@miraland-labs/conduit-bridge 0.16.0 → 0.16.2

package/README.md

@@ -15,6 +15,7 @@ Local Bridge CLI for [Conduit](https://github.com/miralandlabs/conduit). Connect
   - **Pi** — `pi` (local fuel, Experimental; pin `@earendil-works/pi-coding-agent`)
   - **Kiro CLI** — `kiro-cli` (local fuel)
   - **Antigravity** — `agy` (local fuel)
+  - **Grok Build** — `grok` (local fuel)
 
 ## Easy path (all platforms)
 
@@ -97,5 +98,6 @@ The control plane authors **ExecutionClass**; Bridge requires the stamped class
 | `pi` | local only | `--tools` class map (`observe_network` refused) |
 | `kiro` | local only | `--trust-tools` allowlist |
 | `antigravity` | local only | `-p --mode plan` / `accept-edits` |
+| `grok` | local only | `--sandbox` + `--allow`/`--deny` (deny wins under `--always-approve`) |
 
-Cursor/Pi/Kiro/Antigravity require local fuel (`ops install` sets this for you).
+Cursor/Pi/Kiro/Antigravity/Grok require local fuel (`ops install` sets this for you).

package/dist/cli.js

@@ -18,7 +18,7 @@ import { ensureCheckout } from "./checkout.js";
 import { maybeApplyOnShiftIntent } from "./on-shift-apply.js";
 import { loadOpsEnv, OPS_VERBS, runOps } from "./ops.js";
 import { pumpExecutionSlots, renewLeases } from "./execution.js";
-import { installRunnerService, uninstallRunnerService } from "./service.js";
+import { applyRunnerToolPath, installRunnerService, uninstallRunnerService } from "./service.js";
 import { BRIDGE_PROTOCOL_VERSION, cachedBridgePreflight, unavailableWorkspacePreflight } from "./preflight.js";
 import { executeNextInvestigation } from "./investigation.js";
 import { bridgeVersion } from "./version.js";
@@ -125,7 +125,7 @@ async function join() {
         console.log(`Assignments at once: ${leaseCapacity}`);
         console.log(`Fuel source: ${plannedFuel === "local" ? "local subscription" : "Conduit pump"}`
             + (!fuelSource && plannedFuel === "local" ? " (auto: only local-fuel agents detected)" : ""));
-        console.log(`Execution drivers: ${Object.keys(DRIVERS).join(", ")} (cursor/pi/kiro/antigravity require local fuel).`);
+        console.log(`Execution drivers: ${Object.keys(DRIVERS).join(", ")} (cursor/pi/kiro/antigravity/grok require local fuel).`);
         console.log("Use --machine <name> to override the computer label.\n");
         const response = await fetch(`${baseUrl}/runner/v1/connect/requests`, {
             method: "POST",
@@ -197,6 +197,43 @@ async function waitForConnection(pending, fuelSource) {
     await clearPendingConnection();
     throw new Error("Connection request expired. Run `conduit join --url <worker-url>` again.");
 }
+async function enroll() {
+    const { values } = parseArgs({
+        args: process.argv.slice(3),
+        options: {
+            url: { type: "string" },
+            token: { type: "string" },
+            fuel: { type: "string" },
+            machine: { type: "string" },
+        },
+    });
+    if (!values.url || !values.token) {
+        throw new Error(`Usage: ${BRIDGE_NPX} enroll --url <url> --token <token> [--machine <name>]`);
+    }
+    const baseUrl = normalizeBaseUrl(values.url);
+    const installationId = await loadOrCreateInstallationId();
+    const machineName = values.machine?.trim() || suggestMachineName(hostname(), installationId);
+    const response = await fetch(`${baseUrl}/runner/v1/connect/enroll-fast`, {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({ code: values.token, installation_id: installationId, machine_name: machineName }),
+    });
+    if (!response.ok) {
+        const errorText = await response.text();
+        let message = errorText;
+        try {
+            const parsed = JSON.parse(errorText);
+            if (parsed.message)
+                message = parsed.message;
+        }
+        catch {
+            // keep raw text
+        }
+        throw new Error(`Enrollment failed (${response.status}): ${message}`);
+    }
+    const data = (await response.json());
+    await finishConnection(baseUrl, data, parseFuelSource(values.fuel));
+}
 async function finishConnection(baseUrl, data, fuelSource) {
     const fuelList = Array.isArray(data.fuel) ? data.fuel : [];
     const fuel = {};
@@ -242,15 +279,14 @@ async function finishConnection(baseUrl, data, fuelSource) {
         + (fuelAutoLocal ? " (auto: only local-fuel agents detected)" : ""));
     const localOnly = localFuelOnlyClients(detected);
     if (config.fuelSource === "conduit" && localOnly.length) {
-        console.log(`Note: ${localOnly.join(", ")} require local fuel per lane (set automatically for cursor/pi/kiro/antigravity).`);
+        console.log(`Note: ${localOnly.join(", ")} require local fuel per lane (set automatically for cursor/pi/kiro/antigravity/grok).`);
     }
     console.log("Heartbeats report capabilities for diagnostics only; matching uses the Connect confirmation. Detected clients never receive grants automatically.");
     console.log(`MCP setup: {"mcpServers":{"conduit":{"command":"npx","args":["-y","@miraland-labs/conduit-bridge","mcp"]}}}`);
     console.log(`Bring a lane online: ${bridgeUsage("drivers", "online", AGENT_PLACEHOLDER)}`);
     console.log(`Execute work: ${bridgeUsage("runner", "--workspace", "<repo>")}`);
-    console.log(`Keep on shift (macOS/Linux): ${bridgeUsage("install-service", "--workspace", "<repo>")}`);
+    console.log(`Keep on shift: ${bridgeUsage("install-service", "--workspace", "<repo>")}`);
     console.log(`Flip machine fuel later: ${bridgeUsage("fuel", "local|conduit")} (per-lane override: ${bridgeUsage("drivers", "fuel", "<id>", "local|conduit")})`);
-    console.log("Windows: keep the runner terminal open — install-service is macOS/Linux only.");
     if (Object.keys(fuel).length) {
         console.log(`Fleet fueling: ${Object.keys(fuel).length} project key(s) configured for Conduit /v1`);
     }
@@ -259,7 +295,7 @@ async function finishConnection(baseUrl, data, fuelSource) {
     }
 }
 function openUrl(url) {
-    const command = process.platform === "darwin" ? "open" : process.platform === "linux" ? "xdg-open" : null;
+    const command = process.platform === "darwin" ? "open" : process.platform === "linux" ? "xdg-open" : process.platform === "win32" ? "explorer" : null;
     if (!command)
         return;
     try {
@@ -418,6 +454,7 @@ async function driversCommand() {
     throw new Error(`Usage: ${bridgeUsage("drivers", "[list|online|offline|fuel]", "…")}`);
 }
 async function runner() {
+    applyRunnerToolPath();
     const { values } = parseArgs({ args: process.argv.slice(3), options: {
             workspace: { type: "string" }, interval: { type: "string" }, once: { type: "boolean" },
             "agent-timeout-minutes": { type: "string" }, fuel: { type: "string" }, "ensure-checkout": { type: "string" },
@@ -587,6 +624,8 @@ try {
         await connect();
     else if (command === "join")
         await join();
+    else if (command === "enroll")
+        await enroll();
     else if (command === "disconnect")
         await disconnect();
     else if (command === "fuel")
@@ -606,7 +645,7 @@ try {
     else if (command === "ops")
         await opsCommand();
     else
-        throw new Error(`Usage: ${BRIDGE_NPX} <join|disconnect|connect|fuel|drivers|mcp|runner|install-service|uninstall-service|init-ops|ops>`);
+        throw new Error(`Usage: ${BRIDGE_NPX} <join|enroll|disconnect|connect|fuel|drivers|mcp|runner|install-service|uninstall-service|init-ops|ops>`);
 }
 catch (error) {
     console.error(error instanceof Error ? redactSecrets(error.message) : "Conduit command failed");

