@dsh-cc/plugin-cc-grok-bridge 0.8.1

package/.claude-plugin/plugin.json

@@ -0,0 +1,5 @@
+{
+  "name": "cc-grok-bridge",
+  "description": "Official dsh-cc plugin: an approval-free Grok review lane — one canonical, locked-down bash invocation auto-allowed via a PreToolUse hook, with Grok's tool approvals bypassed inside the run while the dsh outer sandbox remains the single write boundary.",
+  "version": "0.8.1"
+}

package/LICENSE

@@ -0,0 +1,201 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/README.i18n.yaml

@@ -0,0 +1,6 @@
+# Bilingual-pair consistency record (docs/i18n/README.md): the git blob hash of each
+# side as of the last confirmed-consistent state. Both languages carry equal authority;
+# after editing either side, bring the other along and re-record with:
+#   pnpm check:readme --write
+README.md: 4549ad4310a124935f935c90df6de3be6aa99a66
+README.zh.md: d2178a9525fd8fbbf64aa500fc9d683a7cdcc11b

package/README.md

@@ -0,0 +1,120 @@
+# cc-grok-bridge
+
+Official dsh-cc plugin: an **approval-free Grok review lane**. Installing it lets a
+dsh-cc session run exactly one canonical, locked-down Grok review invocation —
+`node <launcher> [--last] <prompt>` — with no human permission checkpoint, by
+auto-allowing that single command form through a PreToolUse hook.
+
+The core trade is **state relocation, not sandbox widening**: Grok's tool
+approvals are bypassed inside the run (`--permission-mode bypassPermissions`),
+while the dsh outer sandbox remains the single write boundary — workspace plus
+temp areas only.
+
+## How it works
+
+- One canonical invocation form, pinned byte-for-byte: the interpreter and launcher
+  paths must be expansion-free literal tokens equal to the plugin's canonical
+  anchors — no PATH lookup, no symlink trampoline, no `~`/glob/`$VAR` expansion,
+  no compound commands, no command substitution outside single quotes.
+- A PreToolUse hook downgrades the permission verdict for exactly that form; every
+  other shape fails closed into the unchanged, approval-requiring flow.
+- Grok's session state lives in a `0700` temp-dir shadow home (`GROK_HOME`),
+  swept to a strict allowlist before each run and seeded with `auth.json`;
+  the grok CLI itself resolves to a validated absolute path at spawn.
+- Inline prompts must be single-line and must not start with `-`; multi-line or
+  dash-leading prompts go through `--prompt-file`.
+
+## Usage
+
+1. **Status at session start.** A SessionStart hook fires on every session
+   (startup and resume alike) and injects a `cc-grok-bridge:` block stating
+   whether the lane is **ARMED** — including the exact canonical invocation to
+   type — or **NOT armed** with the machine reason in plain words.
+2. **Invoke the review** with the plugin command:
+
+   ```sh
+   /cc-grok-bridge:review review the failing spec
+   ```
+
+3. **Multi-line (or dash-leading) prompts** go through `--prompt-file`: write the
+   prompt text to a file inside the workspace (or the canonical tmpdir) and use
+   the `--prompt-file <path>` form from the SessionStart block.
+4. **`--last` only on explicit continue**: the resume flag is used only when
+   the user explicitly asks to continue the previous review (it resumes the most
+   recent review thread for the current workspace).
+5. **Fail closed.** If the SessionStart block is absent or reports NOT armed,
+   the model must not guess or construct the canonical invocation — the review
