@webpresso/agent-kit 3.1.30 → 3.2.0

package/dist/esm/cli/commands/init/convergence.js

@@ -0,0 +1,57 @@
+import { isAbsolute, relative, resolve, sep } from "node:path";
+export const CONVERGE_SCOPES = ["repo-committed", "repo-ignored"];
+function normalizeGitPath(value) {
+    return value.replaceAll("\\", "/").replace(/^\.\//u, "");
+}
+function assertInsideRepo(repoRoot, targetPath) {
+    const relativePath = relative(repoRoot, targetPath);
+    if (relativePath.length === 0 ||
+        relativePath === ".." ||
+        relativePath.startsWith(`..${sep}`) ||
+        isAbsolute(relativePath)) {
+        throw new Error(`Convergence target must be a file inside the repository: ${targetPath}`);
+    }
+    return normalizeGitPath(relativePath);
+}
+export function createConvergeUnit(input) {
+    if (!isAbsolute(input.repoRoot)) {
+        throw new Error(`Convergence repo root must be absolute: ${input.repoRoot}`);
+    }
+    if (!isAbsolute(input.targetPath)) {
+        throw new Error(`Convergence target must be absolute: ${input.targetPath}`);
+    }
+    if (!CONVERGE_SCOPES.includes(input.scope)) {
+        throw new Error(`Unsupported convergence scope: ${input.scope}`);
+    }
+    const repoRoot = resolve(input.repoRoot);
+    const targetPath = resolve(input.targetPath);
+    const derivedGitPath = assertInsideRepo(repoRoot, targetPath);
+    const gitPath = normalizeGitPath(input.gitPath);
+    if (gitPath.length === 0 || isAbsolute(gitPath) || gitPath !== derivedGitPath) {
+        throw new Error(`Convergence git path must match its repo-anchored target: expected ${derivedGitPath}, received ${input.gitPath}`);
+    }
+    return {
+        repoRoot,
+        targetPath,
+        gitPath,
+        action: input.action,
+        scope: input.scope,
+        reason: input.reason,
+    };
+}
+export function convergeUnitFromTarget(repoRoot, targetPath, input) {
+    const anchoredRoot = resolve(repoRoot);
+    const anchoredTarget = resolve(targetPath);
+    return createConvergeUnit({
+        ...input,
+        repoRoot: anchoredRoot,
+        targetPath: anchoredTarget,
+        gitPath: assertInsideRepo(anchoredRoot, anchoredTarget),
+    });
+}
+/** Applied units are the sole authority for authored commit scope. */
+export function deriveCommitAllowlist(appliedUnits) {
+    return [
+        ...new Set(appliedUnits.filter((unit) => unit.scope === "repo-committed").map((unit) => unit.gitPath)),
+    ].sort();
+}

package/dist/esm/cli/commands/init/git-convergence.d.ts

@@ -0,0 +1,19 @@
+export type GitConvergenceStatus = "ready" | "fast-forwarded" | "not-git" | "unborn" | "detached" | "dirty" | "diverged" | "failed";
+export interface GitConvergenceResult {
+    readonly status: GitConvergenceStatus;
+    readonly ok: boolean;
+    readonly repoRoot: string;
+    readonly head?: string;
+    readonly upstream?: string;
+    readonly shouldReplan: boolean;
+    readonly canCommit: boolean;
+    readonly warnings: readonly string[];
+    readonly error?: string;
+}
+export interface PrepareGitConvergenceOptions {
+    readonly repoRoot: string;
+    readonly isCi?: boolean;
+    readonly fetchTimeoutMs?: number;
+    readonly gitCommand?: string;
+}
+export declare function prepareRepositoryForConvergence(options: PrepareGitConvergenceOptions): GitConvergenceResult;

