@runuai/host 0.9.108 → 0.9.110

package/lib/agents/grok.ts

@@ -183,7 +183,17 @@ export class GrokSession implements AgentSession {
       argv: argv as [string, ...string[]],
       user: "node",
       inheritEnv,
-      env: this.agentEnv,
+      env: {
+        ...this.agentEnv,
+        // Grok gates MCP/LSP servers (even user-scope ones) behind folder
+        // trust, and /workspace is never trusted: it is not a git repo and
+        // headless runs have no prompt. `grok mcp doctor` on a task machine:
+        // "folder untrusted … not started for an untrusted folder"; with this
+        // off, "2 healthy". The container/machine IS the isolation boundary —
+        // the same reasoning as --permission-mode bypassPermissions above
+        // (live 2026-09-08, first Grok agents with MCP servers).
+        GROK_FOLDER_TRUST: "0",
+      },
       maxOutputBytes: AGENT_SESSION_OUTPUT_BUFFER_BYTES,
     };
   }

package/lib/browser-testing.ts

@@ -243,14 +243,24 @@ const SERVER_DEF = { command: SERVER_COMMAND, args: SERVER_ARGS };
  * `--approve-mcps`); same JSON shape as Claude's project file. */
 const CURSOR_MCP_PATH = "/home/node/.cursor/mcp.json";
 
-/** Grok: `grok mcp add` (add-or-update) in PROJECT scope writes
- * /workspace/.grok/config.toml, honoured by every GROK_HOME and hot-reloaded,
- * so per-account homes need no per-home write. The launcher has no single
- * quotes by construction (see SERVER_LAUNCHER), so it survives the quoting. */
+/** Grok: `grok mcp add` (add-or-update) in USER scope, once per GROK_HOME a
+ * task may run under (the default ~/.grok and each ~/.grok-acct-<id>) —
+ * `GROK_HOME` redirects the user config. PROJECT scope looked simpler but
+ * grok refuses repo-local servers in an untrusted folder, and /workspace is
+ * not a git repo so nothing ever trusts it (live 2026-09-08: "folder
+ * untrusted … re-run with --trust", no such flag headless). The launcher has
+ * no single quotes by construction (see SERVER_LAUNCHER). */
 const GROK_BIN = "/home/node/.grok/bin/grok";
-export const GROK_BROWSER_ADD_CMD =
-  `cd /workspace && ${GROK_BIN} mcp add browser -s project -t stdio ` +
-  `${SERVER_COMMAND} -- ${SERVER_ARGS.map((arg) => `'${arg}'`).join(" ")}`;
+export const DEFAULT_GROK_HOME = "/home/node/.grok";
+export function grokBrowserAddCommand(home: string): string {
+  if (!/^\/home\/node\/\.grok(-acct-[A-Za-z0-9_-]+)?$/.test(home)) {
+    throw new Error("invalid Grok home");
+  }
+  return (
+    `GROK_HOME=${home} ${GROK_BIN} mcp add browser -s user -t stdio ` +
+    `${SERVER_COMMAND} -- ${SERVER_ARGS.map((arg) => `'${arg}'`).join(" ")}`
+  );
+}
 
 const CLAUDE_SETTINGS_JSON = JSON.stringify(
   { enableAllProjectMcpServers: true },
@@ -1081,9 +1091,14 @@ export async function setupBrowserTesting(
    * (2026-09-08 — until then only Claude/Codex were wired and both answered
    * "no browser MCP in this session" on the Studio). */
   engineKinds: readonly string[] = [],
+  /** Every GROK_HOME the task may run under (default + account homes). */
+  grokHomes: readonly string[] = [DEFAULT_GROK_HOME],
 ): Promise<BrowserSetup> {
   const hasCursor = engineKinds.includes("cursor");
   const hasGrok = engineKinds.includes("grok");
+  const selectedGrokHomes = hasGrok
+    ? [...new Set(grokHomes.length > 0 ? grokHomes : [DEFAULT_GROK_HOME])]
+    : [];
   // Machine sessions run under MACHINE_RUNTIME_AUTHORITY_ENV, so every setup
   // exec here must too — the prewarm in particular. Warming npx under the
   // CONTAINER authority (private NPM_CONFIG_CACHE) leaves the session-default
@@ -1359,7 +1374,11 @@ export async function setupBrowserTesting(
     // GROK_BROWSER_ADD_CMD) rather than a file we own; a failure here leaves
     // the task configured-false so the next ensure retries.
     if (hasGrok) {
-      const grokArgv = ["sh", "-lc", GROK_BROWSER_ADD_CMD] as [string, ...string[]];
+      const grokArgv = [
+        "sh",
+        "-lc",
+        selectedGrokHomes.map(grokBrowserAddCommand).join(" && "),
+      ] as [string, ...string[]];
       const registered = environment
         ? await environment.exec({
             argv: grokArgv,