+   falls back to the normal, approval-requiring path.
+
+## Authentication
+
+- `grok login --device-code` writes `~/.grok/auth.json`; the bridge seeds that
+  file into the shadow home per run (never the reverse — nothing is written
+  back to `~/.grok`).
+- Alternatively an ambient `XAI_API_KEY` passes through to the child; when it
+  is set, a missing `auth.json` source no longer warns.
+
+## Shadow-home semantics
+
+The shadow home is per-workspace (keyed on the canonicalized cwd) under the
+canonical tmpdir, mode `0700`, single-flight locked. Before every run the home
+is **swept to an allowlist** — exactly `auth.json`, `sessions/`, and the lock —
+so config, caches, and auto-loaded surfaces from the interactive Grok state
+cannot persist into the lane (cross-run injection control); the credential is
+then re-synced with `O_NOFOLLOW` + atomic-rename semantics. A missing/unreadable
+source deletes the shadow copy (a revoked token must not live on). A previous
+run that outlived its reap budget leaves an `H/.orphaned` poison marker that
+blocks further launches until a human removes it.
+
+## Dev-session degradation
+
+In dsh-cc's own repo dev sessions the launcher anchor sits inside the session
+workspace, so arming is refused (`anchor-under-writable-root`) and the lane
+degrades to the normal approval path. Expected and documented. A non-empty
+ambient `BASH_ENV` or `ENV` also disarms the lane (shell-function takeover
+defense) — and note the residual: plugin hooks themselves run through the host
+shell, so an ambient startup-interception vector could in principle forge this
+plugin's own hook verdicts; the lane carries that exposure as accepted-with-
+documentation (no in-plugin closure exists).
+
+## Security model (capability tunnel, stated plainly)
+
+Enabling the bridge means explicitly dropping the human checkpoint for this one
+command form. Unattended Grok may run any subprocess the outer sandbox permits —
+including actions the permission classifier would otherwise escalate (git push,
+ssh, cloud CLIs) and unlimited networking. **Only the filesystem write boundary
+holds** (workspace + temp areas); nothing else is claimed. The bridge is opt-in
+by installation; **uninstalling or disabling the plugin is the kill switch**.
+
+**Credential exposure, stated plainly:** any run executes as the user with
+networking; a hostile prompt (or hostile repo content under review) can read the
+shadowed `auth.json` (or an ambient `XAI_API_KEY`) and exfiltrate it. Upstream
+token lifetime bounds the shadow's value; the sync never writes back.
+
+## Cost honesty
+
+The lane is **unbounded by design**: there is no turn cap. The durable cost
+record is the per-run stderr line `grok-review: session=… cost_usd=… turns=…`
+emitted by the launcher on success (`grok usage <sessionId>` is not usable
+post-hoc, so there is no other record). Keep an eye on the line per run.
+
+## Verified version
+
+Probed end-to-end against **grok 1.0.41**. Newer grok releases may drift
+silently (no version gate by design); the standing re-probe recipe lives in the
+design doc (`docs/plans/2026-09-27-grok-review-bridge.md` §2) and should be
+re-run on grok updates.
+
+## Install / uninstall
+
+Install from the dsh-cc marketplace, plugin name `cc-grok-bridge`:
+
+```sh
+claude plugin install cc-grok-bridge@dsh-cc
+```
+
+Uninstalling (or disabling) the plugin removes the lane entirely:
+
+```sh
+claude plugin uninstall cc-grok-bridge@dsh-cc
+```