package/dist/esm/cli/commands/init/git-convergence.js

@@ -0,0 +1,168 @@
+import { spawnSync } from "node:child_process";
+import { resolve } from "node:path";
+const DEFAULT_GIT_TIMEOUT_MS = 5_000;
+const GIT_MAX_BUFFER = 1024 * 1024;
+function git(repoRoot, args, timeoutMs, command = "git") {
+    const result = spawnSync(command, [...args], {
+        cwd: repoRoot,
+        encoding: "utf8",
+        timeout: timeoutMs,
+        maxBuffer: GIT_MAX_BUFFER,
+        stdio: ["ignore", "pipe", "pipe"],
+    });
+    return {
+        ok: result.status === 0 && !result.error,
+        stdout: result.stdout.trim(),
+        stderr: result.stderr.trim(),
+        timedOut: result.error !== undefined && "code" in result.error && result.error.code === "ETIMEDOUT",
+    };
+}
+function failed(repoRoot, status, error) {
+    return {
+        status,
+        ok: false,
+        repoRoot,
+        shouldReplan: false,
+        canCommit: false,
+        warnings: [],
+        error,
+    };
+}
+function parseAheadBehindCounts(stdout) {
+    const parts = stdout.trim().split(/\s+/u);
+    if (parts.length !== 2)
+        return null;
+    if (!parts.every((part) => /^\d+$/u.test(part)))
+        return null;
+    const [ahead, behind] = parts.map((part) => Number.parseInt(part, 10));
+    if (ahead === undefined ||
+        behind === undefined ||
+        !Number.isSafeInteger(ahead) ||
+        !Number.isSafeInteger(behind) ||
+        ahead < 0 ||
+        behind < 0) {
+        return null;
+    }
+    return { ahead, behind };
+}
+export function prepareRepositoryForConvergence(options) {
+    const repoRoot = resolve(options.repoRoot);
+    const timeoutMs = options.fetchTimeoutMs ?? DEFAULT_GIT_TIMEOUT_MS;
+    const gitCommand = options.gitCommand ?? "git";
+    const runGit = (args) => git(repoRoot, args, timeoutMs, gitCommand);
+    const inside = runGit(["rev-parse", "--is-inside-work-tree"]);
+    if (!inside.ok || inside.stdout !== "true") {
+        return failed(repoRoot, "not-git", "Repository convergence requires a Git worktree.");
+    }
+    const headResult = runGit(["rev-parse", "--verify", "HEAD"]);
+    if (!headResult.ok) {
+        return failed(repoRoot, "unborn", "Repository convergence requires an existing HEAD commit.");
+    }
+    const head = headResult.stdout;
+    const branch = runGit(["symbolic-ref", "--quiet", "--short", "HEAD"]);
+    const detached = !branch.ok;
+    if (detached && !options.isCi) {
+        return failed(repoRoot, "detached", "Repository convergence refuses a detached HEAD.");
+    }
+    const trackedStatus = runGit(["status", "--porcelain=v1", "--untracked-files=no"]);
+    if (!trackedStatus.ok) {
+        return failed(repoRoot, "failed", trackedStatus.stderr || "Unable to inspect Git status.");
+    }
+    if (trackedStatus.stdout.length > 0) {
+        return failed(repoRoot, "dirty", "Repository convergence requires a clean tracked index and worktree.");
+    }
+    const warnings = [];
+    if (detached) {
+        warnings.push("Detached HEAD accepted in CI; skipped upstream update and authored commit.");
+        return {
+            status: "ready",
+            ok: true,
+            repoRoot,
+            head,
+            shouldReplan: false,
+            canCommit: false,
+            warnings,
+        };
+    }
+    const upstreamResult = runGit(["rev-parse", "--abbrev-ref", "--symbolic-full-name", "@{u}"]);
+    if (!upstreamResult.ok) {
+        warnings.push("No upstream is configured; skipped fetch and fast-forward.");
+        return {
+            status: "ready",
+            ok: true,
+            repoRoot,
+            head,
+            shouldReplan: false,
+            canCommit: !options.isCi,
+            warnings,
+        };
+    }
+    const upstream = upstreamResult.stdout;
+    const remoteSeparator = upstream.indexOf("/");
+    const remote = remoteSeparator === -1 ? upstream : upstream.slice(0, remoteSeparator);
+    const fetch = runGit(["fetch", "--quiet", "--no-tags", remote]);
+    if (!fetch.ok) {
+        warnings.push(fetch.timedOut
+            ? `Upstream fetch timed out after ${timeoutMs}ms; continuing from local refs.`
+            : `Upstream fetch unavailable; continuing from local refs${fetch.stderr ? `: ${fetch.stderr}` : "."}`);
+    }
+    const counts = runGit(["rev-list", "--left-right", "--count", `HEAD...${upstream}`]);
+    if (!counts.ok) {
+        return {
+            ...failed(repoRoot, "failed", counts.stderr || "Unable to compare HEAD with upstream."),
+            head,
+            upstream,
+            warnings,
+        };
+    }
+    const parsedCounts = parseAheadBehindCounts(counts.stdout);
+    if (!parsedCounts) {
+        return {
+            ...failed(repoRoot, "failed", `Unable to parse HEAD/upstream divergence counts from git rev-list output: ${JSON.stringify(counts.stdout)}.`),
+            head,
+            upstream,
+            warnings,
+        };
+    }
+    const { ahead, behind } = parsedCounts;
+    if (ahead > 0 && behind > 0) {
+        return {
+            ...failed(repoRoot, "diverged", `HEAD has diverged from ${upstream}; reconcile it manually.`),
+            head,
+            upstream,
+            warnings,
+        };
+    }
+    if (behind > 0) {
+        const merge = runGit(["merge", "--ff-only", upstream]);
+        if (!merge.ok) {
+            return {
+                ...failed(repoRoot, "failed", merge.stderr || `Unable to fast-forward from ${upstream}.`),
+                head,
+                upstream,
+                warnings,
+            };
+        }
+        const nextHead = runGit(["rev-parse", "--verify", "HEAD"]);
+        return {
+            status: "fast-forwarded",
+            ok: true,
+            repoRoot,
+            head: nextHead.ok ? nextHead.stdout : undefined,
+            upstream,
+            shouldReplan: true,
+            canCommit: !options.isCi,
+            warnings,
+        };
+    }
+    return {
+        status: "ready",
+        ok: true,
+        repoRoot,
+        head,
+        upstream,
+        shouldReplan: false,
+        canCommit: !options.isCi,
+        warnings,
+    };
+}

