@chimix/agentscan 1.1.0 → 1.3.0

package/dist/cli.js

@@ -6962,7 +6962,7 @@ var require_public_api = __commonJS(function(exports) {
 import { parseArgs } from "node:util";
 
 // src/analyze.ts
-import { resolve as resolve8 } from "node:path";
+import { resolve as resolve9 } from "node:path";
 
 // src/checks/aliases.ts
 var RULE_ALIASES = {
@@ -7091,6 +7091,7 @@ var AGENT_CONFIG_SIGNALS = [
   ".gemini",
   ".kiro",
   ".windsurf",
+  ".devin",
   ".cline",
   ".roo",
   ".kilo",
@@ -7634,6 +7635,9 @@ function schemaProfileFromSkillsDir(dir) {
   if (normalized.includes("/.agents/skills") || normalized.endsWith("/.agents/skills") || normalized.includes("/.cursor/skills") || normalized.endsWith("/.cursor/skills") || normalized.includes("/.codex/skills") || normalized.endsWith("/.codex/skills") || normalized.includes("/.commandcode/skills") || normalized.endsWith("/.commandcode/skills")) {
     return "agent-skills";
   }
+  if (normalized.includes("/.grok/skills") || normalized.endsWith("/.grok/skills")) {
+    return "grok";
+  }
   return "claude";
 }
 function assertNever(value, message) {
@@ -7656,6 +7660,9 @@ function providerFromSkillsDir(dir) {
   if (normalized.includes("/.commandcode/skills") || normalized.endsWith("/.commandcode/skills")) {
     return "commandcode";
   }
+  if (normalized.includes("/.grok/skills") || normalized.endsWith("/.grok/skills")) {
+    return "grok";
+  }
   return "unknown";
 }
 function mcpProfileFromPath(filePath) {
@@ -7687,6 +7694,12 @@ function mcpProfileFromPath(filePath) {
   if (/(?:^|\/)(?:\.opencode\/)?opencode\.jsonc?$/.test(normalized)) {
     return "opencode-json";
   }
+  if (normalized.endsWith("/.grok/config.toml") || normalized.endsWith(".grok/config.toml")) {
+    return "grok-toml";
+  }
+  if (/(?:^|\/)\.codeium\/windsurf\/mcp_config\.json$/.test(normalized)) {
+    return "windsurf-json";
+  }
   return "claude-json";
 }
 function sourceProviderForMcpProfile(profile) {
@@ -7711,6 +7724,10 @@ function sourceProviderForMcpProfile(profile) {
       return "opencode";
     case "continue-yaml":
       return "continue";
+    case "grok-toml":
+      return "grok";
+    case "windsurf-json":
+      return "windsurf";
     default: {
       return assertNever(profile, `unhandled MCP schema profile: ${profile}`);
     }
@@ -7738,6 +7755,10 @@ function consumedByForMcpProfile(profile) {
       return ["opencode"];
     case "continue-yaml":
       return ["continue"];
+    case "grok-toml":
+      return ["grok"];
+    case "windsurf-json":
+      return ["windsurf"];
     default: {
       return assertNever(profile, `unhandled MCP schema profile: ${profile}`);
     }
@@ -7929,6 +7950,37 @@ function checkConfigErrors(facts) {
   });
 }
 
+// src/facts/grok.ts
+import { homedir } from "node:os";
+import { join as join2 } from "node:path";
+var GROK_HOOK_EVENTS = new Set([
+  "SessionStart",
+  "SessionEnd",
+  "UserPromptSubmit",
+  "PreToolUse",
+  "PostToolUse",
+  "PostToolUseFailure",
+  "PermissionDenied",
+  "Stop",
+  "StopFailure",
+  "Notification",
+  "SubagentStart",
+  "SubagentStop",
+  "PreCompact",
+  "PostCompact"
+]);
+var GROK_HOOK_HANDLER_TYPES = new Set(["command", "http"]);
+function grokHomeDir() {
+  const override = process.env.GROK_HOME?.trim();
+  if (override !== undefined && override.length > 0) {
+    return override;
+  }
+  return join2(homedir(), ".grok");
+}
+function isShadowedGrok(effective) {
+  return effective === false;
+}
+
 // src/facts/hook-schema.ts
 var KNOWN_HOOK_EVENTS = new Set([
   "SessionStart",
@@ -8041,13 +8093,14 @@ function inferHookSchemaProfile(sourceProvider, explicit) {
   switch (sourceProvider) {
     case "commandcode":
       return "commandcode";
+    case "grok":
+      return "grok";
     case "vscode":
       return "vscode-native";
     case "claude":
     case "agent-skills":
     case "codex":
     case "cursor":
-    case "grok":
     case "antigravity":
     case "gemini":
     case "windsurf":
@@ -8108,6 +8161,8 @@ function eventsFor(profile) {
       return COPILOT_HOOK_EVENTS;
     case "commandcode":
       return COMMANDCODE_HOOK_EVENTS;
+    case "grok":
+      return GROK_HOOK_EVENTS;
     default: {
       return assertNever(profile, `unhandled hook schema profile: ${profile}`);
     }
@@ -8123,6 +8178,8 @@ function unknownEventRuleId(profile) {
       return "copilot.hook.unknown-event";
     case "commandcode":
       return "commandcode.hook.unknown-event";
+    case "grok":
+      return "grok.hook.unknown-event";
     default: {
       return assertNever(profile, `unhandled hook schema profile: ${profile}`);
     }
@@ -8138,6 +8195,8 @@ function missingScriptRuleId(profile) {
       return "copilot.hook.missing-script";
     case "commandcode":
       return "commandcode.hook.missing-script";
+    case "grok":
+      return "grok.hook.missing-script";
     default: {
       return assertNever(profile, `unhandled hook schema profile: ${profile}`);
     }
@@ -8261,6 +8320,21 @@ function defectRuleId(profile, defect) {
           return assertNever(defect, `unhandled hook defect: ${defect}`);
         }
       }
+    case "grok":
+      switch (defect) {
+        case "invalid-group":
+        case "command-without-command":
+        case "http-without-url":
+        case "unknown-handler-type":
+          return `grok.hook.${defect}`;
+        case "mcp-tool-without-server-or-tool":
+        case "prompt-without-prompt":
+        case "incompatible-handler":
+          return;
+        default: {
+          return assertNever(defect, `unhandled hook defect: ${defect}`);
+        }
+      }
     default: {
       return assertNever(profile, `unhandled hook schema profile: ${profile}`);
     }
@@ -8395,7 +8469,7 @@ var SECRET_PATTERNS = [
   { label: "Slack token", re: /\bxox[baprs]-[A-Za-z0-9-]{10,}/ },
   { label: "AWS access key id", re: /\bAKIA[0-9A-Z]{16}\b/ }
 ];
-var INTERPOLATED = /\$\{[A-Za-z_][A-Za-z0-9_]*(?::-[^}]*)?\}|\$\{env:[A-Za-z_][A-Za-z0-9_]*\}|\$\{input:[A-Za-z0-9_-]+\}|\$[A-Za-z_][A-Za-z0-9_]*/;
+var INTERPOLATED = /\$\{[A-Za-z_][A-Za-z0-9_]*(?::-[^}]*)?\}|\$\{env:[A-Za-z_][A-Za-z0-9_]*\}|\$\{file:[^}]+\}|\$\{input:[A-Za-z0-9_-]+\}|\$[A-Za-z_][A-Za-z0-9_]*/;
 function profileOf(server) {
   return server.schemaProfile ?? "claude-json";
 }
@@ -8407,12 +8481,15 @@ function isLaunchable(server) {
   switch (profile) {
     case "antigravity-json":
       return server.hasCommand || server.hasServerUrl === true;
+    case "windsurf-json":
+      return server.hasCommand || server.hasUrl || server.hasServerUrl === true;
     case "claude-json":
     case "mcp-json":
     case "commandcode-json":
     case "vscode-json":
     case "cursor-json":
     case "codex-toml":
+    case "grok-toml":
     case "opencode-json":
     case "continue-yaml":
       return server.hasCommand || server.hasUrl;
@@ -8438,12 +8515,16 @@ function noLaunchId(profile) {
       return "antigravity.mcp.no-launch";
     case "codex-toml":
       return "codex.mcp.no-launch";
+    case "grok-toml":
+      return "grok.mcp.no-launch";
     case "gemini-json":
       return "gemini.mcp.no-launch";
     case "opencode-json":
       return "opencode.mcp.no-launch";
     case "continue-yaml":
       return "continue.mcp.no-launch";
+    case "windsurf-json":
+      return "windsurf.mcp.no-launch";
     default: {
       return assertNever(profile, `unhandled MCP schema profile: ${profile}`);
     }
@@ -8454,6 +8535,8 @@ function noLaunchMessage(server) {
   switch (profile) {
     case "antigravity-json":
       return `MCP server "${server.name}" declares neither command nor serverUrl`;
+    case "windsurf-json":
+      return `MCP server "${server.name}" declares neither command, serverUrl, nor url`;
     case "gemini-json":
       return `MCP server "${server.name}" declares neither command, url, nor httpUrl`;
     case "continue-yaml":
@@ -8464,6 +8547,7 @@ function noLaunchMessage(server) {
     case "vscode-json":
     case "cursor-json":
     case "codex-toml":
+    case "grok-toml":
     case "opencode-json":
       return `MCP server "${server.name}" declares neither command nor url`;
     default: {
@@ -8476,6 +8560,8 @@ function noLaunchSuggest(server) {
   switch (profile) {
     case "antigravity-json":
       return `Add a command (or serverUrl) for "${server.name}", or remove it`;
+    case "windsurf-json":
+      return `Add a command, serverUrl, or url for "${server.name}", or remove it`;
     case "gemini-json":
       return `Add a command, url, or httpUrl for "${server.name}", or remove it`;
     case "continue-yaml":
@@ -8486,6 +8572,7 @@ function noLaunchSuggest(server) {
     case "vscode-json":
     case "cursor-json":
     case "codex-toml":
+    case "grok-toml":
     case "opencode-json":
       return `Add a command or url for "${server.name}", or remove it`;
     default: {
@@ -8619,7 +8706,7 @@ function claudeUrlNeedsType(server) {
 function checkMcp(facts) {
   const out = [];
   for (const server of facts.mcp) {
-    const shadowed = isShadowedCommandcode(server.commandcodeEffective);
+    const shadowed = isShadowedCommandcode(server.commandcodeEffective) || isShadowedGrok(server.grokEffective);
     if (shadowed) {} else if (server.inventoryOnly === true) {} else if (server.opencodeInherit === true) {} else if (server.opencodeDefect !== undefined) {
       const defect = server.opencodeDefect;
       out.push(make(openCodeDefectRule(defect), `mcp:${server.name}@${server.path}`, {
@@ -8737,6 +8824,8 @@ function checkMcp(facts) {
 
