@bakers-build/addon-grok 0.5.1-next.557 → 0.5.1-next.746

package/dist/src/index.d.ts

@@ -1,7 +1,7 @@
-import { type AgentFootprint, type AgentPlugin, type AgentRunIdentity, type BbAgent } from '@bakers-build/conductor/contract';
+import { type AgentFootprint, type AgentPlugin, type AgentRunIdentity, type BbAgent, type RunEnvPolicy, type SandboxHost, type SandboxPreflight, type SecurityOptions } from '@bakers-build/conductor/contract';
 export { parseGrokTranscript } from './footprint.js';
 export type GrokReasoningEffort = 'high' | 'medium' | 'low';
-export interface GrokAgentOptions {
+export interface GrokAgentOptions extends SecurityOptions {
     model?: string;
     reasoningEffort?: GrokReasoningEffort | string;
     effort?: string;
@@ -15,8 +15,14 @@ export declare class GrokAgent implements BbAgent {
     private readonly model;
     private readonly effort;
     private readonly overrides;
+    private readonly security;
+    readonly runEnvPolicy: RunEnvPolicy;
     constructor(options?: GrokAgentOptions, home?: string);
     launchCommand(prompt: string, run?: AgentRunIdentity): string;
+    /** The launch flags a security mode owns (`docs/addons/grok.md`). */
+    private securityFlags;
+    /** Grok's sandbox is Landlock on Linux and Seatbelt on macOS. */
+    sandboxPreflight(host?: SandboxHost): Promise<SandboxPreflight>;
     /**
      * `grok --session-id <uuid>` documents "new conversation… must not already
      * exist" (BB-473 review round 2), so the conductor checks this before