package/dist/esm/cli/commands/init/gitignore-patcher.js

@@ -55,8 +55,10 @@ export const GENERATED_PATHS_BLOCK = {
         ".runtime/",
         ".opencode/",
         ".codex/",
+        ".grok/",
         "_worktrees/",
         ".webpresso/hooks-manifest.json",
+        ".webpresso/converged.json",
         ".claude/settings.json",
         ".claude/settings.local.json",
         ".claude/agents/",

package/dist/esm/cli/commands/init/grok-privacy-smoke.d.ts

@@ -0,0 +1,52 @@
+export interface GrokPrivacyFlow {
+    readonly hostname: string;
+    readonly method: string;
+    readonly requestCount: number;
+    readonly requestBytes: number;
+    readonly responseBytes: number;
+}
+export interface GrokPrivacyBaseline {
+    readonly schemaVersion: 1;
+    readonly cliVersion: string;
+    readonly authMode: "local-session";
+    readonly transportVarianceBytes: number;
+    readonly maxAggregateRequestBytes: number;
+    readonly flows: readonly {
+        readonly hostname: string;
+        readonly method: string;
+        readonly maxRequestCount: number;
+        readonly maxRequestBytes: number;
+    }[];
+}
+export interface GrokPrivacyEvidence {
+    readonly schemaVersion: 1;
+    readonly host: "grok";
+    readonly cliVersion: string;
+    readonly authMode: "local-session";
+    readonly reviewedSha: string;
+    readonly traceSha256: string;
+    readonly sentinelObserved: false;
+    readonly native: {
+        readonly hooksTrusted: true;
+        readonly hookDenial: true;
+        readonly inspect: true;
+        readonly mcpList: true;
+        readonly mcpDoctor: true;
+        readonly localInference: true;
+    };
+    readonly flows: readonly GrokPrivacyFlow[];
+}
+export declare function buildGrokPrivacyEvidence(input: {
+    baseline: GrokPrivacyBaseline;
+    cliVersion: string;
+    reviewedSha: string;
+    sentinelObserved: boolean;
+    hooksTrusted: boolean;
+    hookDenialPassed: boolean;
+    inspectPassed: boolean;
+    mcpListPassed: boolean;
+    mcpDoctorPassed: boolean;
+    localInferencePassed: boolean;
+    flows: readonly GrokPrivacyFlow[];
+}): GrokPrivacyEvidence;
+export declare function serializeGrokPrivacyEvidence(evidence: GrokPrivacyEvidence): string;