package/dist/detect.js

@@ -1,5 +1,6 @@
 import { access, constants } from "node:fs/promises";
 import { delimiter, join } from "node:path";
+import { hasAntigravityLogin, hasClaudeLogin, hasCursorLogin, hasGrokLogin, hasKiroLogin, hasOpenAiLogin, hasOpenCodeLogin, } from "./driver.js";
 /** PATH probes for Connect diagnostics — not proof of a Bridge driver. */
 const CLIENTS = [
     { command: "claude", label: "Claude Code" },
@@ -10,12 +11,13 @@ const CLIENTS = [
     { command: "pi", label: "Pi" },
     { command: "kiro-cli", label: "Kiro CLI" },
     { command: "agy", label: "Antigravity" },
+    { command: "grok", label: "Grok Build" },
     { command: "code", label: "Visual Studio Code" },
 ];
 /** Agents Conduit /v1 pump fuel can drive today. */
 const PUMP_CAPABLE_LABELS = new Set(["Claude Code", "Codex CLI", "OpenCode"]);
 /** Agents that only accept vendor login — Bridge refuses Conduit pump for these drivers. */
-const LOCAL_FUEL_ONLY_LABELS = new Set(["Cursor Agent", "Cursor", "Pi", "Kiro CLI", "Antigravity"]);
+const LOCAL_FUEL_ONLY_LABELS = new Set(["Cursor Agent", "Cursor", "Pi", "Kiro CLI", "Antigravity", "Grok Build"]);
 export function localFuelOnlyClients(detected) {
     return detected.filter((label) => LOCAL_FUEL_ONLY_LABELS.has(label));
 }
@@ -30,6 +32,86 @@ export function suggestFuelSource(detected) {
         return "local";
     return "conduit";
 }
+export function probeAgentHealth(detected, env = process.env) {
+    const detectedSet = new Set(detected);
+    const health = [];
+    const claudeInstalled = detectedSet.has("Claude Code");
+    const claudeAuth = hasClaudeLogin(env);
+    health.push({
+        driverId: "claude",
+        label: "Claude Code",
+        installed: claudeInstalled,
+        authenticated: claudeInstalled,
+        authMethod: env.ANTHROPIC_API_KEY ? "environment_key" : claudeAuth ? "local_login" : "conduit_pump",
+    });
+    const codexInstalled = detectedSet.has("Codex CLI");
+    const codexAuth = hasOpenAiLogin(env);
+    health.push({
+        driverId: "codex",
+        label: "Codex CLI",
+        installed: codexInstalled,
+        authenticated: codexInstalled,
+        authMethod: (env.OPENAI_API_KEY || env.CODEX_API_KEY) ? "environment_key" : codexAuth ? "local_login" : "conduit_pump",
+    });
+    const openCodeInstalled = detectedSet.has("OpenCode");
+    const openCodeAuth = hasOpenCodeLogin(env);
+    health.push({
+        driverId: "opencode",
+        label: "OpenCode",
+        installed: openCodeInstalled,
+        authenticated: openCodeInstalled,
+        authMethod: openCodeAuth ? "local_login" : "conduit_pump",
+    });
+    const cursorInstalled = detectedSet.has("Cursor Agent") || detectedSet.has("Cursor");
+    const cursorAuth = hasCursorLogin(env);
+    health.push({
+        driverId: "cursor",
+        label: "Cursor Agent",
+        installed: cursorInstalled,
+        authenticated: cursorAuth,
+        authMethod: env.CURSOR_API_KEY ? "environment_key" : cursorAuth ? "local_login" : undefined,
+        missingAuthAdvice: cursorInstalled && !cursorAuth ? "Set CURSOR_API_KEY or log in via Cursor IDE" : undefined,
+    });
+    const agyInstalled = detectedSet.has("Antigravity");
+    const agyAuth = hasAntigravityLogin(env);
+    health.push({
+        driverId: "antigravity",
+        label: "Antigravity",
+        installed: agyInstalled,
+        authenticated: agyAuth,
+        authMethod: (env.GEMINI_API_KEY || env.GOOGLE_API_KEY) ? "environment_key" : agyAuth ? "local_login" : undefined,
+        missingAuthAdvice: agyInstalled && !agyAuth ? "Run `agy` to log in or set GEMINI_API_KEY" : undefined,
+    });
+    const kiroInstalled = detectedSet.has("Kiro CLI");
+    const kiroAuth = hasKiroLogin(env);
+    health.push({
+        driverId: "kiro",
+        label: "Kiro CLI",
+        installed: kiroInstalled,
+        authenticated: kiroAuth,
+        authMethod: env.KIRO_API_KEY ? "environment_key" : undefined,
+        missingAuthAdvice: kiroInstalled && !kiroAuth ? "Set KIRO_API_KEY or run `kiro-cli login`" : undefined,
+    });
+    const piInstalled = detectedSet.has("Pi");
+    health.push({
+        driverId: "pi",
+        label: "Pi",
+        installed: piInstalled,
+        authenticated: piInstalled,
+        authMethod: piInstalled ? "local_login" : undefined,
+    });
+    const grokInstalled = detectedSet.has("Grok Build");
+    const grokAuth = hasGrokLogin(env);
+    health.push({
+        driverId: "grok",
+        label: "Grok Build",
+        installed: grokInstalled,
+        authenticated: grokAuth,
+        authMethod: env.XAI_API_KEY ? "environment_key" : grokAuth ? "local_login" : undefined,
+        missingAuthAdvice: grokInstalled && !grokAuth ? "Set XAI_API_KEY or run `grok login`" : undefined,
+    });
+    return health;
+}
 export async function detectInstalledClients(pathValue = process.env.PATH ?? "", platform = process.platform) {
     const directories = pathValue.split(delimiter).filter(Boolean);
     const extensions = platform === "win32" ? [".exe", ".cmd", ".bat", ""] : [""];