package/dist/src/index.js

@@ -1,11 +1,112 @@
 import { readdir, readFile, stat } from 'node:fs/promises';
 import { homedir } from 'node:os';
 import { join } from 'node:path';
-import { resolveAgentCliOptions, validateOptionalString, } from '@bakers-build/conductor/contract';
+import { resolveAgentCliOptions, resolveSecurityOptions, systemSandboxHost, validateOptionalString, } from '@bakers-build/conductor/contract';
 import { shellQuote } from '@bakers-build/core';
 import { parseGrokTranscript } from './footprint.js';
 export { parseGrokTranscript } from './footprint.js';
-const GROK_RESERVED = ['--permission-mode', '--session-id'];
+const GROK_RESERVED = ['--permission-mode', '--session-id', '-s'];
+/** Flags sandbox mode owns on top of `GROK_RESERVED` (`docs/addons/grok.md`). */
+const GROK_SANDBOX_RESERVED = [
+    ...GROK_RESERVED,
+    '--sandbox',
+    '--always-approve',
+    '--allow',
+    '--allowedTools',
+    '--allowed-tools',
+    '--add-dir',
+    // the workspace profile makes the cwd writable; agent definitions may carry their own permissions
+    '--cwd',
+    '-w',
+    '--worktree',
+    '--agents',
+    '--agent',
+];
+/**
+ * Grok splits short-flag clusters (`-cw` is `-c -w`), which the shared matcher
+ * only checks at the token's start. Only `-m`/`-p` end the scan: their value
+ * follows. Fail-closed: an optional-value flag such as `-r` does not end it.
+ */
+function rejectClusteredReserved(args, reserved) {
+    const letters = reserved.filter((f) => /^-[^-]$/.test(f)).map((f) => f[1]);
+    for (const token of args) {
+        if (!/^-[^-]/.test(token))
+            continue;
+        for (const letter of token.slice(1)) {
+            if (letters.includes(letter)) {
+                throw new Error(`args contains reserved flag -${letter}`);
+            }
+            if (letter === 'm' || letter === 'p')
+                break;
+        }
+    }
+}
+/** Grok flags whose value is the next token (`grok --help`, grok 1.0.70). */
+const GROK_VALUE_FLAGS = new Set([
+    '--model',
+    '--single',
+    '--resume',
+    '--debug-file',
+    '--deny',
+    '--disallowedTools',
+    '--disallowed-tools',
+    '--json-schema',
+    '--leader-socket',
+    '--max-turns',
+    '--output-format',
+    '--prompt-file',
+    '--prompt-json',
+    '--reasoning-effort',
+    '--effort',
+    '--rules',
+    '--system-prompt-override',
+    '--system-prompt',
+    '--tools',
+    '--worktree-ref',
+    '--ref',
+]);
+/**
+ * After the prompt, Grok parses a bare token as a subcommand (`wrap`, `agent`),
+ * which replaces the sandboxed session. Allowlist: only a value of a known
+ * value flag may be bare. A short cluster qualifies only when its last letter
+ * is the first that takes a value (`-cm`): in `-pm` the `m` is `-p`'s value.
+ * `-c`, `-h`, `-v` are Grok's only short flags without a value.
+ */
+function rejectBareArgs(args) {
+    args.forEach((token, i) => {
+        if (token.startsWith('-'))
+            return;
+        const prev = args[i - 1] ?? '';
+        if (GROK_VALUE_FLAGS.has(prev) || /^-[chv]*[mpr]$/.test(prev))
+            return;
+        throw new Error(`args contains bare token ${token}, which Grok would run as a subcommand outside the sandboxed session`);
+    });
+}
+/** Only what Grok's built-in `workspace` profile enforces. */
+const SANDBOX_DEFAULTS = {
+    trusted_commands: [],
+    deny_read: [],
+    allow_write: [],
+    network: ['*'],
+    mcp_servers: {},
+};
+/** Throws on a sandbox key Grok cannot enforce from the command line. */
+function rejectUnsupportedSandbox(sandbox) {
+    if (sandbox.network.length !== 1 || sandbox.network[0] !== '*') {
+        throw new Error("Grok cannot restrict sandbox.network: its workspace profile allows all hosts; leave network at ['*']");
+    }
+    if (Object.keys(sandbox.mcp_servers).length > 0) {
+        throw new Error('Grok cannot allow only named sandbox.mcp_servers: sandbox mode passes a deny rule for every MCP tool; leave mcp_servers empty');
+    }
+    if (sandbox.trusted_commands.length > 0) {
+        throw new Error("Grok has no command exception narrowed to executable, arguments and directory for sandbox.trusted_commands; use security: 'system' with your own sandbox.toml profile");
+    }
+    for (const key of ['deny_read', 'allow_write']) {
+        if (sandbox[key].length > 0) {
+            throw new Error(`Grok needs a sandbox.toml profile for sandbox.${key}, which bakers.build does not write; use security: 'system' with args: ['--sandbox', '<profile>']`);
+        }
+    }
+}
 const GROK_KNOWN = [
     { kind: 'model', flags: ['--model', '-m'] },
     { kind: 'effort', flags: ['--reasoning-effort', '--effort'] },
@@ -39,9 +140,21 @@ export class GrokAgent {
     model;
     effort;
     overrides;
+    security;
+    runEnvPolicy;
     constructor(options = {}, home = homedir()) {
         this.home = home;
-        const cli = resolveAgentCliOptions(options, GROK_RESERVED, GROK_KNOWN);
+        this.security = resolveSecurityOptions(options, SANDBOX_DEFAULTS);
+        this.runEnvPolicy = this.security.runEnvPolicy;
+        if (this.security.mode === 'custom') {
+            throw new Error("Grok has no config flags for security: 'custom'; use security: 'system' with args: ['--sandbox', '<profile>'] for your own sandbox.toml profile");
+        }
+        rejectUnsupportedSandbox(this.security.sandbox);
+        const reserved = this.security.mode === 'sandbox' ? GROK_SANDBOX_RESERVED : GROK_RESERVED;
+        const cli = resolveAgentCliOptions(options, reserved, GROK_KNOWN);
+        rejectClusteredReserved(cli.args, reserved);
+        if (this.security.mode === 'sandbox')
+            rejectBareArgs(cli.args);
         this.args = cli.args;
         this.model = cli.model;
         this.effort =
@@ -58,7 +171,7 @@ export class GrokAgent {
             // dispatched into instead of holding a session there.
             parts.push(shellQuote(prompt));
         }
-        parts.push('--permission-mode', 'bypassPermissions');
+        parts.push(...this.securityFlags());
         if (this.model !== undefined && !this.overrides.model) {
             parts.push('-m', shellQuote(this.model));
         }
@@ -77,6 +190,50 @@ export class GrokAgent {
         }
         return parts.join(' ');
     }
+    /** The launch flags a security mode owns (`docs/addons/grok.md`). */
+    securityFlags() {
+        if (this.security.mode === 'system')
+            return [];
+        if (this.security.mode === 'yolo') {
+            return ['--permission-mode', 'bypassPermissions'];
+        }
+        return [
+            '--sandbox',
+            'workspace',
+            '--permission-mode',
+            'acceptEdits',
+            '--allow',
+            shellQuote('Bash(*)'),
+            '--deny',
+            shellQuote('MCPTool(*)'),
+        ];
+    }
+    /** Grok's sandbox is Landlock on Linux and Seatbelt on macOS. */
+    async sandboxPreflight(host = systemSandboxHost()) {
+        if (this.security.mode !== 'sandbox' || host.platform === 'darwin') {
+            return { ok: true };
+        }
+        const fallback = "set security: 'system' or 'yolo' for Grok";
+        if (host.platform !== 'linux') {
+            return {
+                ok: false,
+                cause: `Grok's sandbox does not support ${host.platform}`,
+                fix: fallback,
+            };
+        }
+        const probe = await host.run('grep', [
+            '-qw',
+            'landlock',
+            '/sys/kernel/security/lsm',
+        ]);
+        return probe.ok
+            ? { ok: true }
+            : {
+                ok: false,
+                cause: 'Landlock is not active in this kernel',
+                fix: `boot a kernel with landlock in its lsm= list, or ${fallback}`,
+            };
+    }
     /**
      * `grok --session-id <uuid>` documents "new conversation… must not already
      * exist" (BB-473 review round 2), so the conductor checks this before

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bakers-build/addon-grok",
-  "version": "0.5.1-next.557",
+  "version": "0.5.1-next.746",
   "description": "bakers.build agent plugin for xAI Grok Build, with a real session footprint.",
   "type": "module",
   "license": "MIT",
@@ -20,7 +20,7 @@
     "directory": "bakers-cli/addons/grok"
   },
   "peerDependencies": {
-    "@bakers-build/conductor": "^0.5.1-next.557",
-    "@bakers-build/core": "^0.5.1-next.557"
+    "@bakers-build/conductor": "^0.5.1-next.746",
+    "@bakers-build/core": "^0.5.1-next.746"
   }
 }