package/dist/esm/cli/commands/init/grok-privacy-smoke.js

@@ -0,0 +1,91 @@
+import { createHash } from "node:crypto";
+const EVIDENCE_KEYS = [
+    "schemaVersion",
+    "host",
+    "cliVersion",
+    "authMode",
+    "reviewedSha",
+    "traceSha256",
+    "sentinelObserved",
+    "native",
+    "flows",
+];
+function normalizedFlows(flows) {
+    return [...flows]
+        .map((flow) => ({
+        hostname: flow.hostname.toLowerCase(),
+        method: flow.method.toUpperCase(),
+        requestCount: flow.requestCount,
+        requestBytes: flow.requestBytes,
+        responseBytes: flow.responseBytes,
+    }))
+        .sort((a, b) => `${a.hostname}\0${a.method}`.localeCompare(`${b.hostname}\0${b.method}`));
+}
+export function buildGrokPrivacyEvidence(input) {
+    const { baseline } = input;
+    if (input.cliVersion !== baseline.cliVersion) {
+        throw new Error(`Grok privacy proof requires pinned CLI ${baseline.cliVersion}; observed ${input.cliVersion}`);
+    }
+    if (!/^[a-f0-9]{40}$/u.test(input.reviewedSha)) {
+        throw new Error("Grok privacy proof requires a full reviewed git SHA");
+    }
+    if (input.sentinelObserved) {
+        throw new Error("Grok privacy proof detected the fixture sentinel in an outbound request");
+    }
+    if (!input.hooksTrusted ||
+        !input.hookDenialPassed ||
+        !input.inspectPassed ||
+        !input.mcpListPassed ||
+        !input.mcpDoctorPassed ||
+        !input.localInferencePassed) {
+        throw new Error("Grok privacy proof requires trusted hooks and passing native discovery");
+    }
+    const flows = normalizedFlows(input.flows);
+    const allowed = new Map(baseline.flows.map((flow) => [
+        `${flow.hostname.toLowerCase()}\0${flow.method.toUpperCase()}`,
+        flow,
+    ]));
+    for (const flow of flows) {
+        const expected = allowed.get(`${flow.hostname}\0${flow.method}`);
+        if (!expected) {
+            throw new Error(`Grok privacy proof observed unapproved flow ${flow.method} ${flow.hostname}`);
+        }
+        if (flow.requestCount > expected.maxRequestCount) {
+            throw new Error(`Grok privacy proof exceeded request count for ${flow.hostname}`);
+        }
+        if (flow.requestBytes > expected.maxRequestBytes + baseline.transportVarianceBytes) {
+            throw new Error(`Grok privacy proof exceeded request bytes for ${flow.hostname}`);
+        }
+    }
+    const aggregateRequestBytes = flows.reduce((total, flow) => total + flow.requestBytes, 0);
+    if (aggregateRequestBytes > baseline.maxAggregateRequestBytes + baseline.transportVarianceBytes) {
+        throw new Error("Grok privacy proof exceeded aggregate request bytes");
+    }
+    const trace = JSON.stringify(flows);
+    return {
+        schemaVersion: 1,
+        host: "grok",
+        cliVersion: input.cliVersion,
+        authMode: "local-session",
+        reviewedSha: input.reviewedSha,
+        traceSha256: createHash("sha256").update(trace).digest("hex"),
+        sentinelObserved: false,
+        native: {
+            hooksTrusted: true,
+            hookDenial: true,
+            inspect: true,
+            mcpList: true,
+            mcpDoctor: true,
+            localInference: true,
+        },
+        flows,
+    };
+}
+export function serializeGrokPrivacyEvidence(evidence) {
+    const keys = Object.keys(evidence);
+    if (keys.length !== EVIDENCE_KEYS.length ||
+        keys.some((key) => !EVIDENCE_KEYS.includes(key))) {
+        throw new Error("Grok privacy evidence contains an unknown field");
+    }
+    return `${JSON.stringify(evidence, null, 2)}\n`;
+}