package/dist/driver.js

@@ -3,7 +3,7 @@ import { existsSync } from "node:fs";
 import { mkdir, readFile, rm, rmdir, writeFile } from "node:fs/promises";
 import { join } from "node:path";
 import { z } from "zod";
-import { deniedCommands, executionClassPromptRules, parsePiJsonl, projectClaude, projectCoarseMode, projectCodex, projectCursor, projectKiroTools, projectPi, requireStampedExecutionClass, } from "./execution-class.js";
+import { deniedCommands, executionClassPromptRules, parsePiJsonl, projectClaude, projectCoarseMode, projectCodex, projectCursor, projectGrok, projectKiroTools, projectPi, requireStampedExecutionClass, } from "./execution-class.js";
 export { branchCreateCommands, deniedCommands, isBoundedVerificationCommand, prCreateCommands, requireStampedExecutionClass, } from "./execution-class.js";
 function deliveryLanguageRule(language) {
     if (language === "zh") {
@@ -1054,6 +1054,137 @@ export const piDriver = {
         return { status: "completed", resultText: parsed.resultText, sessionId: parsed.sessionId };
     },
 };
+/**
+ * Grok Build (`grok`) — local-fuel lane. Unattended flags are `--always-approve` plus deny/sandbox;
+ * never `--dangerously-skip-permissions`, never plan mode (same Cursor lesson: it is not an
+ * enforcement boundary and it suppresses the delivery JSON). `--worktree` is omitted: Bridge already
+ * creates the attempt worktree.
+ */
+export function grokRunArgs(input) {
+    const executionClass = resolveRunClass(input);
+    const projected = projectGrok(executionClass, {
+        grants: input.grants,
+        verificationCommands: input.verificationCommands,
+        capabilities: input.capabilities ?? [],
+        diagnosis: input.workRole === "diagnose",
+    });
+    const args = [
+        "--no-auto-update",
+        "--no-alt-screen",
+        "--no-plan",
+        "--no-subagents",
+        "--always-approve",
+        "--output-format", "json",
+        "--cwd", input.workspace,
+        "--sandbox", projected.sandbox,
+    ];
+    if (projected.disableWebSearch)
+        args.push("--disable-web-search");
+    args.push("--disallowed-tools", projected.disallowedTools.join(","));
+    for (const rule of projected.deny)
+        args.push("--deny", rule);
+    for (const rule of projected.allow)
+        args.push("--allow", rule);
+    if (input.model)
+        args.push("--model", input.model);
+    if (input.resumeSessionId)
+        args.push("--resume", input.resumeSessionId);
+    args.push("-p", input.prompt);
+    return args;
+}
+/** Last JSON object in `--output-format json` stdout (`text` / `sessionId`; Claude-shaped fallbacks). */
+export function parseGrokOutput(stdout) {
+    const parsed = parseTrailingJsonObject(stdout);
+    if (!parsed)
+        return { resultText: stdout || null, sessionId: null, isError: false };
+    const resultText = typeof parsed.text === "string" ? parsed.text
+        : typeof parsed.result === "string" ? parsed.result
+            : stdout;
+    const sessionCandidate = [parsed.sessionId, parsed.session_id].find((value) => typeof value === "string");
+    const stop = typeof parsed.stopReason === "string" ? parsed.stopReason
+        : typeof parsed.stop_reason === "string" ? parsed.stop_reason
+            : "";
+    const isError = parsed.is_error === true
+        || parsed.subtype === "error"
+        || typeof parsed.error === "string"
+        || /^(error|refused)/i.test(stop);
+    return { resultText, sessionId: sessionCandidate ?? null, isError };
+}
+function parseTrailingJsonObject(stdout) {
+    const trimmed = stdout.trim();
+    if (!trimmed)
+        return null;
+    try {
+        const parsed = JSON.parse(trimmed);
+        if (parsed && typeof parsed === "object" && !Array.isArray(parsed))
+            return parsed;
+    }
+    catch {
+        // Headless json is "one object at the end"; ignore preamble and take the trailing object.
+    }
+    const end = trimmed.lastIndexOf("}");
+    if (end < 0)
+        return null;
+    let depth = 0;
+    for (let index = end; index >= 0; index -= 1) {
+        const ch = trimmed[index];
+        if (ch === "}")
+            depth += 1;
+        else if (ch === "{") {
+            depth -= 1;
+            if (depth === 0) {
+                try {
+                    const parsed = JSON.parse(trimmed.slice(index, end + 1));
+                    if (parsed && typeof parsed === "object" && !Array.isArray(parsed))
+                        return parsed;
+                }
+                catch {
+                    return null;
+                }
+            }
+        }
+    }
+    return null;
+}
+export const grokDriver = {