 // src/checks/rules.ts
 var CURSOR_RULE_LINE_LIMIT = 500;
+var WINDSURF_WORKSPACE_CHAR_LIMIT = 12000;
+var WINDSURF_GLOBAL_CHAR_LIMIT = 6000;
 function lineLimitFor(provider) {
   switch (provider) {
     case "cursor":
@@ -8798,10 +8887,17 @@ function checkRules(facts) {
     if (finding !== undefined) {
       out.push(finding);
     }
+    const missing = missingTriggerFinding(rule);
+    if (missing !== undefined) {
+      out.push(missing);
+    }
   }
   return out;
 }
 function tooLargeFinding(rule) {
+  if (rule.sourceProvider === "windsurf") {
+    return windsurfTooLargeFinding(rule);
+  }
   const limit = lineLimitFor(rule.sourceProvider);
   const ruleId = tooLargeRuleId(rule.sourceProvider);
   if (limit === undefined || ruleId === undefined || rule.lineCount <= limit) {
@@ -8820,6 +8916,42 @@ function tooLargeFinding(rule) {
     suggest: "Split or shorten the .mdc file, or ignore this info finding if the length is deliberate"
   });
 }
+function windsurfTooLargeFinding(rule) {
+  const global = rule.windsurfScope === "global";
+  const limit = global ? WINDSURF_GLOBAL_CHAR_LIMIT : WINDSURF_WORKSPACE_CHAR_LIMIT;
+  if (rule.charCount <= limit) {
+    return;
+  }
+  const ruleId = global ? "windsurf.rule.global-too-large" : "windsurf.rule.too-large";
+  return make(ruleId, `rule:${rule.path}`, {
+    action: "warn",
+    severity: "info",
+    message: global ? `Windsurf global rules file is long (${rule.charCount} characters > ${limit})` : `Windsurf workspace rule is long (${rule.charCount} characters > ${limit})`,
+    reason: global ? "Windsurf limits ~/.codeium/windsurf/memories/global_rules.md to 6,000 characters. That is a vendor recommendation, not a load failure. See docs/spec/windsurf-rules.md." : "Windsurf limits workspace rule files to 12,000 characters each. That is a vendor recommendation, not a load failure. See docs/spec/windsurf-rules.md.",
+    evidence: [
+      { kind: "rule", value: rule.path },
+      { kind: "count", value: `chars=${rule.charCount}` },
+      { kind: "threshold", value: String(limit) }
+    ],
+    suggest: global ? "Shorten global_rules.md, or ignore this info finding if the length is deliberate" : "Split or shorten the rule file, or ignore this info finding if the length is deliberate"
+  });
+}
+function missingTriggerFinding(rule) {
+  if (rule.sourceProvider !== "windsurf" || rule.windsurfScope !== "workspace") {
+    return;
+  }
+  if (rule.windsurfHasTrigger === true) {
+    return;
+  }
+  return make("windsurf.rule.missing-trigger", `rule:${rule.path}`, {
+    action: "warn",
+    severity: "warning",
+    message: "Windsurf workspace rule is missing a frontmatter trigger",
+    reason: "Each workspace rule declares an activation mode in its frontmatter via the `trigger` field (`always_on`, `glob`, `model_decision`, or `manual`). See docs/spec/windsurf-rules.md.",
+    evidence: [{ kind: "rule", value: rule.path }],
+    suggest: "Add a `trigger` field to the YAML frontmatter"
+  });
+}
 
 // src/checks/skills.ts
 import { basename as basename3, dirname as dirname2, isAbsolute, resolve as resolve3, sep as sep2 } from "node:path";
@@ -8843,11 +8975,14 @@ function skillSchema(skill) {
   if (skill.sourceProvider === "agent-skills" || skill.sourceProvider === "cursor" || skill.sourceProvider === "codex" || skill.sourceProvider === "commandcode") {
     return "agent-skills";
   }
+  if (skill.sourceProvider === "grok") {
+    return "grok";
+  }
   return "claude";
 }
 function skillRoot(skill) {
   const path = skill.path.replaceAll("\\", "/");
-  for (const marker of ["/.claude/skills", "/.agents/skills", "/.cursor/skills", "/.codex/skills", "/.commandcode/skills"]) {
+  for (const marker of ["/.claude/skills", "/.agents/skills", "/.cursor/skills", "/.codex/skills", "/.commandcode/skills", "/.grok/skills"]) {
     const index = path.lastIndexOf(marker);
     if (index !== -1) {
       return path.slice(0, index + marker.length);
@@ -8889,6 +9024,15 @@ function checkSkillStructure(facts) {
           evidence: skillEvidence(skill, `${skill.path}/SKILL.md`),
           suggest: "Add a --- delimited block with name and description"
         }));
+      } else if (schema === "grok") {
+        out.push(make("grok.skill.missing-frontmatter", skillSubject(skill), {
+          action: "warn",
+          severity: "error",
+          message: "SKILL.md has no YAML frontmatter block",
+          reason: "Grok Build says SKILL.md starts with YAML frontmatter. Extra keys are ignored; name and description are optional. See docs/spec/grok-skills.md.",
+          evidence: skillEvidence(skill, `${skill.path}/SKILL.md`),
+          suggest: "Add a --- delimited frontmatter block"
+        }));
       } else {
         out.push(make("claude.skill.missing-frontmatter", skillSubject(skill), {
           action: "warn",
@@ -8919,7 +9063,7 @@ function checkSkillStructure(facts) {
     }
     if (schema === "agent-skills") {
       out.push(...checkAgentSkillsFrontmatter(skill));
-    } else if (skill.description === undefined && skill.firstMarkdownParagraph === undefined) {
+    } else if (schema === "grok") {} else if (skill.description === undefined && skill.firstMarkdownParagraph === undefined) {
       out.push(make("claude.skill.missing-description", skillSubject(skill), {
         action: "warn",
         severity: "info",
@@ -9182,7 +9326,7 @@ function checkDescriptionBudget(facts, options) {
     return [];
   }
   const perEntryCap = options.skillListingMaxDescChars ?? 1536;
-  const project = facts.skills.filter((s) => s.source === "project" && s.hasSkillMd && skillSchema(s) !== "agent-skills" && listingText(s).length > 0);
+  const project = facts.skills.filter((s) => s.source === "project" && s.hasSkillMd && skillSchema(s) !== "agent-skills" && skillSchema(s) !== "grok" && listingText(s).length > 0);
   const byRoot = new Map;
   for (const s of project) {
     const root = skillRoot(s);
@@ -9677,6 +9821,54 @@ var STRUCTURAL_CHECKS = [
     provenance: "spec-required",
     lastVerified: "2026-08-31"
   },
+  {
+    id: "grok.mcp.no-launch",
+    description: "Grok MCP server declares neither command nor url",
+    provenance: "spec-required",
+    lastVerified: "2026-08-31"
+  },
+  {
+    id: "grok.hook.unknown-event",
+    description: "Grok hook registered under an event that is never dispatched",
+    provenance: "spec-required",
+    lastVerified: "2026-08-31"
+  },
+  {
+    id: "grok.hook.missing-script",
+    description: "Grok hook points at a script that does not exist, so it never runs",
+    provenance: "internal-consistency",
+    lastVerified: "2026-08-31"
+  },
+  {
+    id: "grok.hook.invalid-group",
+    description: "Grok hook group is missing the required nested hooks array, or matcher is not a string",
+    provenance: "spec-required",
+    lastVerified: "2026-08-31"
+  },
+  {
+    id: "grok.hook.command-without-command",
+    description: "Grok command hook is missing the command field",
+    provenance: "spec-required",
+    lastVerified: "2026-08-31"
+  },
+  {
+    id: "grok.hook.http-without-url",
+    description: "Grok http hook is missing the url field",
+    provenance: "spec-required",
+    lastVerified: "2026-08-31"
+  },
+  {
+    id: "grok.hook.unknown-handler-type",
+    description: "Grok hook uses a handler type other than command or http, or omits the required type",
+    provenance: "spec-required",
+    lastVerified: "2026-08-31"
+  },
+  {
+    id: "grok.skill.missing-frontmatter",
+    description: "Grok SKILL.md has no YAML frontmatter block",
+    provenance: "spec-required",
+    lastVerified: "2026-08-31"
+  },
   {
     id: "mcp.command-missing",
     description: "MCP server command is a path that does not exist on disk",
@@ -9742,6 +9934,30 @@ var STRUCTURAL_CHECKS = [
     description: "Cursor project rule exceeds the 500-line recommendation",
     provenance: "vendor-recommendation",
     lastVerified: "2026-08-31"
+  },
+  {
+    id: "windsurf.rule.too-large",
+    description: "Windsurf workspace rule exceeds the 12,000-character limit",
+    provenance: "vendor-recommendation",
+    lastVerified: "2026-08-31"
+  },
+  {
+    id: "windsurf.rule.global-too-large",
+    description: "Windsurf global_rules.md exceeds the 6,000-character limit",
+    provenance: "vendor-recommendation",
+    lastVerified: "2026-08-31"
+  },
+  {
+    id: "windsurf.rule.missing-trigger",
+    description: "Windsurf workspace rule is missing frontmatter trigger",
+    provenance: "spec-required",
+    lastVerified: "2026-08-31"
+  },
+  {
+    id: "windsurf.mcp.no-launch",
+    description: "Windsurf MCP server declares neither command, serverUrl, nor url",
+    provenance: "spec-required",
+    lastVerified: "2026-08-31"
   }
 ];
 
@@ -9764,7 +9980,7 @@ function runChecks(facts, options = {}) {
 
 // src/config/load.ts
 import { existsSync as existsSync2, readFileSync as readFileSync2 } from "node:fs";
-import { join as join2 } from "node:path";
+import { join as join3 } from "node:path";
 
 // node_modules/zod/v3/external.js
 var exports_external = {};
@@ -13749,7 +13965,7 @@ var defaultThresholds = {
   agents: 8
 };
 var defaultConfig = {
-  skillPaths: [".agents/skills", ".claude/skills", "skills", ".cursor/skills", ".codex/skills", ".commandcode/skills"],
+  skillPaths: [".agents/skills", ".claude/skills", "skills", ".cursor/skills", ".codex/skills", ".commandcode/skills", ".grok/skills"],
   mcpPaths: [
     ".mcp.json",
     ".claude/mcp.json",
@@ -13764,7 +13980,8 @@ var defaultConfig = {
     ".opencode/opencode.json",
     ".opencode/opencode.jsonc",
     ".continue/config.yaml",
-    ".continue/mcpServers"
+    ".continue/mcpServers",
+    ".grok/config.toml"
   ],
   policyFiles: ["AGENTS.md", "CLAUDE.md"],
   ignoreSkills: [],
@@ -13800,7 +14017,7 @@ var configSchema = exports_external.object({
 
 // src/config/load.ts
 function loadConfig(root, configPath) {
-  const path = configPath ?? join2(root, ".agentscanrc.json");
+  const path = configPath ?? join3(root, ".agentscanrc.json");
   if (!existsSync2(path)) {
     return configSchema.parse({});
   }
@@ -13816,22 +14033,22 @@ function loadConfig(root, configPath) {
 }
 
 // src/discover/index.ts
-import { homedir as homedir6 } from "node:os";
-import { join as join12, resolve as resolve7 } from "node:path";
+import { homedir as homedir9 } from "node:os";
+import { join as join17, resolve as resolve8 } from "node:path";
 
 // src/discover/agents.ts
 import { existsSync as existsSync6, readdirSync as readdirSync5, statSync as statSync4 } from "node:fs";
-import { dirname as dirname4, join as join7 } from "node:path";
+import { dirname as dirname4, join as join8 } from "node:path";
 
 // src/discover/commandcode.ts
 import { existsSync as existsSync5, readdirSync as readdirSync4, statSync as statSync3 } from "node:fs";
-import { homedir as homedir4 } from "node:os";
-import { basename as basename6, dirname as dirname3, isAbsolute as isAbsolute4, join as join6, resolve as resolve4, sep as sep3 } from "node:path";
+import { homedir as homedir5 } from "node:os";
+import { basename as basename6, dirname as dirname3, isAbsolute as isAbsolute4, join as join7, resolve as resolve4, sep as sep3 } from "node:path";
 