package/dist/esm/cli/commands/init/host-native-proof.d.ts

@@ -0,0 +1,18 @@
+export declare const CLAUDE_NATIVE_PROOF_TOOL = "mcp__plugin_agent-kit_webpresso__wp_session_stats";
+type JsonRecord = Record<string, unknown>;
+export interface ClaudeNativeProofRecord {
+    readonly host: "claude";
+    readonly cliVersion: string;
+    readonly toolName: typeof CLAUDE_NATIVE_PROOF_TOOL;
+    readonly emptyArguments: true;
+    readonly success: true;
+    readonly elapsedMs: number;
+    readonly terminalEventSha256: string;
+}
+export declare function parseJsonLines(raw: string): JsonRecord[];
+export declare function verifyClaudeNativeProof(events: readonly JsonRecord[], input: {
+    cliVersion: string;
+    elapsedMs: number;
+}): ClaudeNativeProofRecord;
+export declare function serializeClaudeNativeProof(record: ClaudeNativeProofRecord): string;
+export {};

package/dist/esm/cli/commands/init/host-native-proof.js

@@ -0,0 +1,88 @@
+import { createHash } from "node:crypto";
+export const CLAUDE_NATIVE_PROOF_TOOL = "mcp__plugin_agent-kit_webpresso__wp_session_stats";
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+export function parseJsonLines(raw) {
+    return raw
+        .split(/\r?\n/u)
+        .filter((line) => line.trim() !== "")
+        .map((line) => {
+        const parsed = JSON.parse(line);
+        if (!isRecord(parsed))
+            throw new Error("Claude stream event must be a JSON object");
+        return parsed;
+    });
+}
+export function verifyClaudeNativeProof(events, input) {
+    const init = events.find((event) => event["type"] === "system" && event["subtype"] === "init");
+    if (!init)
+        throw new Error("Claude native proof missing system/init");
+    const pluginErrors = init["plugin_errors"];
+    if (Array.isArray(pluginErrors) && pluginErrors.length > 0) {
+        throw new Error("Claude native proof reported plugin load errors");
+    }
+    const plugins = Array.isArray(init["plugins"]) ? init["plugins"] : [];
+    const pluginNames = plugins
+        .map((plugin) => (isRecord(plugin) ? plugin["name"] : undefined))
+        .filter((name) => typeof name === "string");
+    if (pluginNames.length !== 1 || pluginNames[0] !== "agent-kit") {
+        throw new Error(`Claude native proof expected only agent-kit plugin; observed ${JSON.stringify(pluginNames)}`);
+    }
+    const tools = Array.isArray(init["tools"])
+        ? init["tools"].filter((tool) => typeof tool === "string")
+        : [];
+    if (tools.length !== 1 || tools[0] !== CLAUDE_NATIVE_PROOF_TOOL) {
+        throw new Error(`Claude native proof expected exactly ${CLAUDE_NATIVE_PROOF_TOOL}; observed tools=${JSON.stringify(tools)} mcp_servers=${JSON.stringify(init["mcp_servers"] ?? [])}`);
+    }
+    const mcpServers = Array.isArray(init["mcp_servers"]) ? init["mcp_servers"] : [];
+    const expectedServers = mcpServers.filter((server) => isRecord(server) &&
+        server["name"] === "plugin:agent-kit:webpresso" &&
+        server["status"] === "connected");
+    if (expectedServers.length !== 1) {
+        throw new Error(`Claude native proof expected one connected Agent Kit MCP server; observed ${JSON.stringify(mcpServers)}`);
+    }
+    const toolUses = events.flatMap((event) => {
+        const message = isRecord(event["message"]) ? event["message"] : null;
+        const content = message && Array.isArray(message["content"]) ? message["content"] : [];
+        return content.filter((block) => isRecord(block) && block["type"] === "tool_use");
+    });
+    if (toolUses.length !== 1) {
+        throw new Error(`Claude native proof expected exactly one tool use; observed ${toolUses.length}`);
+    }
+    const toolUse = toolUses[0];
+    if (toolUse["name"] !== CLAUDE_NATIVE_PROOF_TOOL) {
+        throw new Error(`Claude native proof observed unexpected tool: ${String(toolUse["name"])}`);
+    }
+    if (!isRecord(toolUse["input"]) || Object.keys(toolUse["input"]).length !== 0) {
+        throw new Error("Claude native proof tool arguments must be an empty object");
+    }
+    const terminal = events.findLast((event) => event["type"] === "result");
+    if (!terminal || terminal["subtype"] !== "success" || terminal["is_error"] === true) {
+        throw new Error("Claude native proof missing successful terminal result");
+    }
+    return {
+        host: "claude",
+        cliVersion: input.cliVersion,
+        toolName: CLAUDE_NATIVE_PROOF_TOOL,
+        emptyArguments: true,
+        success: true,
+        elapsedMs: Math.max(0, Math.min(Math.round(input.elapsedMs), 300_000)),
+        terminalEventSha256: createHash("sha256").update(JSON.stringify(terminal)).digest("hex"),
+    };
+}
+export function serializeClaudeNativeProof(record) {
+    const allowedKeys = [
+        "host",
+        "cliVersion",
+        "toolName",
+        "emptyArguments",
+        "success",
+        "elapsedMs",
+        "terminalEventSha256",
+    ];
+    if (Object.keys(record).some((key) => !allowedKeys.includes(key))) {
+        throw new Error("Claude native proof record contains an unknown field");
+    }
+    return `${JSON.stringify(record, null, 2)}\n`;
+}