package/lib/mcp-gateway.ts

@@ -1056,8 +1056,8 @@ const MCP_CONFIG_HOST_TIMEOUT_MS = 40_000;
  *   - Codex — mcp-remote shims appended once per slug to config.toml.
  *   - Cursor — ~/.cursor/mcp.json ({ url } form; the adapter passes
  *     `--approve-mcps`).
- *   - Grok — `grok mcp add -s project` writes /workspace/.grok/config.toml
- *     (idempotent per slug; applies to every GROK_HOME).
+ *   - Grok — `grok mcp add -s user` into every GROK_HOME the task may use
+ *     (idempotent per slug; project scope is refused in an untrusted folder).
  *   - OpenCode — ~/.config/opencode/opencode.json `mcp` block (type:"remote",
  *     oauth:false so it treats the gateway URL as a plain server; the path
  *     token is the auth). Written only when the task has connections.
@@ -1071,6 +1071,8 @@ export async function setupMcpTaskConfig(
   codexHomes: readonly string[] = ["/home/node/.codex"],
   environment?: Pick<TaskEnvironmentHandle, "exec"> &
     Partial<Pick<TaskEnvironmentHandle, "descriptor">>,
+  /** Every GROK_HOME the task may run under (default + account homes). */
+  grokHomes: readonly string[] = ["/home/node/.grok"],
 ): Promise<boolean> {
   // No early return on empty: the claude adapter passes
   // `--mcp-config /workspace/.mcp.json` unconditionally (ADR-057), so the
@@ -1153,18 +1155,22 @@ export async function setupMcpTaskConfig(
             )}`,
           ]
         : []),
-      // Grok: PROJECT-scope `grok mcp add` writes /workspace/.grok/config.toml,
-      // which every GROK_HOME (the default or a per-account dir) picks up —
-      // grok hot-reloads repo config. The binary lives at ~/.grok/bin (x.ai
-      // installer); the old ~/.local/bin path failed silently behind `|| true`
-      // and grok never saw a single MCP server (live 2026-09-08).
+      // Grok: USER-scope `grok mcp add` once per GROK_HOME the task may run
+      // under (GROK_HOME redirects the user config). Project scope is refused
+      // for an untrusted folder and /workspace is no git repo (live
+      // 2026-09-08). The binary lives at ~/.grok/bin (x.ai installer); the
+      // old ~/.local/bin path failed silently behind `|| true`.
       ...(has("grok")
-        ? connections.map(
-            (c) =>
-              `(cd /workspace && ${GROK_BIN} mcp add ${shellQuote(c.slug)} ${shellQuote(
-                urlFor(c.slug),
-              )} -t http -s project >/dev/null 2>&1) || true`,
-          )
+        ? grokHomes
+            .filter((home) => /^\/home\/node\/\.grok(-acct-[A-Za-z0-9_-]+)?$/.test(home))
+            .flatMap((home) =>
+              connections.map(
+                (c) =>
+                  `GROK_HOME=${home} ${GROK_BIN} mcp add ${shellQuote(c.slug)} ${shellQuote(
+                    urlFor(c.slug),
+                  )} -t http -s user >/dev/null 2>&1 || true`,
+              ),
+            )
         : []),
       // OpenCode: global config `mcp` block (auto-discovered regardless of the
       // exec cwd, and independent of any per-account OPENCODE_DATA_DIR).

package/lib/orchestrator.ts

@@ -101,6 +101,7 @@ import {
 } from "./agent-cli";
 import {
   DEFAULT_CODEX_HOME,
+  DEFAULT_GROK_HOME,
   setupBrowserTesting,
   type BrowserSetup,
 } from "./browser-testing";
@@ -814,6 +815,16 @@ export class Orchestrator {
     return [...new Set([DEFAULT_CODEX_HOME, ...homes])];
   }
 
+  /** Every GROK_HOME a task in `scope` may run under: the default plus each
+   *  sign-in account's isolated home (API-key accounts use the default). */
+  private grokHomes(hasGrok: boolean, scope: string): string[] {
+    if (!hasGrok) return [];
+    const homes = resolveEngineAccounts("grok", {}, scope)
+      .map((account) => account.configDir?.containerDir)
+      .filter((home): home is string => Boolean(home));
+    return [...new Set([DEFAULT_GROK_HOME, ...homes])];
+  }
+
   private noteProvisionMutation(
     channel: Channel,
     waitForBrowserReadiness: boolean,
@@ -1026,6 +1037,7 @@ export class Orchestrator {
               requestedHomes,
               channel.agentHandle,
               requestedKinds,
+              this.grokHomes(requestedKinds.includes("grok"), channel.engineAccountScope),
             )
           : await setupBrowserTesting(
               channel.taskId,
@@ -1034,6 +1046,7 @@ export class Orchestrator {
               requestedHomes,
               undefined,
               requestedKinds,
+              this.grokHomes(requestedKinds.includes("grok"), channel.engineAccountScope),
             );
       } catch (err) {
         console.warn(
@@ -1190,10 +1203,15 @@ export class Orchestrator {
     const codexHomes = engineKinds.includes("codex")
       ? this.codexHomes(true, channel.engineAccountScope)
       : [];
+    const grokHomes = this.grokHomes(
+      engineKinds.includes("grok"),
+      channel.engineAccountScope,
+    );
     const fingerprint = JSON.stringify({
       connections,
       engineKinds,
       codexHomes,
+      ...(grokHomes.length > 0 ? { grokHomes } : {}),
     });
     const dirtyEpoch = channel.mcpConfigDirtyEpoch;
     const repairingProvisionedConfig =
@@ -1240,6 +1258,7 @@ export class Orchestrator {
           engineKinds,
           codexHomes,
           providerEnvironment,
+          grokHomes,
         )
       : await setupMcpTaskConfig(
           channel.taskId,
@@ -1247,6 +1266,8 @@ export class Orchestrator {
           connections,
           engineKinds,
           codexHomes,
+          undefined,
+          grokHomes,
         );
     if (!configured || !this.isActiveChannel(channel)) return;
     channel.configGeneration += 1;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@runuai/host",
-  "version": "0.9.108",
+  "version": "0.9.110",
   "description": "Uai host — runs ephemeral AI tasks in containers on a machine you control.",
   "license": "MIT",
   "author": "Uai Tech <team@runuai.com>",