 // src/discover/mcp.ts
 import { existsSync as existsSync3, readdirSync as readdirSync2, readFileSync as readFileSync3, statSync } from "node:fs";
-import { homedir as homedir2 } from "node:os";
-import { basename as basename5, isAbsolute as isAbsolute2, join as join4 } from "node:path";
+import { homedir as homedir3 } from "node:os";
+import { basename as basename5, isAbsolute as isAbsolute2, join as join5 } from "node:path";
 
 // node_modules/smol-toml/dist/date.js
 /*!
@@ -15567,8 +15784,8 @@ function parseJsonc(text) {
 }
 
 // src/discover/launch.ts
-import { homedir } from "node:os";
-import { basename as basename4, join as join3, posix, win32 } from "node:path";
+import { homedir as homedir2 } from "node:os";
+import { basename as basename4, join as join4, posix, win32 } from "node:path";
 var UNRESOLVED_CWD = /\$\{[^}]+\}|\$[A-Za-z_][A-Za-z0-9_]*|%[A-Za-z0-9_]+%/;
 var INTERPRETERS = new Set([
   "bash",
@@ -15772,7 +15989,7 @@ function resolveLaunchCwd(cwd, projectRoot, hostPlatform = process.platform) {
   }
   let expanded = cwd;
   if (expanded.startsWith("~/")) {
-    expanded = join3(homedir(), expanded.slice(2));
+    expanded = join4(homedir2(), expanded.slice(2));
   }
   const pathApi = pathApiForHost(hostPlatform);
   const abs = pathApi.isAbsolute(expanded) ? expanded : pathApi.join(projectRoot, expanded);
@@ -15844,7 +16061,7 @@ function formatLaunch(launch) {
 
 // src/discover/mcp.ts
 var SHELL_METACHARS2 = /[|;&`]|\$\(|\|\||&&|\s/;
-var INTERPOLATED2 = /\$\{[A-Za-z_][A-Za-z0-9_]*(?::-[^}]*)?\}|\$\{env:[A-Za-z_][A-Za-z0-9_]*\}|\$\{input:[A-Za-z0-9_-]+\}|\$\{(?:userHome|workspaceFolder|workspaceFolderBasename|pathSeparator|\/)\}|\{env:[A-Za-z_][A-Za-z0-9_]*\}|\$\{\{\s*secrets\.[A-Za-z0-9_.]+\s*\}\}|\$[A-Za-z_][A-Za-z0-9_]*/;
+var INTERPOLATED2 = /\$\{[A-Za-z_][A-Za-z0-9_]*(?::-[^}]*)?\}|\$\{env:[A-Za-z_][A-Za-z0-9_]*\}|\$\{file:[^}]+\}|\$\{input:[A-Za-z0-9_-]+\}|\$\{(?:userHome|workspaceFolder|workspaceFolderBasename|pathSeparator|\/)\}|\{env:[A-Za-z_][A-Za-z0-9_]*\}|\$\{\{\s*secrets\.[A-Za-z0-9_.]+\s*\}\}|\$[A-Za-z_][A-Za-z0-9_]*/;
 function mcpCommandPath(command) {
   const trimmed = command.trim();
   if (trimmed.length === 0 || SHELL_METACHARS2.test(trimmed)) {
@@ -15871,11 +16088,11 @@ function resolveMcpCommand(root, raw) {
   }
   let expanded = extracted;
   if (expanded.startsWith("~/")) {
-    expanded = join4(homedir2(), expanded.slice(2));
+    expanded = join5(homedir3(), expanded.slice(2));
   } else if (expanded.startsWith("$")) {
     expanded = expanded.replace(/^\$(?:CLAUDE_PROJECT_DIR|\{CLAUDE_PROJECT_DIR\}|COMMANDCODE_PROJECT_DIR|\{COMMANDCODE_PROJECT_DIR\}|COMMANDCODE_CWD|\{COMMANDCODE_CWD\})\/?/, "");
   }
-  const abs = isAbsolute2(expanded) ? expanded : join4(root, expanded);
+  const abs = isAbsolute2(expanded) ? expanded : join5(root, expanded);
   try {
     return { command: extracted, exists: statSync(abs).isFile() };
   } catch {
@@ -16150,12 +16367,13 @@ function readVscodeConfig(path, errors3) {
     return;
   }
 }
-function parseCodexToml(raw, filePath, root, errors3) {
+function parseTomlMcpServers(raw, filePath, root, errors3, profile) {
+  const owner = profile === "codex-toml" ? "Codex" : "Grok";
   if (raw === null || typeof raw !== "object" || Array.isArray(raw)) {
     errors3.push({
       path: filePath,
       kind: "unexpected-shape",
-      detail: "Codex config root is not a TOML table"
+      detail: `${owner} config root is not a TOML table`
     });
     return [];
   }
@@ -16172,7 +16390,31 @@ function parseCodexToml(raw, filePath, root, errors3) {
     });
     return [];
   }
-  return parseMcpServers({ mcpServers: servers }, filePath, root, errors3, "codex-toml");
+  return parseMcpServers({ mcpServers: servers }, filePath, root, errors3, profile);
+}
+function parseCodexToml(raw, filePath, root, errors3) {
+  return parseTomlMcpServers(raw, filePath, root, errors3, "codex-toml");
+}
+function parseCodexTomlFile(filePath, root, errors3) {
+  const raw = readTomlConfig(filePath, errors3);
+  if (raw === undefined) {
+    return [];
+  }
+  return parseCodexToml(raw, filePath, root, errors3);
+}
+function parseGrokTomlFile(filePath, root, errors3) {
+  const raw = readTomlConfig(filePath, errors3);
+  if (raw === undefined) {
+    return [];
+  }
+  return parseTomlMcpServers(raw, filePath, root, errors3, "grok-toml");
+}
+function parseWindsurfJsonFile(filePath, root, errors3) {
+  const raw = readJsonConfig(filePath, errors3);
+  if (raw === undefined) {
+    return [];
+  }
+  return parseMcpServers(raw, filePath, root, errors3, "windsurf-json");
 }
 function parseOpenCode(raw, filePath, root, errors3) {
   if (raw === null || typeof raw !== "object" || Array.isArray(raw)) {
@@ -16401,6 +16643,9 @@ function parseMcpFile(filePath, root, errors3) {
       ...knobs
     };
   }
+  if (profile === "grok-toml") {
+    return { facts: parseGrokTomlFile(filePath, root, errors3) };
+  }
   if (profile === "continue-yaml") {
     const raw2 = filePath.endsWith(".json") || filePath.endsWith(".jsonc") ? readVscodeConfig(filePath, errors3) : readYamlConfig(filePath, errors3);
     if (raw2 === undefined) {
@@ -16465,7 +16710,7 @@ function discoverContinueMcpDir(dir, root, errors3, seen) {
     if (!continueMcpFilename(name)) {
       continue;
     }
-    const filePath = join4(dir, name);
+    const filePath = join5(dir, name);
     if (isDirectory(filePath)) {
       continue;
     }
@@ -16487,7 +16732,7 @@ function discoverMcpSurface(root, mcpPaths, errors3) {
   let codexProjectDocFallbackFilenames;
   let codexProjectRootMarkers;
   for (const rel of mcpPaths) {
-    const filePath = isAbsolute2(rel) ? rel : join4(root, rel);
+    const filePath = isAbsolute2(rel) ? rel : join5(root, rel);
     if (!existsSync3(filePath)) {
       continue;
     }
@@ -16545,8 +16790,8 @@ function discoverNestedContinueMcp(root, errors3, seen) {
 