+    name: "grok",
+    async run(input) {
+        const fuelSource = input.fuelSource === "local" ? "local" : "conduit";
+        if (fuelSource === "conduit") {
+            return {
+                status: "failed",
+                resultText: null,
+                sessionId: null,
+                error: "grok driver requires local fuel (XAI_API_KEY or `grok login`). Run: npx @miraland-labs/conduit-bridge fuel local",
+            };
+        }
+        if (!hasMappedRepoAccess(input.grants)) {
+            return {
+                status: "failed",
+                resultText: null,
+                sessionId: null,
+                error: "No Bridge-mapped Grok access for active grants; refusing to start agent",
+            };
+        }
+        if (!hasGrokLogin()) {
+            return { status: "failed", resultText: null, sessionId: null, error: "grok has no login (set XAI_API_KEY or run `grok login`)" };
+        }
+        const executable = input.executable ?? "grok";
+        const version = await execute(executable, ["--version"], input.workspace, 15_000, undefined, "local");
+        if (version.code !== 0 || !(version.stdout || version.stderr).trim()) {
+            return { status: "failed", resultText: null, sessionId: null, error: "grok preflight could not verify the installed CLI version" };
+        }
+        if (input.grants.includes("test_run") && !(input.verificationCommands?.length)) {
+            return { status: "failed", resultText: null, sessionId: null, error: "grok preflight found no bounded verification command for the test_run grant" };
+        }
+        const { code, stdout, stderr } = await execute(executable, grokRunArgs(input), input.workspace, input.timeoutMs ?? 20 * 60_000, undefined, "local");
+        const parsed = parseGrokOutput(stdout);
+        if (code !== 0 || parsed.isError) {
+            return { status: "failed", resultText: parsed.resultText, sessionId: parsed.sessionId, error: (stderr || parsed.resultText || `grok exited with code ${code}`).slice(0, 20_000) };
+        }
+        return { status: "completed", resultText: parsed.resultText, sessionId: parsed.sessionId };
+    },
+};
 /** Stable driver ids shown in Connect / CLI. Order is product preference, not exclusivity. */
 export const SUPPORTED_AGENTS = [
     { id: "claude-code", label: "Claude Code", executableHint: "claude" },
@@ -1063,6 +1194,7 @@ export const SUPPORTED_AGENTS = [
     { id: "pi", label: "Pi", executableHint: "pi" },
     { id: "kiro", label: "Kiro CLI", executableHint: "kiro-cli" },
     { id: "antigravity", label: "Antigravity (agy)", executableHint: "agy" },
+    { id: "grok", label: "Grok Build", executableHint: "grok" },
 ];
 export const DRIVERS = {
     "claude-code": claudeCodeDriver,
@@ -1072,6 +1204,7 @@ export const DRIVERS = {
     pi: piDriver,
     kiro: kiroDriver,
     antigravity: antigravityDriver,
+    grok: grokDriver,
 };
 /** Most an agent may write to a pipe before the runner starts discarding the head. */
 const MAX_AGENT_OUTPUT = 8 * 1024 * 1024;
@@ -1124,6 +1257,7 @@ const LOCAL_VENDOR_ENV = [
     "ANTHROPIC_API_KEY", "ANTHROPIC_AUTH_TOKEN", "ANTHROPIC_BASE_URL",
     "OPENAI_API_KEY", "OPENAI_BASE_URL", "OPENAI_API_BASE", "CODEX_API_KEY",
     "CURSOR_API_KEY", "KIRO_API_KEY", "GEMINI_API_KEY", "GOOGLE_API_KEY",
+    "XAI_API_KEY",
 ];
 function boundedEnvironment(fuel, fuelSource = "conduit") {
     // Proxy and TLS variables stay: fueled agents must reach Conduit's /v1 on
@@ -1185,10 +1319,18 @@ export function hasAntigravityLogin(env = process.env) {
     // agy 1.1.3 stores its Google session state under ~/.gemini (shared with the IDE).
     return Boolean(home && (existsSync(join(home, ".gemini")) || existsSync(join(home, ".antigravity"))));
 }
+export function hasGrokLogin(env = process.env) {
+    if (env.XAI_API_KEY)
+        return true;
+    const home = env.HOME;
+    // `~/.grok` exists after install; auth.json is the `grok login` / cached_token file.
+    return Boolean(home && existsSync(join(home, ".grok", "auth.json")));
+}
 /** True when local fuel can use a host vendor login for at least one supported agent. */
 export function hasLocalVendorLogin(env = process.env) {
     return hasClaudeLogin(env) || hasOpenAiLogin(env) || hasCursorLogin(env)
-        || hasOpenCodeLogin(env) || hasKiroLogin(env) || hasAntigravityLogin(env);
+        || hasOpenCodeLogin(env) || hasKiroLogin(env) || hasAntigravityLogin(env)
+        || hasGrokLogin(env);
 }
 /** Exported for tests — builds the stripped process env with optional Conduit fuel. */
 export function agentProcessEnv(fuel, fuelSource = "conduit") {