package/dist/esm/cli/commands/init/host-visibility.d.ts

@@ -1,4 +1,4 @@
-export declare const AGENT_HOSTS: readonly ["codex", "claude", "opencode"];
+export declare const AGENT_HOSTS: readonly ["codex", "claude", "opencode", "grok"];
 export type AgentHost = (typeof AGENT_HOSTS)[number];
 export declare const REQUIRED_CORE_CAPABILITIES: readonly ["verify", "fix", "investigate", "ai-deslop", "plan-refine", "ralplan", "best-practice-research", "testing-philosophy", "tph", "claude", "codex", "grok", "opencode-go", "plan-eng-review", "plan-ceo-review", "plan-design-review", "plan-devex-review", "browse", "devex-review", "design-review", "hooks-doctor", "tech-debt", "lore-protocol", "deep-interview", "deep-research", "autoresearch", "ultragoal", "autopilot", "team"];
 export declare const VISIBILITY_STATUSES: readonly ["visible-now", "visible-after-restart", "not-visible"];
@@ -21,7 +21,7 @@ export interface HostVisibilityAudit {
     readonly requiredCapabilities: readonly string[];
     readonly results: readonly HostSkillVisibility[];
 }
-export declare const SETUP_SURFACE_HOSTS: readonly ["claude", "codex", "opencode"];
+export declare const SETUP_SURFACE_HOSTS: readonly ["claude", "codex", "opencode", "grok"];
 export type SetupSurfaceHost = (typeof SETUP_SURFACE_HOSTS)[number];
 export type SetupSurfaceArtifactStatus = "installed" | "missing" | "deferred";
 export type SetupSurfaceActiveStatus = "managed" | "not-installed";