 // src/discover/hooks.ts
 import { existsSync as existsSync4, readdirSync as readdirSync3, statSync as statSync2 } from "node:fs";
-import { homedir as homedir3 } from "node:os";
-import { isAbsolute as isAbsolute3, join as join5 } from "node:path";
+import { homedir as homedir4 } from "node:os";
+import { isAbsolute as isAbsolute3, join as join6 } from "node:path";
 var PROJECT_DIR2 = /^\$(?:CLAUDE_PROJECT_DIR\b|\{CLAUDE_PROJECT_DIR\})/;
 var PLUGIN_ROOT2 = /^\$(?:CLAUDE_PLUGIN_ROOT\b|\{CLAUDE_PLUGIN_ROOT\})/;
 var CLAUDE_HANDLER_TYPES = new Set(["command", "http", "mcp_tool", "mcp-tool", "prompt", "agent"]);
@@ -16562,26 +16807,26 @@ function resolveHookScript(bases, extracted, cwdAbs) {
   if (extracted.startsWith("~/")) {
     return {
       scriptPath: extracted,
-      exists: isFile(join5(homedir3(), extracted.slice(2)))
+      exists: isFile(join6(homedir4(), extracted.slice(2)))
     };
   }
   if (PROJECT_DIR2.test(extracted) || COMMANDCODE_PROJECT_DIR.test(extracted)) {
     const rel = extracted.replace(/^\$(?:CLAUDE_PROJECT_DIR|\{CLAUDE_PROJECT_DIR\}|COMMANDCODE_PROJECT_DIR|\{COMMANDCODE_PROJECT_DIR\}|COMMANDCODE_CWD|\{COMMANDCODE_CWD\})\/?/, "");
-    return { scriptPath: extracted, exists: isFile(join5(bases.project, rel)) };
+    return { scriptPath: extracted, exists: isFile(join6(bases.project, rel)) };
   }
   if (bases.plugin !== undefined && PLUGIN_ROOT2.test(extracted)) {
     const rel = extracted.replace(/^\$(?:CLAUDE_PLUGIN_ROOT|\{CLAUDE_PLUGIN_ROOT\})\/?/, "");
-    return { scriptPath: extracted, exists: isFile(join5(bases.plugin, rel)) };
+    return { scriptPath: extracted, exists: isFile(join6(bases.plugin, rel)) };
   }
   if (isAbsolute3(extracted)) {
     return { scriptPath: extracted, exists: isFile(extracted) };
   }
   if (cwdAbs !== undefined) {
-    return { scriptPath: extracted, exists: isFile(join5(cwdAbs, extracted)) };
+    return { scriptPath: extracted, exists: isFile(join6(cwdAbs, extracted)) };
   }
   const candidates = [
-    ...bases.own === undefined ? [] : [join5(bases.own, extracted)],
-    join5(bases.project, extracted)
+    ...bases.own === undefined ? [] : [join6(bases.own, extracted)],
+    join6(bases.project, extracted)
   ];
   return { scriptPath: extracted, exists: candidates.some(isFile) };
 }
@@ -16900,6 +17145,52 @@ function copilotHookFromEntry(item, ctx) {
   });
   return [attachLaunch(fact, launch, ctx, choice.skipExists)];
 }
+function timeoutFromGrokEntry(item) {
+  if (!("timeout" in item)) {
+    return {};
+  }
+  const value = item.timeout;
+  if (typeof value === "number" && Number.isFinite(value)) {
+    return { timeout: value };
+  }
+  return {};
+}
+function grokHookFromEntry(item, ctx) {
+  const timeoutFacts = timeoutFromGrokEntry(item);
+  const typeRaw = typeof item.type === "string" ? item.type : undefined;
+  if (typeRaw === undefined) {
+    return [
+      baseFact(ctx, {
+        defect: "unknown-handler-type",
+        unknownHandlerType: "(missing)",
+        ...timeoutFacts
+      })
+    ];
+  }
+  if (!GROK_HOOK_HANDLER_TYPES.has(typeRaw)) {
+    return [
+      baseFact(ctx, {
+        defect: "unknown-handler-type",
+        unknownHandlerType: typeRaw,
+        ...timeoutFacts
+      })
+    ];
+  }
+  if (typeRaw === "http") {
+    const url = nonemptyString(item.url);
+    return [
+      baseFact(ctx, {
+        handlerType: "http",
+        ...timeoutFacts,
+        ...url === undefined ? { defect: "http-without-url" } : {}
+      })
+    ];
+  }
+  return commandFactsFromLaunches(ctx, item, "command-without-command").map((fact) => ({
+    ...fact,
+    ...timeoutFacts
+  }));
+}
 function hooksFromProfile(item, ctx) {
   switch (ctx.schemaProfile) {
     case "claude":
@@ -16910,6 +17201,8 @@ function hooksFromProfile(item, ctx) {
       return copilotHookFromEntry(item, ctx);
     case "commandcode":
       return [commandcodeHookFromEntry(item, ctx)];
+    case "grok":
+      return grokHookFromEntry(item, ctx);
     default: {
       const neverProfile = ctx.schemaProfile;
       return neverProfile;
@@ -16926,7 +17219,7 @@ function hooksFromObject(hooks, filePath, source, bases, errors3, sourceProvider
     return [];
   }
   const profile = inferHookSchemaProfile(sourceProvider, schemaProfile);
-  const nestedOnly = profile === "claude" || profile === "commandcode";
+  const nestedOnly = profile === "claude" || profile === "commandcode" || profile === "grok";
   const facts = [];
   for (const [event, groups] of Object.entries(hooks)) {
     if (!Array.isArray(groups)) {
@@ -16984,8 +17277,8 @@ function hooksFromObject(hooks, filePath, source, bases, errors3, sourceProvider
 }
 function discoverHooks(root, errors3) {
   const files = [
-    join5(root, ".claude", "settings.json"),
-    join5(root, ".claude", "settings.local.json")
+    join6(root, ".claude", "settings.json"),
+    join6(root, ".claude", "settings.local.json")
   ];
   const facts = [];
   for (const filePath of files) {
@@ -17032,7 +17325,7 @@ function discoverHookDir(dir, root, errors3, defaultProfile) {
     if (!name.endsWith(".json") || name.startsWith(".")) {
       continue;
     }
-    const filePath = join5(dir, name);
+    const filePath = join6(dir, name);
     const raw = readJsonConfig(filePath, errors3);
     if (raw === undefined) {
       continue;
@@ -17056,12 +17349,53 @@ function discoverHookDir(dir, root, errors3, defaultProfile) {
   return facts;
 }
 function discoverVscodeHooks(root, errors3) {
-  return discoverHookDir(join5(root, ".github", "hooks"), root, errors3, "vscode-native");
+  return discoverHookDir(join6(root, ".github", "hooks"), root, errors3, "vscode-native");
 }
 function discoverCopilotUserHooks(errors3) {
-  const dir = join5(homedir3(), ".copilot", "hooks");
+  const dir = join6(homedir4(), ".copilot", "hooks");
   return discoverHookDir(dir, dir, errors3, "vscode-native");
 }
+function discoverGrokHooks(dir, projectRoot, errors3) {
+  if (!existsSync4(dir)) {
+    return [];
+  }
+  let names;
+  try {
+    names = readdirSync3(dir);
+  } catch (err) {
+    errors3.push({
+      path: dir,
+      kind: "unreadable",
+      detail: err instanceof Error ? err.message : String(err)
+    });
+    return [];
+  }
+  const facts = [];
+  for (const name of names) {
+    if (!name.endsWith(".json") || name.startsWith(".")) {
+      continue;
+    }
+    const filePath = join6(dir, name);
+    const raw = readJsonConfig(filePath, errors3);
+    if (raw === undefined) {
+      continue;
+    }
+    if (raw === null || typeof raw !== "object" || Array.isArray(raw)) {
+      errors3.push({
+        path: filePath,
+        kind: "unexpected-shape",
+        detail: "hook file is not a JSON object"
+      });
+      continue;
+    }
+    const hooks = raw.hooks;
+    if (hooks === undefined) {
+      continue;
+    }
+    facts.push(...hooksFromObject(hooks, filePath, "grok-hooks", { project: projectRoot, own: dir }, errors3, "grok", process.platform, "grok"));
+  }
+  return facts;
+}
 
 // src/discover/commandcode.ts
 var SETTINGS_LAYER_RANK = {
@@ -17117,9 +17451,9 @@ function layerFromObject(filePath, kind, obj) {
 function readCommandcodeSettingsLayers(commandcodeProjectRoot, errors3, includeGlobal) {
   const layers = [];
   const candidates = [
-    { path: join6(commandcodeProjectRoot, ".commandcode", "settings.local.json"), kind: "local" },
-    { path: join6(commandcodeProjectRoot, ".commandcode", "settings.json"), kind: "project" },
-    ...includeGlobal ? [{ path: join6(homedir4(), ".commandcode", "settings.json"), kind: "user" }] : []
+    { path: join7(commandcodeProjectRoot, ".commandcode", "settings.local.json"), kind: "local" },
+    { path: join7(commandcodeProjectRoot, ".commandcode", "settings.json"), kind: "project" },
+    ...includeGlobal ? [{ path: join7(homedir5(), ".commandcode", "settings.json"), kind: "user" }] : []
   ];
   for (const candidate of candidates) {
     const obj = readSettingsObject(candidate.path, errors3);
@@ -17141,12 +17475,12 @@ function winningSkillsExtraDirs(layers) {
 function resolveSkillLocation(commandcodeProjectRoot, declared) {
   const trimmed = declared.trim();
   if (trimmed.startsWith("~/")) {
-    return join6(homedir4(), trimmed.slice(2));
+    return join7(homedir5(), trimmed.slice(2));
   }
   if (isAbsolute4(trimmed)) {
     return trimmed;
   }
-  return join6(commandcodeProjectRoot, trimmed);
+  return join7(commandcodeProjectRoot, trimmed);
 }
 function winningCommandcodeModel(layers) {
   for (const layer of layers) {
@@ -17177,7 +17511,7 @@ function discoverCommandcodeInlineMcp(commandcodeProjectRoot, layers, errors3) {
   return facts;
 }
 function discoverCommandcodeUserMcp(commandcodeProjectRoot, errors3) {
-  return discoverMcp(commandcodeProjectRoot, [join6(homedir4(), ".commandcode", "mcp.json")], errors3);
+  return discoverMcp(commandcodeProjectRoot, [join7(homedir5(), ".commandcode", "mcp.json")], errors3);
 }
 function discoverCommandcodeMods(layers) {
   const out = [];
@@ -17232,9 +17566,9 @@ function commandFiles(dir, errors3) {
     if (name.startsWith(".")) {
       continue;
     }
-    const abs = join6(dir, name);
+    const abs = join7(dir, name);
     if (isDirectory2(abs)) {
-      out.push(...commandFiles(abs, errors3).map((rel) => join6(name, rel)));
+      out.push(...commandFiles(abs, errors3).map((rel) => join7(name, rel)));
       continue;
     }
     if (name.endsWith(".md") && isFile2(abs)) {
@@ -17246,25 +17580,25 @@ function commandFiles(dir, errors3) {
 function discoverCommandcodeCommands(commandcodeProjectRoot, includeGlobal, errors3) {
   const facts = [];
   const seen = new Set;
-  const projectDir = join6(commandcodeProjectRoot, ".commandcode", "commands");
+  const projectDir = join7(commandcodeProjectRoot, ".commandcode", "commands");
   if (existsSync5(projectDir)) {
     seen.add(projectDir);
     for (const rel of commandFiles(projectDir, errors3)) {
       facts.push({
         name: basename6(rel, ".md"),
-        path: join6(projectDir, rel),
+        path: join7(projectDir, rel),
         source: "project",
         sourceProvider: "commandcode"
       });
     }
   }
   if (includeGlobal) {
-    const userDir = join6(homedir4(), ".commandcode", "commands");
+    const userDir = join7(homedir5(), ".commandcode", "commands");
     if (existsSync5(userDir) && !seen.has(userDir)) {
       for (const rel of commandFiles(userDir, errors3)) {
         facts.push({
           name: basename6(rel, ".md"),
-          path: join6(userDir, rel),
+          path: join7(userDir, rel),
           source: "global",
           sourceProvider: "commandcode"
         });
@@ -17391,7 +17725,7 @@ function discoverCommandcodeAgentsDir(dir, errors3) {
     if (name.startsWith(".") || !name.endsWith(".md")) {
       continue;
     }
-    const filePath = join6(dir, name);
+    const filePath = join7(dir, name);
     if (!isFile2(filePath)) {
       continue;
     }
@@ -17401,9 +17735,9 @@ function discoverCommandcodeAgentsDir(dir, errors3) {
 }
 function discoverCommandcodeAgents(commandcodeProjectRoot, includeGlobal, errors3) {
   const facts = [];
-  facts.push(...discoverCommandcodeAgentsDir(join6(commandcodeProjectRoot, ".commandcode", "agents"), errors3));
+  facts.push(...discoverCommandcodeAgentsDir(join7(commandcodeProjectRoot, ".commandcode", "agents"), errors3));
   if (includeGlobal) {
-    facts.push(...discoverCommandcodeAgentsDir(join6(homedir4(), ".commandcode", "agents"), errors3));
+    facts.push(...discoverCommandcodeAgentsDir(join7(homedir5(), ".commandcode", "agents"), errors3));
   }
   return facts;
 }
@@ -17416,7 +17750,7 @@ function commandcodeAgentsSkillsRoots(startDir, scanBoundary, home) {
     if (dir === homeDir) {
       break;
     }
-    out.push(join6(dir, ".agents", "skills"));
+    out.push(join7(dir, ".agents", "skills"));
     if (dir === stop) {
       break;
     }
@@ -17437,11 +17771,11 @@ function mcpCommandcodeScore(entry, commandcodeProjectRoot, home) {
     return;
   }
   const p = resolve4(entry.path);
-  const projectMcp = resolve4(join6(commandcodeProjectRoot, ".mcp.json"));
-  const userMcp = resolve4(join6(home, ".commandcode", "mcp.json"));
-  const localSettings = resolve4(join6(commandcodeProjectRoot, ".commandcode", "settings.local.json"));
-  const projectSettings = resolve4(join6(commandcodeProjectRoot, ".commandcode", "settings.json"));
-  const userSettings = resolve4(join6(home, ".commandcode", "settings.json"));
+  const projectMcp = resolve4(join7(commandcodeProjectRoot, ".mcp.json"));
+  const userMcp = resolve4(join7(home, ".commandcode", "mcp.json"));
+  const localSettings = resolve4(join7(commandcodeProjectRoot, ".commandcode", "settings.local.json"));
+  const projectSettings = resolve4(join7(commandcodeProjectRoot, ".commandcode", "settings.json"));
+  const userSettings = resolve4(join7(home, ".commandcode", "settings.json"));
   if (p === projectMcp) {
     return 20;
   }
@@ -17463,7 +17797,7 @@ function mcpCommandcodeScore(entry, commandcodeProjectRoot, home) {
   return;
 }
 function applyCommandcodeMcpPrecedence(mcp, commandcodeProjectRoot) {
-  const home = homedir4();
+  const home = homedir5();
   const ranked = [];
   for (const entry of mcp) {
     const score = mcpCommandcodeScore(entry, commandcodeProjectRoot, home);
@@ -17559,9 +17893,9 @@ function applyCommandcodeHookPrecedence(hooks) {
   }
 }
 function applyCommandcodeAgentPrecedence(agents, commandcodeProjectRoot) {
-  const home = homedir4();
-  const userDir = resolve4(join6(home, ".commandcode", "agents"));
-  const projectDir = resolve4(join6(commandcodeProjectRoot, ".commandcode", "agents"));
+  const home = homedir5();
+  const userDir = resolve4(join7(home, ".commandcode", "agents"));
+  const projectDir = resolve4(join7(commandcodeProjectRoot, ".commandcode", "agents"));
   const personal = [];
   const project = [];
   for (const agent of agents) {
@@ -17585,10 +17919,10 @@ function applyCommandcodeAgentPrecedence(agents, commandcodeProjectRoot) {
   }
 }
 function applyCommandcodeSkillPrecedence(skills, ctx) {
-  const home = homedir4();
-  const projectCc = resolve4(join6(ctx.commandcodeProjectRoot, ".commandcode", "skills"));
-  const userCc = resolve4(join6(home, ".commandcode", "skills"));
-  const userAgents = resolve4(join6(home, ".agents", "skills"));
+  const home = homedir5();
+  const projectCc = resolve4(join7(ctx.commandcodeProjectRoot, ".commandcode", "skills"));
+  const userCc = resolve4(join7(home, ".commandcode", "skills"));
+  const userAgents = resolve4(join7(home, ".agents", "skills"));
   const projectAgents = ctx.agentsSkillsRoots.map((dir) => resolve4(dir));
   const extras = ctx.extraDirs.map((dir) => resolve4(dir));
   const rankOf = (skill) => {
@@ -17656,7 +17990,7 @@ function agentFiles(dir, errors3) {
       continue;
     }
     if (entry.endsWith("/")) {
-      out.push(...agentFiles(join7(dir, entry.slice(0, -1)), errors3).map((p) => join7(entry.slice(0, -1), p)));
+      out.push(...agentFiles(join8(dir, entry.slice(0, -1)), errors3).map((p) => join8(entry.slice(0, -1), p)));
       continue;
     }
     out.push(entry);
@@ -17707,7 +18041,7 @@ function discoverClaudeAgentsDir(dir, root, errors3) {
     if (!name.endsWith(".md")) {
       continue;
     }
-    const filePath = join7(dir, name);
+    const filePath = join8(dir, name);
     try {
       const st = statSync4(filePath);
       if (!st.isFile()) {
@@ -17721,7 +18055,7 @@ function discoverClaudeAgentsDir(dir, root, errors3) {
   return facts;
 }
 function discoverVscodeAgents(root, errors3) {
-  const dir = join7(root, ".github", "agents");
+  const dir = join8(root, ".github", "agents");
   if (!existsSync6(dir)) {
     return [];
   }
@@ -17744,7 +18078,7 @@ function discoverVscodeAgents(root, errors3) {
     if (!name.endsWith(".agent.md") && !name.endsWith(".md")) {
       continue;
     }
-    const filePath = join7(dir, name);
+    const filePath = join8(dir, name);
     try {
       if (!statSync4(filePath).isFile()) {
         continue;
@@ -17792,7 +18126,7 @@ function discoverAgents(root, errors3, startDir = root, includeGlobal = false, c
   const facts = [];
   const seenDirs = new Set;
   for (const dir of ancestorDirsInclusive(startDir, root)) {
-    const agentsDir = join7(dir, ".claude", "agents");
+    const agentsDir = join8(dir, ".claude", "agents");
     if (seenDirs.has(agentsDir)) {
       continue;
     }
@@ -17804,12 +18138,83 @@ function discoverAgents(root, errors3, startDir = root, includeGlobal = false, c
   return facts;
 }
 