package/dist/drivers.js

@@ -14,14 +14,15 @@ const LABEL_TO_DRIVER = {
     Pi: "pi",
     "Kiro CLI": "kiro",
     Antigravity: "antigravity",
+    "Grok Build": "grok",
 };
-const LOCAL_FUEL_ONLY_DRIVERS = new Set(["cursor", "pi", "kiro", "antigravity"]);
+const LOCAL_FUEL_ONLY_DRIVERS = new Set(["cursor", "pi", "kiro", "antigravity", "grok"]);
 /**
  * Drivers that can combine repository reads with bounded verification while denying source edits.
  * Coarse build/bash modes are not enough for Invariant 23: a diagnosis carries `test_run`, but it
  * must never acquire `repo_write` as an implementation detail of the selected lane.
  */
-const READ_ONLY_DIAGNOSIS_DRIVERS = new Set(["claude-code", "codex", "cursor"]);
+const READ_ONLY_DIAGNOSIS_DRIVERS = new Set(["claude-code", "codex", "cursor", "grok"]);
 export function isSupportedDriverId(id) {
     return Object.prototype.hasOwnProperty.call(DRIVERS, id);
 }

package/dist/ensure-test-evidence.js

@@ -8,6 +8,10 @@ import { promisify } from "node:util";
 import { isBoundedVerificationCommand } from "./execution-class.js";
 const execFileAsync = promisify(execFile);
 const TEST_EVIDENCE_DETAILS_MIN = 32;
+/** Cold `cargo test` in an attempt worktree routinely exceeds two minutes of compile. */
+export const VERIFICATION_TIMEOUT_MS = 600_000;
+/** rustc + cargo logs routinely exceed 2 MiB; Node kills the child when maxBuffer is hit. */
+export const VERIFICATION_MAX_BUFFER_BYTES = 32_000_000;
 /** Contract requires test + test_run — Bridge always runs; agent paste is not a substitute. */
 export function needsTestEvidence(_report, spec, grants) {
     if (!grants.includes("test_run"))
@@ -93,17 +97,18 @@ async function defaultRunCommand(command, workspace) {
     try {
         const { stdout, stderr } = await execFileAsync(bin, argv.slice(1), {
             cwd: workspace,
-            timeout: 120_000,
-            maxBuffer: 2_000_000,
+            timeout: VERIFICATION_TIMEOUT_MS,
+            maxBuffer: VERIFICATION_MAX_BUFFER_BYTES,
             env: process.env,
         });
         return { stdout: String(stdout), stderr: String(stderr), code: 0 };
     }
     catch (error) {
         const err = error;
+        const stderr = String(err.stderr || err.message || "verification failed");
         return {
             stdout: String(err.stdout ?? ""),
-            stderr: String(err.stderr ?? err.message ?? "verification failed"),
+            stderr,
             code: typeof err.code === "number" ? err.code : 1,
         };
     }

package/dist/execution-class.js

@@ -217,6 +217,68 @@ export function projectCodex(executionClass, input) {
         return { sandbox: "read-only", networkAccess };
     return { sandbox: "workspace-write", networkAccess };
 }
+function grokBash(command) {
+    return `Bash(${command}*)`;
+}
+/**
+ * Grok Build (`grok`) — Claude-style `--allow`/`--deny` plus Codex-style `--sandbox`.
+ *
+ * `--always-approve` is required for unattended runs (otherwise unmatched tools prompt and hang).
+ * Deny always wins over allow, including under always-approve, so restriction is deny + sandbox +
+ * `--disallowed-tools` + `--disable-web-search`. Allow entries document the intended surface; they
+ * are not a whitelist under always-approve. Do not deny `Bash(*)` on diagnosis: that would also
+ * block bounded verification because deny wins. OS `read-only` is what keeps diagnosis from writing
+ * the worktree. In-process WebFetch still works under `read-only` (child-process network does not).
+ */
+export function projectGrok(executionClass, input) {
+    const grants = input.grants;
+    const verificationCommands = input.verificationCommands ?? [];
+    const capabilities = input.capabilities ?? [];
+    const fetch = allowsExternalFetch(executionClass, capabilities);
+    const landDeny = executionClass === "publish_artifact" || executionClass === "observe" || executionClass === "observe_network";
+    const deny = [
+        ...deniedCommands.map(grokBash),
+        "MCPTool(*)",
+        ...(landDeny ? landCommands.map(grokBash) : []),
+        // always-approve: omit-from-allow is not a gate. In-process WebFetch ignores read-only.
+        ...(!fetch ? ["WebFetch(*)", "WebSearch(*)"] : []),
+    ];
+    const disallowedTools = fetch ? ["Agent"] : ["Agent", "web_search", "web_fetch"];
+    const allow = [];
+    if (fetch)
+        allow.push("WebFetch(*)");
+    if (executionClass === "observe" || executionClass === "observe_network") {
+        allow.push("Read(*)", "Grep(*)");
+        deny.push("Edit(*)", "Write(*)", "Bash(*)");
+        return { sandbox: "read-only", allow, deny, disableWebSearch: !fetch, disallowedTools };
+    }
+    if (input.diagnosis) {
+        allow.push("Read(*)", "Grep(*)", ...verificationCommands.filter(isBoundedVerificationCommand).map(grokBash));
+        deny.push("Edit(*)", "Write(*)");
+        return { sandbox: "read-only", allow, deny, disableWebSearch: !fetch, disallowedTools };
+    }
+    if (executionClass === "verify") {
+        allow.push("Read(*)", "Grep(*)", ...verificationCommands.filter(isBoundedVerificationCommand).map(grokBash));
+        deny.push("Edit(*)", "Write(*)");
+        return { sandbox: "workspace", allow, deny, disableWebSearch: !fetch, disallowedTools };
+    }
+    if (executionClass === "publish_artifact") {
+        allow.push("Read(*)", "Grep(*)", "Edit(*)", "Write(*)", "Bash(*)");
+        return { sandbox: "workspace", allow, deny, disableWebSearch: !fetch, disallowedTools };
+    }
+    if (grants.includes("repo_read"))
+        allow.push("Read(*)", "Grep(*)");
+    if (grants.includes("repo_write"))
+        allow.push("Edit(*)", "Write(*)");
+    if (grants.includes("test_run")) {
+        allow.push(...verificationCommands.filter(isBoundedVerificationCommand).map(grokBash));
+    }
+    if (grants.includes("branch_create"))
+        allow.push(...branchCreateCommands.map(grokBash));
+    if (grants.includes("pr_create"))
+        allow.push(...prCreateCommands.map(grokBash));
+    return { sandbox: "workspace", allow, deny, disableWebSearch: !fetch, disallowedTools };
+}
 /** Coarse mode for OpenCode / Antigravity. */
 export function projectCoarseMode(executionClass) {
     if (executionClass === "observe" || executionClass === "observe_network")