package/README.zh.md

@@ -0,0 +1,97 @@
+# cc-grok-bridge
+
+dsh-cc 官方插件：一条**免审批的 Grok 评审通道**。安装后，dsh-cc 会话可以运行唯一一种
+规范、锁死的 Grok 评审调用 —— `node <launcher> [--last] <prompt>` —— 无需人工审批：
+PreToolUse 钩子只对这一种命令形态自动放行。
+
+核心思路是**状态搬迁，而非放宽沙箱**：运行内绕过 Grok 自身的工具审批
+（`--permission-mode bypassPermissions`），同时 dsh 外层沙箱仍是唯一的写入边界 ——
+仅限工作区与临时目录。
+
+## 工作原理
+
+- 唯一的规范调用形态，逐字节锁定：解释器与启动器路径必须是不含展开的字面量，与插件的
+  规范锚点逐字节相等 —— 不走 PATH 查找、不允许符号链接跳板、禁止 `~`/glob/`$VAR` 展开、
+  禁止复合命令、单引号之外禁止命令替换。
+- PreToolUse 钩子只对这一形态降级权限判定；其他一切形态一律失败关闭（fail-closed），
+  回落到原有需审批的流程。
+- Grok 的会话状态位于临时目录中权限为 `0700` 的专属影子 home（`GROK_HOME`），每次运行前
+  按允许清单清扫并以 `auth.json` 播种；grok CLI 本身在启动时解析为经过校验的绝对路径。
+- 内联提示词必须单行且不得以 `-` 开头；多行或短横线开头的提示词走 `--prompt-file`。
+
+## 使用方法
+
+1. **会话开始时的状态块。** SessionStart 钩子在每次会话启动时触发（startup 与 resume
+   均包括），注入一个以 `cc-grok-bridge:` 开头的块：说明通道是否 **已启用（ARMED）** ——
+   并给出可照抄的规范调用 —— 或 **未启用（NOT armed）** 及其白话原因。
+2. **发起评审**，使用插件命令：
+
+   ```sh
+   /cc-grok-bridge:review review the failing spec
+   ```
+
+3. **多行（或短横线开头）的提示词** 走 `--prompt-file`：先用文件工具把提示词写入工作区内
+   （或规范临时目录）的文件，再使用 SessionStart 块中的 `--prompt-file <path>` 形态。
+4. **`--last` 仅在明确要求续聊时使用**：只有当用户明确要求继续上一次评审时才加该标志
+   （它恢复当前工作区最近一次评审线程）。
+5. **失败即关闭。** 若 SessionStart 块缺失或显示未启用，模型不得猜测或自行拼造规范调用
+   —— 评审回落到正常的需审批路径。
+
+## 认证
+
+- `grok login --device-code` 写入 `~/.grok/auth.json`；桥接每次运行把该文件播种进影子
+  home（绝不反向 —— 不会写回 `~/.grok`）。
+- 或者，环境变量 `XAI_API_KEY` 会透传给子进程；设置它之后，`auth.json` 源缺失不再警告。
+
+## 影子 home 语义
+
+影子 home 按工作区（以规范化 cwd 为键）位于规范临时目录下，权限 `0700`，单飞锁。每次
+运行前，home 会被**按允许清单清扫** —— 恰好保留 `auth.json`、`sessions/` 与锁 —— 交互式
+Grok 状态中的配置、缓存与自动加载面不会带入通道（跨运行注入控制）；随后以 `O_NOFOLLOW`
++ 原子重命名语义重新同步凭据。源缺失/不可读时删除影子副本（被吊销的令牌不得存留）。
+超出收割预算残留的上一轮运行会留下 `H/.orphaned` 毒标记，阻止后续启动，直到人工移除。
+
+## 开发会话降级
+
+在 dsh-cc 自身的仓库开发会话中，启动器锚点位于会话工作区内，启用会被拒绝
+（`anchor-under-writable-root`），通道降级为正常审批路径。预期行为，已有文档。环境变量
+`BASH_ENV` 或 `ENV` 非空时通道同样失效（防御 shell 函数劫持）—— 并请留意残留风险：插件
+钩子本身经宿主 shell 运行，环境级启动拦截向量原则上可伪造本插件自身的钩子判定；该暴露
+作为“接受并记录在案”处理（插件内无解）。
+
+## 安全模型（能力隧道，直言不讳）
+
+启用本桥接意味着明确放弃这一种命令形态的人工检查点。无人值守的 Grok 可以运行外层
+沙箱允许的任何子进程 —— 包括权限分类器本会升级处理的操作（git push、ssh、云 CLI）以及
+不受限的网络访问。**只有文件系统写入边界仍然成立**（工作区 + 临时目录），除此之外不作
+任何承诺。本插件通过安装进行选择加入；**卸载或禁用插件即是一键关闭**。
+
+**凭据暴露，直言不讳：** 任何一次运行都以用户身份并带网络执行；恶意提示词（或被评审的
+恶意仓库内容）可以读取影子 `auth.json`（或环境变量 `XAI_API_KEY`）并将其外传。上游令牌
+的生命周期限制了影子的价值；同步绝不写回。
+
+## 成本诚实
+
+该通道**按设计不设上限**：没有回合上限。持久成本记录是每次运行成功时启动器输出的
+stderr 行 `grok-review: session=… cost_usd=… turns=…`（`grok usage <sessionId>` 事后
+不可用，此外没有别的记录）。请逐次留意该行。
+
+## 已验证版本
+
+已针对 **grok 1.0.41** 端到端探明。更新的 grok 版本可能静默漂移（按设计不设版本闸门）；
+现行复探配方见设计文档（`docs/plans/2026-09-27-grok-review-bridge.md` §2），grok 更新后
+应重新执行。
+
+## 安装 / 卸载
+
+从 dsh-cc marketplace 安装，插件名 `cc-grok-bridge`：
+
+```sh
+claude plugin install cc-grok-bridge@dsh-cc
+```
+
+卸载（或禁用）插件即彻底移除该通道：
+
+```sh
+claude plugin uninstall cc-grok-bridge@dsh-cc
+```

