ const PLATFORM_BUILTINS = {
     'opencode': ['help', 'run'],
     'warp': ['help', 'settings'],
     'hermes': [],
+    'grokbot': [],
     'openclaw': [],
     'openhuman': [],
     'factory': [],

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aiwg/cli",
-  "version": "2026.9.15",
+  "version": "2026.9.17",
   "description": "Lightweight AIWG CLI for signed, versioned web-backed resources.",
   "type": "module",
   "license": "MIT",

package/schemas/dataset/conformance-receipt.v1.schema.json

@@ -15,7 +15,7 @@
   "$defs": {
     "version": { "type": "string", "pattern": "^[0-9]+\\.[0-9]+\\.[0-9]+(?:[-+][0-9A-Za-z.-]+)?$" }, "digest": { "type": "string", "pattern": "^sha256:[0-9a-f]{64}$" }, "time": { "type": "string", "format": "date-time", "pattern": "Z$" },
     "digestMap": { "type": "object", "minProperties": 1, "additionalProperties": { "$ref": "#/$defs/digest" } },
-    "bindings": { "type": "object", "additionalProperties": false, "required": ["aiwgCommit", "packageDigests", "schemaDigests", "fixtureDigest", "configurationDigest"], "properties": { "aiwgCommit": { "type": "string", "pattern": "^(?:[0-9a-f]{40}|sha256:[0-9a-f]{64})$" }, "fortemiCommit": { "type": "string", "pattern": "^[0-9a-f]{40}$" }, "packageDigests": { "$ref": "#/$defs/digestMap" }, "schemaDigests": { "$ref": "#/$defs/digestMap" }, "fixtureDigest": { "$ref": "#/$defs/digest" }, "descriptorDigest": { "$ref": "#/$defs/digest" }, "configurationDigest": { "$ref": "#/$defs/digest" } } },
+    "bindings": { "type": "object", "additionalProperties": false, "required": ["aiwgCommit", "packageDigests", "schemaDigests", "fixtureDigest", "configurationDigest"], "properties": { "aiwgCommit": { "type": "string", "pattern": "^(?:[0-9a-f]{40}|sha256:[0-9a-f]{64})$" }, "fortemiCommit": { "type": "string", "pattern": "^[0-9a-f]{40}$" }, "fortemiServerCommit": { "type": "string", "pattern": "^[0-9a-f]{40}$" }, "packageDigests": { "$ref": "#/$defs/digestMap" }, "schemaDigests": { "$ref": "#/$defs/digestMap" }, "fixtureDigest": { "$ref": "#/$defs/digest" }, "descriptorDigest": { "$ref": "#/$defs/digest" }, "configurationDigest": { "$ref": "#/$defs/digest" } } },
     "evidence": { "type": "object", "additionalProperties": false, "required": ["kind", "reference", "digest"], "properties": { "kind": { "enum": ["fixture", "real-source", "cross-repo", "live-qualification"] }, "reference": { "type": "string", "minLength": 1 }, "digest": { "$ref": "#/$defs/digest" } } },
     "result": { "type": "object", "additionalProperties": false, "required": ["cellId", "status", "evidence", "observed"], "properties": { "cellId": { "type": "string", "minLength": 1 }, "status": { "enum": ["passed", "failed", "pending"] }, "diagnostic": { "type": "string", "minLength": 1 }, "evidence": { "type": "array", "items": { "$ref": "#/$defs/evidence" } }, "observed": { "type": "object", "additionalProperties": false, "required": ["networkAttempts"], "properties": { "records": { "type": "integer", "minimum": 0 }, "bytes": { "type": "integer", "minimum": 0 }, "durationMs": { "type": "integer", "minimum": 0 }, "networkAttempts": { "type": "integer", "minimum": 0 } } } } }
   }

package/tools/agents/deploy-agents.mjs

@@ -20,7 +20,7 @@
  *   --rules-only             Deploy only rules (skip agents)
  *   --dry-run                Show what would be deployed without writing
  *   --force                  Overwrite existing files
- *   --provider <name>        Target provider: antigravity (agy), claude (default), openai, codex, cursor, opencode, copilot, factory, pi, omp, deepseek-harness (dsh), warp, devin, hermes, or openclaw
+ *   --provider <name>        Target provider: antigravity (agy), claude (default), openai, codex, cursor, opencode, copilot, factory, grokbot, grok-build, pi, omp, deepseek-harness (dsh), warp, devin, hermes, openhuman, or openclaw
  *   --model <name>            Override model for all tiers (blanket)
  *   --reasoning-model <name> Override model for reasoning tasks
  *   --coding-model <name>    Override model for coding tasks
@@ -123,7 +123,7 @@ const PROVIDER_ALIASES = {
   'dsh': 'deepseek-harness',
 };
 
-const AVAILABLE_PROVIDERS = ['antigravity', 'claude', 'factory', 'codex', 'opencode', 'copilot', 'cursor', 'pi', 'omp', 'deepseek-harness', 'warp', 'windsurf', 'hermes', 'openclaw', 'openhuman'];
+const AVAILABLE_PROVIDERS = ['antigravity', 'claude', 'factory', 'codex', 'opencode', 'copilot', 'cursor', 'pi', 'omp', 'deepseek-harness', 'warp', 'windsurf', 'hermes', 'openclaw', 'openhuman', 'grokbot', 'grok-build'];
 
 const UNSUPPORTED_PROVIDER_HINTS = {
   'devin-cli': [
@@ -651,6 +651,8 @@ Providers (all deploy agents, commands, skills, and rules):
               Paths: AGENTS.md, .agents/skills/, .dsh/aiwg.cordis.patch.yml
   devin     - Devin Desktop (preferred; aliases: devin-desktop, windsurf)
               Paths: .windsurf/agents/, .windsurf/workflows/, .windsurf/skills/, .windsurf/rules/
+  grokbot   - Grok Bot (AGENTS.md bridge; skills only with AIWG_GROKBOT_SKILLS_DIR)
+  grok-build - Grok Build (experimental; .grok paths + $GROK_HOME; no bare grok alias)
   hermes    - Hermes Agent (MCP-based integration)
               Skills: $HERMES_HOME/skills/ (user-global; defaults to ~/.hermes/skills/) | Agents: AGENTS.md
               Commands/Rules: served via MCP, not file-deployed