+// src/discover/codex.ts
+import { existsSync as existsSync7 } from "node:fs";
+import { join as join10 } from "node:path";
+
+// src/facts/codex.ts
+import { homedir as homedir6 } from "node:os";
+import { join as join9 } from "node:path";
+function codexHomeDir() {
+  const override = process.env.CODEX_HOME?.trim();
+  if (override !== undefined && override.length > 0) {
+    return override;
+  }
+  return join9(homedir6(), ".codex");
+}
+
+// src/discover/codex.ts
+function discoverCodexUserMcp(errors3) {
+  const home = codexHomeDir();
+  const filePath = join10(home, "config.toml");
+  if (!existsSync7(filePath)) {
+    return [];
+  }
+  return parseCodexTomlFile(filePath, home, errors3);
+}
+
+// src/discover/grok.ts
+import { existsSync as existsSync8 } from "node:fs";
+import { dirname as dirname5, join as join11, resolve as resolve5 } from "node:path";
+function discoverGrokUserMcp(errors3) {
+  const home = grokHomeDir();
+  const filePath = join11(home, "config.toml");
+  if (!existsSync8(filePath)) {
+    return [];
+  }
+  return parseGrokTomlFile(filePath, home, errors3);
+}
+function applyGrokMcpPrecedence(mcp, startDir) {
+  const userFile = resolve5(join11(grokHomeDir(), "config.toml"));
+  const ranked = [];
+  for (const entry of mcp) {
+    if (entry.schemaProfile !== "grok-toml") {
+      continue;
+    }
+    ranked.push({ entry, score: grokMcpScore(entry, startDir, userFile) });
+  }
+  const best = new Map;
+  for (const item of ranked) {
+    const current = best.get(item.entry.name);
+    if (current === undefined || item.score > current) {
+      best.set(item.entry.name, item.score);
+    }
+  }
+  const seenWinner = new Set;
+  for (const item of ranked) {
+    const winning = best.get(item.entry.name) ?? item.score;
+    if (item.score === winning && !seenWinner.has(item.entry.name)) {
+      item.entry.grokEffective = true;
+      seenWinner.add(item.entry.name);
+    } else {
+      item.entry.grokEffective = false;
+    }
+  }
+}
+function grokMcpScore(entry, startDir, userFile) {
+  if (resolve5(entry.path) === userFile) {
+    return 0;
+  }
+  const projectDir = dirname5(dirname5(entry.path));
+  return 1000 - hopsFrom(startDir, projectDir);
+}
+
 // src/discover/plugins.ts
-import { existsSync as existsSync7, readdirSync as readdirSync6 } from "node:fs";
-import { join as join8 } from "node:path";
+import { existsSync as existsSync9, readdirSync as readdirSync6 } from "node:fs";
+import { join as join12 } from "node:path";
 function findPluginRoots(root, errors3) {
   const found = [];
-  if (existsSync7(join8(root, "hooks", "hooks.json"))) {
+  if (existsSync9(join12(root, "hooks", "hooks.json"))) {
     found.push(root);
   }
   const walk = (dir, depth) => {
@@ -17831,8 +18236,8 @@ function findPluginRoots(root, errors3) {
       if (entry.name.startsWith(".") && entry.name !== ".claude") {
         continue;
       }
-      const child = join8(dir, entry.name);
-      if (existsSync7(join8(child, ".claude-plugin", "plugin.json"))) {
+      const child = join12(dir, entry.name);
+      if (existsSync9(join12(child, ".claude-plugin", "plugin.json"))) {
         found.push(child);
         continue;
       }
@@ -17848,8 +18253,8 @@ function findPluginRoots(root, errors3) {
 function discoverPluginHooks(root, errors3) {
   const facts = [];
   for (const pluginRoot of findPluginRoots(root, errors3)) {
-    const filePath = join8(pluginRoot, "hooks", "hooks.json");
-    if (!existsSync7(filePath)) {
+    const filePath = join12(pluginRoot, "hooks", "hooks.json");
+    if (!existsSync9(filePath)) {
       continue;
     }
     const raw = readJsonConfig(filePath, errors3);
@@ -17878,11 +18283,11 @@ function discoverPluginHooks(root, errors3) {
 }
 