package/commands/review.md

@@ -0,0 +1,25 @@
+---
+description: Run a Grok review through the cc-grok-bridge lane
+argument-hint: "[review request]"
+---
+
+You are dispatching a Grok review for this request from the user:
+
+$ARGUMENTS
+
+The **cc-grok-bridge** plugin's SessionStart hook injected a block at session
+start beginning with `cc-grok-bridge:` that states whether the review lane is
+ARMED and, if so, gives THE exact canonical invocation to type.
+
+Rules — follow them exactly:
+
+1. **Use the SessionStart-provided canonical block.** If it reports ARMED, run
+   the canonical invocation exactly as given there, passing this request as the
+   prompt. If the request text is multi-line (or its first character is `-`,
+   which the launcher rejects for inline prompts), write the text to a file
+   inside the current workspace (or the canonical tmpdir) with your file-write
+   tool, then use the `--prompt-file <path>` form from the block. Never edit,
+   abbreviate, or re-derive the anchor paths.
+2. **`--last` ONLY when the user explicitly asked to continue the previous
+   review** (e.g. "continue the last review"). Otherwise omit it.
+3. **Fail closed when the block is absent or reports NOT armed.** If the SessionStart block is missing or reports NOT armed, STOP: do not guess or construct any invocation; tell the user the Grok review lane is not armed in this session.

package/hooks/grok-review-allow.mjs

@@ -0,0 +1,75 @@
+#!/usr/bin/env node
+/**
+ * grok-review-allow.mjs — the §3.2 pre-execute allow listener as a plugin
+ * PreToolUse command hook.
+ *
+ * Contract: on a byte-exact canonical review invocation emit exactly one
+ * `hookSpecificOutput` allow verdict (the codec drops a top-level
+ * `decision: "allow"` — only `permissionDecision` reaches the waterfall);
+ * on EVERYTHING else — parse failure, non-Bash tool, non-match, disarmed
+ * state, refusal, containment violation — emit NOTHING and exit 0, so the
+ * command falls through to the unchanged existing permission flow. This
+ * hook never denies (fail-closed-into-silence; the SessionStart
+ * hook surfaces armed/refused state).
+ *
+ * Canonical anchors are derived per-match inside THIS process via the
+ * shared canonical.mjs module: a command hook runs through a PATH-resolved
+ * interpreter, so the byte-pinned pair is the realpath of this process's
+ * own interpreter executable and the realpath of the plugin's own launcher
+ * script (see canonical.mjs for the derivation). Both must sit outside the
+ * writable-root refusal set, ambient BASH_ENV/ENV must be empty, and the
+ * platform must not be win32, or the bridge is disarmed for this call.
+ */
+import { tmpdir } from 'node:os'
+import { isAbsolute, join } from 'node:path'
+import { arming, inside, safeReal } from '../scripts/lib/canonical.mjs'
+import { matchInvocation } from '../scripts/lib/argv.mjs'
+
+const REASON = 'cc-grok-bridge: canonical review invocation (byte-pinned anchors, expansion-free)'
+
+/** Silent pass: no stdout at all, exit 0 — the unchanged existing flow decides. */
+const silent = () => process.exit(0)
+
+let input = ''
+process.stdin.setEncoding('utf8')
+for await (const chunk of process.stdin) input += chunk
+
+let payload
+try {
+  payload = JSON.parse(input)
+} catch {
+  silent()
+}
+if (payload?.tool_name !== 'Bash') silent()
+const command = payload?.tool_input?.command
+if (typeof command !== 'string' || command === '') silent()
+
+try {
+  const arm = arming(typeof payload.cwd === 'string' ? payload.cwd : process.cwd(), { hookUrl: import.meta.url })
+  if (!arm.armed) silent()
+  const { node: NODE, launcher: LAUNCHER, cwd } = arm
+
+  const match = matchInvocation(command, { node: NODE, launcher: LAUNCHER })
+  if (!match.ok) silent()
+
+  if (match.value.prompt.kind === 'prompt-file') {
+    const raw = match.value.prompt.path
+    const abs = isAbsolute(raw) ? raw : join(cwd ?? payload.cwd, raw)
+    // Matcher-side containment: realpath must land inside the session
+    // workspace or the canonical tmpdir (a symlink escaping via realpath is
+    // refused here; the launcher re-checks on the fd it opens).
+    if (!inside(safeReal(abs), [cwd, safeReal(tmpdir())].filter((p) => p !== null))) silent()
+  }
+
+  process.stdout.write(
+    JSON.stringify({
+      hookSpecificOutput: {
+        hookEventName: 'PreToolUse',
+        permissionDecision: 'allow',
+        permissionDecisionReason: REASON,
+      },
+    }) + '\n',
+  )
+} catch {
+  silent()
+}