package/dist/execution.js

@@ -670,7 +670,7 @@ async function runClaimedAssignment(client, config, driver, workspace, brief, ta
                     disposition: "hold",
                     responsible_party: "computer_operator",
                     message: "Conductor is waiting for a diagnostic lane that can enforce read-only access.",
-                    next_action: "Bring a Claude Code, Codex, or Cursor lane online on this computer, then Recheck. Do not author compiler constraints for the agent.",
+                    next_action: "Bring a Claude Code, Codex, Cursor, or Grok Build lane online on this computer, then Recheck. Do not author compiler constraints for the agent.",
                     diagnostic_detail: detail,
                 },
                 error: detail,

package/dist/investigation.js

@@ -35,7 +35,7 @@ export const investigationAssignmentSchema = z.object({
  * the run happens in a disposable worktree with no remote credential, and it is checked afterwards.
  */
 export function boundedByForDriver(driverId) {
-    if (driverId === "codex")
+    if (driverId === "codex" || driverId === "grok")
         return "os_sandbox";
     if (driverId === "claude-code" || driverId === "cursor")
         return "tool_allowlist";

package/dist/ops.js

@@ -4,19 +4,19 @@
  */
 import { spawnSync } from "node:child_process";
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
-import { homedir, platform } from "node:os";
+import { homedir } from "node:os";
 import { dirname, join, resolve } from "node:path";
 import { parseArgs } from "node:util";
 import { ConduitClient } from "./client.js";
 import { loadConfig } from "./config.js";
-import { detectInstalledClients } from "./detect.js";
+import { detectInstalledClients, probeAgentHealth } from "./detect.js";
 import { driverIdsFromDetectedLabels } from "./drivers.js";
 import { BRIDGE_PROTOCOL_VERSION, describePreflightIssue, runBridgePreflight } from "./preflight.js";
 import { bridgeVersion } from "./version.js";
 export const OPS_VERBS = [
-    "connect", "install", "switch", "online", "offline", "status", "doctor", "disconnect", "uninstall",
+    "connect", "enroll", "install", "switch", "online", "offline", "status", "doctor", "disconnect", "uninstall",
 ];
-const LOCAL_FUEL_DRIVERS = new Set(["cursor", "pi", "kiro", "antigravity"]);
+const LOCAL_FUEL_DRIVERS = new Set(["cursor", "pi", "kiro", "antigravity", "grok"]);
 function bridgeVersionAtLeast(value, minimum) {
     const parse = (input) => {
         const match = /^(\d+)\.(\d+)\.(\d+)/.exec(input);
@@ -151,7 +151,7 @@ export async function resolveDrivers(env, argv, detect = detectInstalledClients)
         console.log(`CONDUIT_DRIVERS not set — using detected agents: ${detected.join(", ")}`);
         return detected;
     }
-    throw new Error("No coding agent found on this computer. Install one (Claude Code, Codex, Cursor, OpenCode, Pi, Kiro, Antigravity), " +
+    throw new Error("No coding agent found on this computer. Install one (Claude Code, Codex, Cursor, OpenCode, Pi, Kiro, Antigravity, Grok Build), " +
         "then retry — or set CONDUIT_DRIVERS / pass driver ids explicitly.");
 }
 /** Quote args for a copy-pasteable shell/cmd line (paths with spaces). */
@@ -180,7 +180,6 @@ function defaultRunBridge(args, options = {}) {
 }
 export async function runOps(verb, argv = [], deps = {}) {
     const runBridge = deps.runBridge ?? defaultRunBridge;
-    const host = deps.host ?? platform();
     const env = deps.env ?? loadOpsEnv();
     if (verb === "disconnect") {
         runBridge(["uninstall-service"], { allowFail: true });
@@ -239,7 +238,24 @@ export async function runOps(verb, argv = [], deps = {}) {
             workspace: resolve(expandOpsValue(env.CONDUIT_WORKSPACE)),
             expectedRepository: env.CONDUIT_REPO || undefined,
         });
+        const installed = await detectInstalledClients();
+        const health = probeAgentHealth(installed, process.env);
         console.log(`Bridge preflight: ${report.ready ? "READY" : "BLOCKED"}`);
+        const installedAgents = health.filter((h) => h.installed);
+        if (installedAgents.length > 0) {
+            console.log("\nAgent Diagnostics:");
+            for (const h of installedAgents) {
+                const method = h.authMethod === "conduit_pump" ? "Conduit pump"
+                    : h.authMethod === "environment_key" ? "environment key"
+                        : h.authMethod === "local_login" ? "local login"
+                            : h.authMethod;
+                console.log(`- ${h.label}: ${h.authenticated ? "Ready" : "Needs local login"}${method ? ` (${method})` : ""}`);
+                if (h.missingAuthAdvice) {