 // src/discover/policy.ts
-import { existsSync as existsSync8 } from "node:fs";
-import { homedir as homedir5 } from "node:os";
-import { basename as basename7, dirname as dirname5, join as join9, resolve as resolve5 } from "node:path";
+import { existsSync as existsSync10 } from "node:fs";
+import { homedir as homedir7 } from "node:os";
+import { basename as basename7, dirname as dirname6, join as join13, resolve as resolve6 } from "node:path";
 function readPolicyFile(filePath, errors3, meta) {
-  if (!existsSync8(filePath)) {
+  if (!existsSync10(filePath)) {
     return;
   }
   try {
@@ -17900,7 +18305,7 @@ function readPolicyFile(filePath, errors3, meta) {
       text,
       sourceProvider: meta.sourceProvider,
       kind: meta.kind,
-      hopsFromStart: hopsFrom(meta.startDir, meta.hopsDir ?? dirname5(filePath))
+      hopsFromStart: hopsFrom(meta.startDir, meta.hopsDir ?? dirname6(filePath))
     };
   } catch (err) {
     errors3.push({
@@ -17915,7 +18320,7 @@ function addUnique(out, seen, fact) {
   if (fact === undefined) {
     return;
   }
-  const key = resolve5(fact.path);
+  const key = resolve6(fact.path);
   if (seen.has(key)) {
     return;
   }
@@ -17923,46 +18328,61 @@ function addUnique(out, seen, fact) {
   out.push(fact);
 }
 function resolveCodexProjectRoot(startDir, scanBoundary, markers) {
-  const start = resolve5(startDir);
-  const boundary = resolve5(scanBoundary);
+  const start = resolve6(startDir);
+  const boundary = resolve6(scanBoundary);
   if (markers !== undefined && markers.length === 0) {
     return start;
   }
   const names = markers ?? [".git"];
   for (const dir of ancestorDirsInclusive(start, boundary)) {
-    if (names.some((name) => existsSync8(join9(dir, name)))) {
+    if (names.some((name) => existsSync10(join13(dir, name)))) {
       return dir;
     }
   }
   return boundary;
 }
 function isCommandcodeMemoryFallback(abs) {
-  return basename7(abs) === "AGENTS.md" && basename7(dirname5(abs)) === ".commandcode";
+  return basename7(abs) === "AGENTS.md" && basename7(dirname6(abs)) === ".commandcode";
 }
 function discoverPolicyFiles(root, policyFiles, errors3, startDir = root, includeGlobal = false, _commandcodeProjectRoot = root, fallbackFilenames = []) {
   const out = [];
   const seen = new Set;
-  const start = resolve5(startDir);
+  const start = resolve6(startDir);
   for (const rel of policyFiles) {
     const kind = basename7(rel) === "CLAUDE.md" || basename7(rel) === "CLAUDE.local.md" ? "claude-md" : basename7(rel).endsWith(".instructions.md") || basename7(rel) === "copilot-instructions.md" ? "vscode-instructions" : "agents-md";
     const sourceProvider = kind === "claude-md" ? "claude" : kind === "vscode-instructions" ? "vscode" : "unknown";
-    addUnique(out, seen, readPolicyFile(join9(root, rel), errors3, { sourceProvider, kind, startDir: start }));
+    addUnique(out, seen, readPolicyFile(join13(root, rel), errors3, { sourceProvider, kind, startDir: start }));
   }
   for (const dir of ancestorDirsInclusive(start, root)) {
-    addUnique(out, seen, readPolicyFile(join9(dir, "AGENTS.md"), errors3, {
+    addUnique(out, seen, readPolicyFile(join13(dir, "AGENTS.md"), errors3, {
+      sourceProvider: "unknown",
+      kind: "agents-md",
+      startDir: start
+    }));
+    addUnique(out, seen, readPolicyFile(join13(dir, "agents.md"), errors3, {
       sourceProvider: "unknown",
       kind: "agents-md",
       startDir: start
     }));
-    if (!existsSync8(join9(dir, "AGENTS.md"))) {
-      addUnique(out, seen, readPolicyFile(join9(dir, ".commandcode", "AGENTS.md"), errors3, {
+    addUnique(out, seen, readPolicyFile(join13(dir, "Agents.md"), errors3, {
+      sourceProvider: "grok",
+      kind: "agents-md",
+      startDir: start
+    }));
+    addUnique(out, seen, readPolicyFile(join13(dir, "AGENT.md"), errors3, {
+      sourceProvider: "grok",
+      kind: "agents-md",
+      startDir: start
+    }));
+    if (!existsSync10(join13(dir, "AGENTS.md"))) {
+      addUnique(out, seen, readPolicyFile(join13(dir, ".commandcode", "AGENTS.md"), errors3, {
         sourceProvider: "commandcode",
         kind: "agents-md",
         startDir: start,
         hopsDir: dir
       }));
     }
-    addUnique(out, seen, readPolicyFile(join9(dir, "AGENTS.override.md"), errors3, {
+    addUnique(out, seen, readPolicyFile(join13(dir, "AGENTS.override.md"), errors3, {
       sourceProvider: "codex",
       kind: "agents-md",
       startDir: start
@@ -17971,23 +18391,23 @@ function discoverPolicyFiles(root, policyFiles, errors3, startDir = root, includ
       if (name === "AGENTS.md" || name === "AGENTS.override.md" || basename7(name) !== name) {
         continue;
       }
-      addUnique(out, seen, readPolicyFile(join9(dir, name), errors3, {
+      addUnique(out, seen, readPolicyFile(join13(dir, name), errors3, {
         sourceProvider: "codex",
         kind: "agents-md",
         startDir: start
       }));
     }
-    addUnique(out, seen, readPolicyFile(join9(dir, "CLAUDE.md"), errors3, {
+    addUnique(out, seen, readPolicyFile(join13(dir, "CLAUDE.md"), errors3, {
       sourceProvider: "claude",
       kind: "claude-md",
       startDir: start
     }));
-    addUnique(out, seen, readPolicyFile(join9(dir, ".claude", "CLAUDE.md"), errors3, {
+    addUnique(out, seen, readPolicyFile(join13(dir, ".claude", "CLAUDE.md"), errors3, {
       sourceProvider: "claude",
       kind: "claude-md",
       startDir: start
     }));
-    addUnique(out, seen, readPolicyFile(join9(dir, "CLAUDE.local.md"), errors3, {
+    addUnique(out, seen, readPolicyFile(join13(dir, "CLAUDE.local.md"), errors3, {
       sourceProvider: "claude",
       kind: "claude-md",
       startDir: start
@@ -17996,14 +18416,14 @@ function discoverPolicyFiles(root, policyFiles, errors3, startDir = root, includ
   for (const abs of walkFiles(root, {
     maxDepth: NESTED_DISCOVERY_MAX_DEPTH,
     match: (abs2, name) => {
-      if (name === "AGENTS.override.md") {
+      if (name === "AGENTS.override.md" || name === "Agents.md" || name === "AGENT.md" || name === "agents.md") {
         return true;
       }
       if (name !== "AGENTS.md") {
         return false;
       }
-      if (basename7(dirname5(abs2)) === ".commandcode") {
-        return !existsSync8(join9(dirname5(dirname5(abs2)), "AGENTS.md"));
+      if (basename7(dirname6(abs2)) === ".commandcode") {
+        return !existsSync10(join13(dirname6(dirname6(abs2)), "AGENTS.md"));
       }
       return true;
     },
@@ -18011,19 +18431,19 @@ function discoverPolicyFiles(root, policyFiles, errors3, startDir = root, includ
   })) {
     const commandcodeMemory = isCommandcodeMemoryFallback(abs);
     addUnique(out, seen, readPolicyFile(abs, errors3, {
-      sourceProvider: commandcodeMemory ? "commandcode" : basename7(abs) === "AGENTS.override.md" ? "codex" : "unknown",
+      sourceProvider: commandcodeMemory ? "commandcode" : basename7(abs) === "AGENTS.override.md" ? "codex" : basename7(abs) === "Agents.md" || basename7(abs) === "AGENT.md" ? "grok" : "unknown",
       kind: "agents-md",
       startDir: start,
-      ...commandcodeMemory ? { hopsDir: dirname5(dirname5(abs)) } : {}
+      ...commandcodeMemory ? { hopsDir: dirname6(dirname6(abs)) } : {}
     }));
   }
-  addUnique(out, seen, readPolicyFile(join9(root, ".github", "copilot-instructions.md"), errors3, {
+  addUnique(out, seen, readPolicyFile(join13(root, ".github", "copilot-instructions.md"), errors3, {
     sourceProvider: "vscode",
     kind: "vscode-instructions",
     startDir: start
   }));
-  const instructionsDir = join9(root, ".github", "instructions");
-  if (existsSync8(instructionsDir)) {
+  const instructionsDir = join13(root, ".github", "instructions");
+  if (existsSync10(instructionsDir)) {
     for (const abs of walkFiles(instructionsDir, {
       maxDepth: NESTED_DISCOVERY_MAX_DEPTH,
       match: (_abs, name) => name.endsWith(".instructions.md"),
@@ -18037,17 +18457,17 @@ function discoverPolicyFiles(root, policyFiles, errors3, startDir = root, includ
     }
   }
   if (includeGlobal) {
-    addUnique(out, seen, readPolicyFile(join9(homedir5(), ".codex", "AGENTS.override.md"), errors3, {
+    addUnique(out, seen, readPolicyFile(join13(homedir7(), ".codex", "AGENTS.override.md"), errors3, {
       sourceProvider: "codex",
       kind: "agents-md",
       startDir: start
     }));
-    addUnique(out, seen, readPolicyFile(join9(homedir5(), ".codex", "AGENTS.md"), errors3, {
+    addUnique(out, seen, readPolicyFile(join13(homedir7(), ".codex", "AGENTS.md"), errors3, {
       sourceProvider: "codex",
       kind: "agents-md",
       startDir: start
     }));
-    addUnique(out, seen, readPolicyFile(join9(homedir5(), ".commandcode", "AGENTS.md"), errors3, {
+    addUnique(out, seen, readPolicyFile(join13(homedir7(), ".commandcode", "AGENTS.md"), errors3, {
       sourceProvider: "commandcode",
       kind: "agents-md",
       startDir: start
@@ -18087,7 +18507,7 @@ function parseSkillsLockFile(filePath, errors3) {
     });
     return { entries: [], invalid: true };
   }
-  const lockRoot = dirname5(resolve5(filePath));
+  const lockRoot = dirname6(resolve6(filePath));
   const locked = [];
   for (const [id, value] of Object.entries(skills)) {
     const entry = { id, lockRoot, lockPath: filePath };
@@ -18114,8 +18534,8 @@ function discoverSkillsLocks(scanBoundary, projectRoot, errors3) {
   let present = false;
   let validCount = 0;
   const consider = (filePath) => {
-    const resolved = resolve5(filePath);
-    if (seen.has(resolved) || !existsSync8(resolved)) {
+    const resolved = resolve6(filePath);
+    if (seen.has(resolved) || !existsSync10(resolved)) {
       return;
     }
     seen.add(resolved);
@@ -18125,10 +18545,10 @@ function discoverSkillsLocks(scanBoundary, projectRoot, errors3) {
       return;
     }
     validCount += 1;
-    lockRoots.push(dirname5(resolved));
+    lockRoots.push(dirname6(resolved));
     locked.push(...parsed.entries);
   };
-  consider(join9(projectRoot, "skills-lock.json"));
+  consider(join13(projectRoot, "skills-lock.json"));
   for (const abs of walkFiles(scanBoundary, {
     maxDepth: NESTED_DISCOVERY_MAX_DEPTH,
     match: (_abs, name) => name === "skills-lock.json",
@@ -18145,12 +18565,37 @@ function discoverSkillsLocks(scanBoundary, projectRoot, errors3) {
 }
 