package/hooks/grok-review-context.mjs

@@ -0,0 +1,38 @@
+#!/usr/bin/env node
+/**
+ * grok-review-context.mjs — the SessionStart context hook.
+ *
+ * Contract: read the stdin JSON payload; on ANY failure (parse error, bad
+ * shape, derivation throw) stay silent and exit 0. On success emit exactly
+ * one line `{"hookSpecificOutput":{"hookEventName":"SessionStart",
+ * "additionalContext": <text>}}` where the text is the armed block (the
+ * exact canonical invocation to type) or the refused block (machine reason
+ * in plain words). Arming comes from the shared canonical.mjs — the same
+ * derivation the PreToolUse allow hook applies per call.
+ */
+import { armedText, arming, refusedText } from '../scripts/lib/canonical.mjs'
+
+let input = ''
+process.stdin.setEncoding('utf8')
+for await (const chunk of process.stdin) input += chunk
+
+let payload
+try {
+  payload = JSON.parse(input)
+} catch {
+  process.exit(0)
+}
+const cwd = typeof payload?.cwd === 'string' && payload.cwd !== '' ? payload.cwd : process.cwd()
+
+let text
+try {
+  const arm = arming(cwd, { hookUrl: import.meta.url })
+  text = arm.armed ? armedText(arm) : refusedText(arm.reason)
+} catch {
+  process.exit(0)
+}
+
+process.stdout.write(
+  JSON.stringify({ hookSpecificOutput: { hookEventName: 'SessionStart', additionalContext: text } }) + '\n',
+)
+process.exit(0)

package/hooks/hooks.json

@@ -0,0 +1,27 @@
+{
+  "hooks": {
+    "PreToolUse": [
+      {
+        "matcher": "Bash",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/grok-review-allow.mjs\"",
+            "timeout": 5
+          }
+        ]
+      }
+    ],
+    "SessionStart": [
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/grok-review-context.mjs\"",
+            "timeout": 5
+          }
+        ]
+      }
+    ]
+  }
+}

package/package.json

@@ -0,0 +1,22 @@
+{
+  "name": "@dsh-cc/plugin-cc-grok-bridge",
+  "version": "0.8.1",
+  "description": "Official dsh-cc plugin: an approval-free Grok review lane — one canonical, locked-down bash invocation auto-allowed via a PreToolUse hook, with Grok's tool approvals bypassed inside the run while the dsh outer sandbox remains the single write boundary.",
+  "type": "module",
+  "license": "Apache-2.0",
+  "files": [
+    ".claude-plugin/plugin.json",
+    "commands",
+    "hooks",
+    "scripts",
+    "README.md"
+  ],
+  "publishConfig": {
+    "access": "public"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/dsh-cc/dsh-cc.git",
+    "directory": "packages/plugin/cc-grok-bridge"
+  }
+}