+                    console.log(`  Advice: ${h.missingAuthAdvice}`);
+                }
+            }
+            console.log("");
+        }
         if (report.ready) {
             console.log("Workspace, online lanes, local fuel, CLI availability, and authentication are ready.");
             return;
@@ -388,6 +404,43 @@ export async function runOps(verb, argv = [], deps = {}) {
         runBridge(args);
         return;
     }
+    if (verb === "enroll") {
+        const { values } = parseArgs({
+            args: argv,
+            options: {
+                url: { type: "string" },
+                token: { type: "string" },
+                workspace: { type: "string" },
+                repo: { type: "string" },
+                machine: { type: "string" },
+                "no-install": { type: "boolean" },
+            },
+            allowPositionals: true,
+        });
+        const url = (values.url?.trim() || env.CONDUIT_URL).trim();
+        const token = values.token?.trim();
+        if (!url || !token) {
+            throw new Error("Usage: ops enroll --url <url> --token <token> [--workspace <path>] [--repo <url>] [--machine <name>]");
+        }
+        const workspace = values.workspace?.trim() || env.CONDUIT_WORKSPACE;
+        const repo = values.repo?.trim() || env.CONDUIT_REPO;
+        const machine = values.machine?.trim();
+        const envPath = env.loadedFrom ?? defaultOpsEnvPath();
+        writeOpsEnvFile(envPath, {
+            CONDUIT_URL: url,
+            ...(workspace ? { CONDUIT_WORKSPACE: workspace } : {}),
+            ...(repo ? { CONDUIT_REPO: repo } : {}),
+        });
+        const args = ["enroll", "--url", url, "--token", token];
+        if (machine)
+            args.push("--machine", machine);
+        runBridge(args);
+        if (!values["no-install"] && workspace) {
+            const refreshedEnv = loadOpsEnv();
+            await runOps("install", [], { ...deps, env: refreshedEnv });
+        }
+        return;
+    }
     if (verb === "install") {
         if (!installEnv.CONDUIT_WORKSPACE) {
             throw new Error(`No workspace declared. Rerun with --workspace /path/to/repo, or set CONDUIT_WORKSPACE in ${defaultOpsEnvPath()}`);
@@ -401,17 +454,6 @@ export async function runOps(verb, argv = [], deps = {}) {
         runBridge(["drivers", "online", ...drivers]);
         // Prove the exact local environment before installing a service that advertises availability.
         runBridge(["ops", "doctor"]);
-        if (host === "win32") {
-            const runnerArgs = ["runner", "--workspace", workspace];
-            if (installEnv.CONDUIT_REPO)
-                runnerArgs.push("--ensure-checkout", installEnv.CONDUIT_REPO);
-            console.log(`Bridge: v${bridgeVersion()} (protocol ${BRIDGE_PROTOCOL_VERSION})`);
-            console.log("Windows: background install-service is not available.");
-            console.log("Keep a terminal open and run:");
-            console.log(`  npx @miraland-labs/conduit-bridge@latest ${shellQuoteArgs(runnerArgs)}`);
-            console.log(`Drivers online: ${drivers.join(", ")}`);
-            return;
-        }
         const installArgs = ["install-service", "--workspace", workspace];
         if (installEnv.CONDUIT_REPO)
             installArgs.push("--ensure-checkout", installEnv.CONDUIT_REPO);

package/dist/preflight.js

@@ -2,7 +2,7 @@ import { execFile } from "node:child_process";
 import { createHash } from "node:crypto";
 import { promisify } from "node:util";
 import { buildWorkspaceBrief, normalizeRepositoryUrl } from "./brief.js";
-import { hasAntigravityLogin, hasClaudeLogin, hasOpenAiLogin, hasOpenCodeLogin, resolveCodexExecutable, } from "./driver.js";
+import { hasAntigravityLogin, hasClaudeLogin, hasGrokLogin, hasOpenAiLogin, hasOpenCodeLogin, resolveCodexExecutable, } from "./driver.js";
 import { localFuelOnlyDriver, onlineDriverIds, resolveDriverFuel, supportsReadOnlyDiagnosis } from "./drivers.js";
 /** Protocol 3: read-only diagnosis can reuse a retained failed-attempt worktree. */
 // 4: each driver snapshot reports diagnosis_read_only, so the control plane can require a
@@ -39,6 +39,7 @@ const DRIVER_COMMAND = {
     pi: "pi",
     kiro: "kiro-cli",
     antigravity: "agy",
+    grok: "grok",
 };
 function executableFor(driver) {
     return driver === "codex" ? resolveCodexExecutable() : DRIVER_COMMAND[driver] ?? driver;
@@ -52,6 +53,8 @@ async function localAuthenticationReady(driver, workspace, run) {
         return hasOpenCodeLogin();
     if (driver === "antigravity")
         return hasAntigravityLogin();
+    if (driver === "grok")
+        return hasGrokLogin();
     if (driver === "cursor") {
         if (process.env.CURSOR_API_KEY)
             return true;