 // src/discover/rules.ts
-import { existsSync as existsSync9 } from "node:fs";
-import { join as join10 } from "node:path";
+import { existsSync as existsSync11 } from "node:fs";
+import { basename as basename8, dirname as dirname7, join as join14 } from "node:path";
 function lineCount2(text) {
   return text.length === 0 ? 0 : text.replace(/\r?\n$/, "").split(/\r?\n/).length;
 }
-function readRule(path, sourceProvider, errors3) {
+function windsurfWorkspaceHasTrigger(text) {
+  let body = text;
+  if (body.charCodeAt(0) === 65279) {
+    body = body.slice(1);
+  }
+  body = body.replace(/\r\n/g, `
+`);
+  if (!body.startsWith("---")) {
+    return false;
+  }
+  const fence = /\n(?:---|\.\.\.)[ \t]*(?:\n|$)/.exec(body.slice(3));
+  if (fence === null) {
+    return false;
+  }
+  try {
+    const block = $parse(body.slice(3, 3 + fence.index));
+    if (block === null || typeof block !== "object" || Array.isArray(block)) {
+      return false;
+    }
+    const trigger = block.trigger;
+    return typeof trigger === "string" && trigger.trim().length > 0;
+  } catch {
+    return false;
+  }
+}
+function readRuleFile(path, sourceProvider, errors3, extras) {
   try {
     const result = readCapped(path, POLICY_CAP);
     const text = result.buf.subarray(0, POLICY_CAP).toString("utf8");
@@ -18161,11 +18606,15 @@ function readRule(path, sourceProvider, errors3) {
         detail: `file exceeds ${POLICY_CAP} byte scan cap`
       });
     }
+    const windsurfScope = extras?.windsurfScope;
     return {
       path,
       sourceProvider,
       lineCount: lineCount2(text),
-      byteLength: result.buf.length
+      byteLength: result.buf.length,
+      charCount: text.length,
+      ...windsurfScope === undefined ? {} : { windsurfScope },
+      ...windsurfScope === "workspace" ? { windsurfHasTrigger: windsurfWorkspaceHasTrigger(text) } : {}
     };
   } catch (err) {
     errors3.push({
@@ -18176,40 +18625,111 @@ function readRule(path, sourceProvider, errors3) {
     return;
   }
 }
+function collectMdRules(dir, sourceProvider, errors3, extras) {
+  const out = [];
+  if (!existsSync11(dir)) {
+    return out;
+  }
+  for (const abs of walkFiles(dir, {
+    maxDepth: NESTED_DISCOVERY_MAX_DEPTH,
+    match: (_abs, name) => name.endsWith(".md"),
+    errors: errors3
+  })) {
+    const fact = readRuleFile(abs, sourceProvider, errors3, extras);
+    if (fact !== undefined) {
+      out.push(fact);
+    }
+  }
+  return out;
+}
+function isWindsurfWorkspaceRulePath(abs, name) {
+  if (!name.endsWith(".md")) {
+    return false;
+  }
+  const normalized = abs.replaceAll("\\", "/");
+  return normalized.includes("/.devin/rules/") || normalized.includes("/.windsurf/rules/");
+}
 function discoverRules(root, errors3) {
   const out = [];
-  const cursorRules = join10(root, ".cursor", "rules");
-  if (existsSync9(cursorRules)) {
+  const cursorRules = join14(root, ".cursor", "rules");
+  if (existsSync11(cursorRules)) {
     for (const abs of walkFiles(cursorRules, {
       maxDepth: NESTED_DISCOVERY_MAX_DEPTH,
       match: (_abs, name) => name.endsWith(".mdc"),
       errors: errors3
     })) {
-      const fact = readRule(abs, "cursor", errors3);
+      const fact = readRuleFile(abs, "cursor", errors3);
       if (fact !== undefined) {
         out.push(fact);
       }
     }
   }
-  const claudeRules = join10(root, ".claude", "rules");
-  if (existsSync9(claudeRules)) {
-    for (const abs of walkFiles(claudeRules, {
-      maxDepth: NESTED_DISCOVERY_MAX_DEPTH,
-      match: (_abs, name) => name.endsWith(".md"),
-      errors: errors3
-    })) {
-      const fact = readRule(abs, "claude", errors3);
-      if (fact !== undefined) {
-        out.push(fact);
-      }
+  out.push(...collectMdRules(join14(root, ".grok", "rules"), "grok", errors3));
+  out.push(...collectMdRules(join14(root, ".claude", "rules"), "claude", errors3));
+  out.push(...collectMdRules(join14(root, ".devin", "rules"), "windsurf", errors3, {
+    windsurfScope: "workspace"
+  }));
+  out.push(...collectMdRules(join14(root, ".windsurf", "rules"), "windsurf", errors3, {
+    windsurfScope: "workspace"
+  }));
+  const legacy = join14(root, ".windsurfrules");
+  if (existsSync11(legacy) && basename8(legacy) === ".windsurfrules") {
+    const fact = readRuleFile(legacy, "windsurf", errors3, { windsurfScope: "legacy" });
+    if (fact !== undefined) {
+      out.push(fact);
     }
   }
   return out;
 }
+function discoverNestedWindsurfRules(scanBoundary, errors3) {
+  const out = [];
+  for (const abs of walkFiles(scanBoundary, {
+    maxDepth: NESTED_DISCOVERY_MAX_DEPTH,
+    match: isWindsurfWorkspaceRulePath,
+    errors: errors3
+  })) {
+    const fact = readRuleFile(abs, "windsurf", errors3, { windsurfScope: "workspace" });
+    if (fact !== undefined) {
+      out.push(fact);
+    }
+  }
+  return out;
+}
+function discoverWindsurfGlobalRules(filePath, errors3) {
+  if (!existsSync11(filePath) || basename8(filePath) !== "global_rules.md") {
+    return [];
+  }
+  if (basename8(dirname7(filePath)) !== "memories") {
+    return [];
+  }
+  const fact = readRuleFile(filePath, "windsurf", errors3, { windsurfScope: "global" });
+  return fact === undefined ? [] : [fact];
+}
+
+// src/discover/windsurf.ts
+import { existsSync as existsSync12 } from "node:fs";
+import { homedir as homedir8 } from "node:os";
+import { dirname as dirname8, join as join15 } from "node:path";
+function windsurfUserMcpPath(home = homedir8()) {
+  return join15(home, ".codeium", "windsurf", "mcp_config.json");
+}
+function windsurfGlobalRulesPath(home = homedir8()) {
+  return join15(home, ".codeium", "windsurf", "memories", "global_rules.md");
+}
+function discoverWindsurfUserMcp(errors3) {
+  const filePath = windsurfUserMcpPath();
+  if (!existsSync12(filePath)) {
+    return [];
+  }
+  return parseWindsurfJsonFile(filePath, dirname8(filePath), errors3);
+}
+function discoverWindsurfUserRules(errors3) {
+  return discoverWindsurfGlobalRules(windsurfGlobalRulesPath(), errors3);
+}
 
 // src/discover/skills.ts
-import { existsSync as existsSync10, readdirSync as readdirSync7, statSync as statSync5 } from "node:fs";
-import { basename as basename8, join as join11, resolve as resolve6 } from "node:path";
+import { existsSync as existsSync13, readdirSync as readdirSync7, statSync as statSync5 } from "node:fs";
+import { basename as basename9, join as join16, resolve as resolve7 } from "node:path";
 var BUNDLED = "scripts|references|assets|templates|examples";
 var REFERENCE_RE = new RegExp(`(?<![\\w/.-])(?:\\./)?((?:${BUNDLED})/[A-Za-z0-9_./-]+\\.[A-Za-z0-9]{1,10})(?![A-Za-z0-9_.-])`, "g");
 var FENCE_BLOCK = /^[ \t]*(`{3,}|~{3,})[^\n]*\n[\s\S]*?(?:^[ \t]*\1[ \t]*$|$)/gm;
@@ -18251,13 +18771,13 @@ function brokenReferences(body, skillDir, root, skillRootOnly) {
     }
   };
   return skillReferences(body).filter((rel) => {
-    if (isFilePath(join11(skillDir, rel))) {
+    if (isFilePath(join16(skillDir, rel))) {
       return false;
     }
     if (skillRootOnly) {
       return true;
     }
-    return !isFilePath(join11(root, rel));
+    return !isFilePath(join16(root, rel));
   });
 }
 function readDirNames(dir, errors3) {
@@ -18291,7 +18811,7 @@ function findSkillMdDirs(dir, errors3, depth = 0) {
   if (names === undefined) {
     return [];
   }
-  if (isFile3(join11(dir, "SKILL.md"))) {
+  if (isFile3(join16(dir, "SKILL.md"))) {
     return [dir];
   }
   if (depth >= NESTED_DISCOVERY_MAX_DEPTH) {
@@ -18302,7 +18822,7 @@ function findSkillMdDirs(dir, errors3, depth = 0) {
     if (name.startsWith(".") || name === "node_modules" || NESTED_DISCOVERY_SKIP.has(name)) {
       continue;
     }
-    const child = join11(dir, name);
+    const child = join16(dir, name);
     if (!isDirectory3(child)) {
       continue;
     }
@@ -18362,10 +18882,10 @@ function skillFactFromDir(skillDir, source, skillsRoot, errors3, root, opts) {
   const normalizedRoot = skillsRoot.replaceAll("\\", "/");
   const sourceProvider = providerFromSkillsDir(normalizedRoot);
   const schemaProfile = schemaProfileFromSkillsDir(normalizedRoot);
-  const skillMd = join11(skillDir, "SKILL.md");
+  const skillMd = join16(skillDir, "SKILL.md");
   const fm = opts.hasSkillMd ? readFrontmatter(skillMd, errors3) : { hasFrontmatter: false };
   const fact = {
-    id: basename8(skillDir),
+    id: basename9(skillDir),
     sourceProvider,
     schemaProfile,
     path: skillDir,
@@ -18422,7 +18942,7 @@ function skillFactFromDir(skillDir, source, skillsRoot, errors3, root, opts) {
   return fact;
 }
 function discoverSkillsInDir(dir, source, errors3, root) {
-  if (!existsSync10(dir)) {
+  if (!existsSync13(dir)) {
     return [];
   }
   const names = readDirNames(dir, errors3);
@@ -18430,18 +18950,18 @@ function discoverSkillsInDir(dir, source, errors3, root) {
     return [];
   }
   const found = findSkillMdDirs(dir, errors3);
-  const foundSet = new Set(found.map((path) => resolve6(path)));
+  const foundSet = new Set(found.map((path) => resolve7(path)));
   const skills = found.map((skillDir) => skillFactFromDir(skillDir, source, dir, errors3, root, { hasSkillMd: true }));
   for (const name of names) {
     if (name.startsWith(".") || name === "node_modules") {
       continue;
     }
-    const child = join11(dir, name);
+    const child = join16(dir, name);
     if (!isDirectory3(child)) {
       continue;
     }
-    const resolved = resolve6(child);
-    if (foundSet.has(resolved) || found.some((path) => resolve6(path).startsWith(`${resolved}/`))) {
+    const resolved = resolve7(child);
+    if (foundSet.has(resolved) || found.some((path) => resolve7(path).startsWith(`${resolved}/`))) {
       continue;
     }
     let dirReadable = true;
@@ -18481,8 +19001,8 @@ function discoverNestedClaudeSkills(root, configuredRoots, errors3, options = {}
     for (const entry of entries) {
       if (!entry.isDirectory() || entry.name !== "skills")
         continue;
-      const child = join11(dir, entry.name);
-      if (configuredRoots.has(resolve6(child)))
+      const child = join16(dir, entry.name);
+      if (configuredRoots.has(resolve7(child)))
         continue;
       out.push(...discoverSkillsInDir(child, "project", errors3, root));
     }
@@ -18496,7 +19016,7 @@ function discoverNestedClaudeSkills(root, configuredRoots, errors3, options = {}
         continue;
       if (entry.name.startsWith(".") && !NESTED_SKILL_PARENTS.has(entry.name))
         continue;
-      const child = join11(dir, entry.name);
+      const child = join16(dir, entry.name);
       if (NESTED_SKILL_PARENTS.has(entry.name)) {
         inspectSkillsParent(child);
         continue;
@@ -18525,6 +19045,19 @@ function disambiguateSkills(skills, root) {
 function mcpKey(fact) {
   return `${fact.name}@${fact.path}${fact.platform === undefined ? "" : `:${fact.platform}`}`;
 }
+function uniqueRules(facts) {
+  const seen = new Set;
+  const out = [];
+  for (const fact of facts) {
+    const key = resolve8(fact.path);
+    if (seen.has(key)) {
+      continue;
+    }
+    seen.add(key);
+    out.push(fact);
+  }
+  return out;
+}
 function discoverAgentSurface(root, config, opts) {
   const startDir = opts.startDir ?? root;
   const scanBoundary = opts.scanBoundary ?? root;
@@ -18538,12 +19071,12 @@ function discoverAgentSurface(root, config, opts) {
       if (isCommandcodeSkillsRel(rel)) {
         continue;
       }
-      const abs = resolve7(dir, rel);
+      const abs = resolve8(dir, rel);
       configuredRoots.add(abs);
       skills.push(...discoverSkillsInDir(abs, "project", configErrors, root));
     }
   }
-  const commandcodeSkills = resolve7(commandcodeProjectRoot, ".commandcode", "skills");
+  const commandcodeSkills = resolve8(commandcodeProjectRoot, ".commandcode", "skills");
   if (!configuredRoots.has(commandcodeSkills)) {
     configuredRoots.add(commandcodeSkills);
     skills.push(...discoverSkillsInDir(commandcodeSkills, "project", configErrors, root));
@@ -18554,27 +19087,28 @@ function discoverAgentSurface(root, config, opts) {
   const ccLayers = readCommandcodeSettingsLayers(commandcodeProjectRoot, configErrors, opts.includeGlobal);
   const extraDirs = [];
   for (const declared of winningSkillsExtraDirs(ccLayers)) {
-    const abs = resolve7(resolveSkillLocation(commandcodeProjectRoot, declared));
+    const abs = resolve8(resolveSkillLocation(commandcodeProjectRoot, declared));
     extraDirs.push(abs);
     if (configuredRoots.has(abs)) {
       continue;
     }
     configuredRoots.add(abs);
-    const homeRoot = resolve7(homedir6());
+    const homeRoot = resolve8(homedir9());
     const source = abs === homeRoot || abs.startsWith(`${homeRoot}/`) ? "global" : "project";
     const extra = discoverSkillsInDir(abs, source, configErrors, root);
     skills.push(...extra.map((skill) => skill.schemaProfile === "agent-skills" ? skill : { ...skill, schemaProfile: "agent-skills" }));
   }
   if (opts.includeGlobal) {
-    const home = homedir6();
+    const home = homedir9();
     const globalSkillDirs = [
-      join12(home, ".claude", "skills"),
-      join12(home, ".codex", "skills"),
-      join12(home, ".commandcode", "skills"),
-      join12(home, ".agents", "skills")
+      join17(home, ".claude", "skills"),
+      join17(home, ".codex", "skills"),
+      join17(home, ".commandcode", "skills"),
+      join17(home, ".agents", "skills"),
+      join17(grokHomeDir(), "skills")
     ];
     for (const abs of globalSkillDirs) {
-      const resolved = resolve7(abs);
+      const resolved = resolve8(abs);
       if (configuredRoots.has(resolved)) {
         continue;
       }
@@ -18582,7 +19116,7 @@ function discoverAgentSurface(root, config, opts) {
       skills.push(...discoverSkillsInDir(abs, "global", configErrors, root));
     }
   }
-  const agentsSkillsRoots = commandcodeAgentsSkillsRoots(startDir, scanBoundary, homedir6());
+  const agentsSkillsRoots = commandcodeAgentsSkillsRoots(startDir, scanBoundary, homedir9());
   applyCommandcodeSkillPrecedence(skills, {
     commandcodeProjectRoot,
     extraDirs,
@@ -18602,6 +19136,7 @@ function discoverAgentSurface(root, config, opts) {
   for (const dir of dirs) {
     hooks.push(...discoverHooks(dir, configErrors));
     hooks.push(...discoverVscodeHooks(dir, configErrors));
+    hooks.push(...discoverGrokHooks(join17(dir, ".grok", "hooks"), dir, configErrors));
     const discovered = discoverMcpSurface(dir, config.mcpPaths, configErrors);
     if (discovered.codexProjectDocMaxBytes !== undefined && codexProjectDocMaxBytes === undefined) {
       codexProjectDocMaxBytes = discovered.codexProjectDocMaxBytes;
@@ -18622,6 +19157,7 @@ function discoverAgentSurface(root, config, opts) {
     }
     rules.push(...discoverRules(dir, configErrors));
   }
+  rules.push(...discoverNestedWindsurfRules(scanBoundary, configErrors));
   mcp.push(...discoverNestedContinueMcp(scanBoundary, configErrors, mcpSeen));
   hooks.push(...discoverPluginHooks(scanBoundary, configErrors));
   hooks.push(...discoverCommandcodeHooks(commandcodeProjectRoot, ccLayers, configErrors));
@@ -18635,6 +19171,23 @@ function discoverAgentSurface(root, config, opts) {
   }
   if (opts.includeGlobal) {
     hooks.push(...discoverCopilotUserHooks(configErrors));
+    hooks.push(...discoverGrokHooks(join17(grokHomeDir(), "hooks"), grokHomeDir(), configErrors));
+    for (const fact of discoverGrokUserMcp(configErrors)) {
+      const key = mcpKey(fact);
+      if (mcpSeen.has(key)) {
+        continue;
+      }
+      mcpSeen.add(key);
+      mcp.push(fact);
+    }
+    for (const fact of discoverCodexUserMcp(configErrors)) {
+      const key = mcpKey(fact);
+      if (mcpSeen.has(key)) {
+        continue;
+      }
+      mcpSeen.add(key);
+      mcp.push(fact);
+    }
     for (const fact of discoverCommandcodeUserMcp(commandcodeProjectRoot, configErrors)) {
       const key = mcpKey(fact);
       if (mcpSeen.has(key)) {
@@ -18643,8 +19196,18 @@ function discoverAgentSurface(root, config, opts) {
       mcpSeen.add(key);
       mcp.push(fact);
     }
+    for (const fact of discoverWindsurfUserMcp(configErrors)) {
+      const key = mcpKey(fact);
+      if (mcpSeen.has(key)) {
+        continue;
+      }
+      mcpSeen.add(key);
+      mcp.push(fact);
+    }
+    rules.push(...discoverWindsurfUserRules(configErrors));
   }
   applyCommandcodeMcpPrecedence(mcp, commandcodeProjectRoot);
+  applyGrokMcpPrecedence(mcp, startDir);
   const slashCommands = discoverCommandcodeCommands(commandcodeProjectRoot, opts.includeGlobal, configErrors);
   const mods = discoverCommandcodeMods(ccLayers);
   const winningModel = winningCommandcodeModel(ccLayers);
@@ -18661,7 +19224,7 @@ function discoverAgentSurface(root, config, opts) {
     hooks: allHooks,
     mcp,
     policyFiles: discoverPolicyFiles(scanBoundary, config.policyFiles, configErrors, startDir, opts.includeGlobal, commandcodeProjectRoot, codexProjectDocFallbackFilenames ?? []),
-    rules,
+    rules: uniqueRules(rules),
     lockedSkills: lock.locked,
     hasSkillsLock: lock.present,
     skillsLockInvalid: lock.invalid,
@@ -18679,11 +19242,11 @@ function discoverAgentSurface(root, config, opts) {
 }
 
 // src/facts/extract.ts
-import { existsSync as existsSync11, readFileSync as readFileSync4 } from "node:fs";
-import { join as join13 } from "node:path";
+import { existsSync as existsSync14, readFileSync as readFileSync4 } from "node:fs";
+import { join as join18 } from "node:path";
 function readPackageJson(root, errors3) {
-  const path = join13(root, "package.json");
-  if (!existsSync11(path)) {
+  const path = join18(root, "package.json");
+  if (!existsSync14(path)) {
     return {};
   }
   let text;
@@ -18781,16 +19344,16 @@ function inferPackageManager(root, pkg) {
       return prefix;
     }
   }
-  if (existsSync11(join13(root, "bun.lock")) || existsSync11(join13(root, "bun.lockb"))) {
+  if (existsSync14(join18(root, "bun.lock")) || existsSync14(join18(root, "bun.lockb"))) {
     return "bun";
   }
-  if (existsSync11(join13(root, "pnpm-lock.yaml"))) {
+  if (existsSync14(join18(root, "pnpm-lock.yaml"))) {
     return "pnpm";
   }
-  if (existsSync11(join13(root, "yarn.lock"))) {
+  if (existsSync14(join18(root, "yarn.lock"))) {
     return "yarn";
   }
-  if (existsSync11(join13(root, "package-lock.json"))) {
+  if (existsSync14(join18(root, "package-lock.json"))) {
     return "npm";
   }
   return "unknown";
@@ -18867,7 +19430,7 @@ function compareAction(a, b) {
 
 // src/analyze.ts
 function analyze(options = {}) {
-  const requested = resolve8(options.dir ?? process.cwd());
+  const requested = resolve9(options.dir ?? process.cwd());
   const ctx = resolveScanContext(requested);
   const root = ctx.projectRoot;
   const loaded = loadConfig(root, options.configPath);
@@ -18998,7 +19561,7 @@ function renderJson(args) {
 }
 
 // src/report/prompt.ts
-import { basename as basename9 } from "node:path";
+import { basename as basename10 } from "node:path";
 
 // src/report/safe.ts
 var MAX_RENDERED = 400;
@@ -19033,7 +19596,7 @@ function safe(value) {
 function renderPrompt(args) {
   const { version, facts } = args;
   const actionable = sortFindings(args.findings).filter((f) => f.severity !== "info");
-  const project = basename9(facts.root) || facts.root;
+  const project = basename10(facts.root) || facts.root;
   if (actionable.length === 0) {
     return [
       `# agentscan v${version} — ${safe(project)}`,
@@ -19083,7 +19646,7 @@ function headingFor(severity) {
 }
 
 // src/report/text.ts
-import { basename as basename10 } from "node:path";
+import { basename as basename11 } from "node:path";
 
 // src/report/ansi.ts
 var CODES = {
@@ -19184,7 +19747,7 @@ function formatHeaderBox(findings, verbose, name, ink) {
   ];
 }
 function projectLabel(root) {
-  const base = basename10(root);
+  const base = basename11(root);
   return base.length > 0 ? base : root;
 }
 function formatStack(facts) {
@@ -19295,7 +19858,7 @@ function formatSummary(findings, verbose, ink) {
 }
 
 // src/version.ts
-var VERSION = "1.1.0";
+var VERSION = "1.3.0";
 
 // src/commands/check.ts
 async function runCheck(options) {
@@ -19342,13 +19905,13 @@ import {
   writeFileSync
 } from "node:fs";
 import { tmpdir } from "node:os";
-import { join as join14 } from "node:path";
+import { join as join19 } from "node:path";
 async function runDemo() {
-  const root = mkdtempSync(join14(tmpdir(), "agentscan-demo-"));
+  const root = mkdtempSync(join19(tmpdir(), "agentscan-demo-"));
   try {
-    const claude = join14(root, ".claude");
+    const claude = join19(root, ".claude");
     mkdirSync(claude, { recursive: true });
-    writeFileSync(join14(claude, "settings.json"), `${JSON.stringify({
+    writeFileSync(join19(claude, "settings.json"), `${JSON.stringify({
       hooks: {
         PreToolUse: [
           {
@@ -19422,12 +19985,12 @@ function formatExplain(f) {
 }
 
 // src/commands/init.ts
-import { existsSync as existsSync12, writeFileSync as writeFileSync2 } from "node:fs";
-import { join as join15, resolve as resolve9 } from "node:path";
+import { existsSync as existsSync15, writeFileSync as writeFileSync2 } from "node:fs";
+import { join as join20, resolve as resolve10 } from "node:path";
 async function runInit(dir, options = {}) {
-  const root = resolve9(dir ?? process.cwd());
-  const path = join15(root, ".agentscanrc.json");
-  if (existsSync12(path) && !options.force) {
+  const root = resolve10(dir ?? process.cwd());
+  const path = join20(root, ".agentscanrc.json");
+  if (existsSync15(path) && !options.force) {
     return {
       exitCode: 2,
       stdout: "",
@@ -19463,7 +20026,7 @@ async function runRulesCommand(options = {}) {
 // src/report/clipboard.ts
 import { spawn } from "node:child_process";
 import { accessSync, constants } from "node:fs";
-import { delimiter, join as join16 } from "node:path";
+import { delimiter, join as join21 } from "node:path";
 var TOOLS = [
   ["wl-copy"],
   ["xclip", "-selection", "clipboard"],
@@ -19472,15 +20035,15 @@ var TOOLS = [
   ["clip.exe"]
 ];
 var TIMEOUT_MS = 3000;
-function clipboardCandidates(onPath = (name) => resolve10(name) !== null) {
+function clipboardCandidates(onPath = (name) => resolve11(name) !== null) {
   return TOOLS.filter((t) => onPath(t[0])).map((t) => [...t]);
 }
-function resolve10(name) {
+function resolve11(name) {
   for (const dir of (process.env.PATH ?? "").split(delimiter)) {
     if (dir.length === 0) {
       continue;
     }
-    const candidate = join16(dir, name);
+    const candidate = join21(dir, name);
     try {
       accessSync(candidate, constants.X_OK);
       return candidate;
@@ -19499,7 +20062,7 @@ async function copyToClipboard(text) {
   const failures = [];
   for (const argv of candidates) {
     const tool = argv[0];
-    const bin = resolve10(tool);
+    const bin = resolve11(tool);
     if (bin === null) {
       continue;
     }