package/dist/service.js

@@ -33,13 +33,14 @@ export function runnerProgramArguments(options = {}) {
     return args;
 }
 /**
- * PATH for LaunchAgent/systemd so agent CLIs in ~/.local/bin and Homebrew resolve
- * without the operator hand-editing the unit.
+ * PATH for LaunchAgent/systemd so agent CLIs in ~/.local/bin, rustup cargo,
+ * and Homebrew resolve without the operator hand-editing the unit.
  */
 export function runnerServicePath(home = homedir(), nodeBin = dirname(process.execPath)) {
     const parts = [
         nodeBin,
         join(home, ".local", "bin"),
+        join(home, ".cargo", "bin"),
         "/opt/homebrew/bin",
         "/usr/local/bin",
         "/usr/bin",
@@ -49,6 +50,21 @@ export function runnerServicePath(home = homedir(), nodeBin = dirname(process.ex
     ];
     return [...new Set(parts.filter(Boolean))].join(":");
 }
+/**
+ * Merge the install-service PATH into this process so `cargo` / agent CLIs resolve
+ * even when a stale LaunchAgent plist omitted them. Call at runner boot — not a
+ * per-machine hand edit.
+ */
+export function applyRunnerToolPath(env = process.env, home = homedir(), nodeBin = dirname(process.execPath)) {
+    if (platform() === "win32")
+        return env.PATH ?? env.Path ?? "";
+    const current = env.PATH ?? "";
+    const seen = new Set(current.split(":").filter(Boolean));
+    const prefix = runnerServicePath(home, nodeBin).split(":").filter((dir) => dir && !seen.has(dir));
+    const next = [...prefix, ...current.split(":").filter(Boolean)].join(":");
+    env.PATH = next;
+    return next;
+}
 export function launchdPlist(programArguments, stdoutPath, pathEnv = runnerServicePath()) {
     const argsXml = programArguments.map((arg) => `    <string>${escapeXml(arg)}</string>`).join("\n");
     return `<?xml version="1.0" encoding="UTF-8"?>
@@ -111,6 +127,18 @@ function launchAgentsPath() {
 function systemdUnitPath() {
     return join(homedir(), ".config", "systemd", "user", "conduit-runner.service");
 }
+export const WINDOWS_TASK_NAME = "ConduitBridgeRunner";
+/** Quote one argv token for a Windows Task Scheduler /TR command line. */
+export function quoteWindowsTaskArg(value) {
+    if (!/[\s&<>|^()"]/.test(value))
+        return value;
+    return `"${value.replaceAll('"', '\\"')}"`;
+}
+/** cmd.exe line that keeps Node on PATH and starts the runner. */
+export function windowsTaskCommandLine(programArguments, nodeBin = dirname(process.execPath)) {
+    const inner = programArguments.map(quoteWindowsTaskArg).join(" ");
+    return `cmd.exe /c set "PATH=${nodeBin};%PATH%"&& ${inner}`;
+}
 function run(command, args) {
     const result = spawnSync(command, args, { encoding: "utf8" });
     if (result.status !== 0) {
@@ -180,10 +208,23 @@ export function reloadLaunchdRunnerSync(domain, plistPath) {
 }
 export async function installRunnerService(options = {}) {
     const host = platform();
-    if (host !== "darwin" && host !== "linux") {
-        throw new Error(`install-service is supported on macOS and Linux only (got ${host})`);
+    if (host !== "darwin" && host !== "linux" && host !== "win32") {
+        throw new Error(`install-service is supported on macOS, Linux, and Windows only (got ${host})`);
     }
     const programArguments = runnerProgramArguments(options);
+    if (host === "win32") {
+        const tr = windowsTaskCommandLine(programArguments);
+        run("schtasks", ["/Create", "/TN", WINDOWS_TASK_NAME, "/TR", tr, "/SC", "ONLOGON", "/RL", "LIMITED", "/F"]);
+        try {
+            run("schtasks", ["/Run", "/TN", WINDOWS_TASK_NAME]);
+        }
+        catch {
+            // Task is registered for next logon. /Run needs an interactive session; enroll already succeeded.
+        }
+        await mkdir(configDir(), { recursive: true });
+        await writeFile(serviceStatePath(), `${JSON.stringify({ platform: "win32", programArguments, options, installed_at: new Date().toISOString() }, null, 2)}\n`, { mode: 0o600 });
+        return { path: WINDOWS_TASK_NAME, platform: "win32" };
+    }
     if (host === "darwin") {
         const plistPath = launchAgentsPath();
         await mkdir(dirname(plistPath), { recursive: true });
@@ -225,8 +266,8 @@ export async function installRunnerService(options = {}) {
 }
 export async function uninstallRunnerService() {
     const host = platform();
-    if (host !== "darwin" && host !== "linux") {
-        throw new Error(`uninstall-service is supported on macOS and Linux only (got ${host})`);
+    if (host !== "darwin" && host !== "linux" && host !== "win32") {
+        throw new Error(`uninstall-service is supported on macOS, Linux, and Windows only (got ${host})`);
     }
     let stored = null;
     try {
@@ -235,6 +276,11 @@ export async function uninstallRunnerService() {
     catch {
         stored = null;
     }
+    if (host === "win32") {
+        spawnSync("schtasks", ["/Delete", "/TN", WINDOWS_TASK_NAME, "/F"], { encoding: "utf8" });
+        await unlink(serviceStatePath()).catch(() => undefined);
+        return { path: WINDOWS_TASK_NAME, platform: "win32" };
+    }
     if (host === "darwin") {
         const plistPath = launchAgentsPath();
         spawnSync("launchctl", ["bootout", `gui/${process.getuid?.() ?? 501}/${SERVICE_LABEL}`], { encoding: "utf8" });

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@miraland-labs/conduit-bridge",
-  "version": "0.16.0",
-  "description": "Conduit Bridge CLI — join, connect, disconnect, multi-driver lanes, and run Claude Code / Codex / Cursor / OpenCode / Pi / Kiro / Antigravity agents for a Conduit organization",
+  "version": "0.16.2",
+  "description": "Conduit Bridge CLI — join, connect, disconnect, multi-driver lanes, and run Claude Code / Codex / Cursor / OpenCode / Pi / Kiro / Antigravity / Grok Build agents for a Conduit organization",
   "type": "module",
   "bin": {
     "conduit": "dist/cli.js"