package/dist/esm/cli/commands/init/host-visibility.js

@@ -6,10 +6,10 @@ import { SHARED_FAVORITE_SKILLS } from "./scaffold-agent.js";
 import { CLAUDE_DEV_ADAPTER_RELATIVE_PATH } from "./scaffolders/claude-plugin/index.js";
 import { CODEX_DEV_ADAPTER_RELATIVE_PATH } from "./scaffolders/codex-plugin/index.js";
 import { OPENCODE_PLUGIN_PACKAGE } from "./scaffolders/opencode-plugin/index.js";
-export const AGENT_HOSTS = ["codex", "claude", "opencode"];
+export const AGENT_HOSTS = ["codex", "claude", "opencode", "grok"];
 export const REQUIRED_CORE_CAPABILITIES = SHARED_FAVORITE_SKILLS;
 export const VISIBILITY_STATUSES = ["visible-now", "visible-after-restart", "not-visible"];
-export const SETUP_SURFACE_HOSTS = ["claude", "codex", "opencode"];
+export const SETUP_SURFACE_HOSTS = ["claude", "codex", "opencode", "grok"];
 export function parseAgentHosts(value) {
     if (value?.trim() === "none")
         return [];
@@ -103,6 +103,18 @@ export function hostSkillRoots(repoRoot, host, homeDir = homedir()) {
                 ],
                 global: [],
             };
+        case "grok":
+            // Grok reads AGENTS.md/CLAUDE.md natively for instructions; skills are
+            // shared from the Claude/agents surfaces plus a native `.grok/skills`.
+            return {
+                project: [
+                    join(repoRoot, ".grok", "skills"),
+                    join(repoRoot, ".claude", "skills"),
+                    join(repoRoot, ".agents", "skills"),
+                ],
+                user: [join(homeDir, ".grok", "skills"), join(homeDir, ".claude", "skills")],
+                global: [],
+            };
     }
 }
 export function auditHostSkillVisibility(input) {
@@ -164,11 +176,13 @@ function allExist(repoRoot, relativePaths) {
     return relativePaths.every((relativePath) => existsSync(join(repoRoot, relativePath)));
 }
 function hasOpenCodePluginRegistration(repoRoot) {
-    const configPath = join(repoRoot, "opencode.json");
+    const configPath = existsSync(join(repoRoot, "opencode.json"))
+        ? join(repoRoot, "opencode.json")
+        : join(repoRoot, "opencode.jsonc");
     if (!existsSync(configPath))
         return false;
     try {
-        const parsed = JSON.parse(readFileSync(configPath, "utf8"));
+        const parsed = JSON.parse(stripJsonc(readFileSync(configPath, "utf8")));
         return (Array.isArray(parsed.plugin) &&
             parsed.plugin.some((entry) => entry === OPENCODE_PLUGIN_PACKAGE));
     }
@@ -176,6 +190,71 @@ function hasOpenCodePluginRegistration(repoRoot) {
         return false;
     }
 }
+function stripJsonc(raw) {
+    let out = "";
+    let inString = false;
+    let quote = null;
+    let escaped = false;
+    for (let i = 0; i < raw.length; i += 1) {
+        const ch = raw[i];
+        const next = raw[i + 1];
+        if (inString) {
+            out += ch;
+            if (escaped)
+                escaped = false;
+            else if (ch === "\\")
+                escaped = true;
+            else if (ch === quote) {
+                inString = false;
+                quote = null;
+            }
+            continue;
+        }
+        if (ch === '"' || ch === "'") {
+            inString = true;
+            quote = ch;
+            out += ch;
+            continue;
+        }
+        if (ch === "/" && next === "/") {
+            while (i < raw.length && raw[i] !== "\n")
+                i += 1;
+            out += "\n";
+            continue;
+        }
+        if (ch === "/" && next === "*") {
+            i += 2;
+            while (i < raw.length && !(raw[i] === "*" && raw[i + 1] === "/"))
+                i += 1;
+            i += 1;
+            continue;
+        }
+        if (ch === ",") {
+            let j = i + 1;
+            while (j < raw.length) {
+                while (/\s/u.test(raw[j] ?? ""))
+                    j += 1;
+                if (raw[j] === "/" && raw[j + 1] === "/") {
+                    while (j < raw.length && raw[j] !== "\n")
+                        j += 1;
+                    continue;
+                }
+                if (raw[j] === "/" && raw[j + 1] === "*") {
+                    j += 2;
+                    while (j < raw.length && !(raw[j] === "*" && raw[j + 1] === "/"))
+                        j += 1;
+                    j += 2;
+                    continue;
+                }
+                break;
+            }
+            if (raw[j] === "}" || raw[j] === "]")
+                continue;
+        }
+        out += ch;
+    }
+    return out;
+}
 export function auditHostSetupSurfaceVisibility(input) {
     const { repoRoot, packageRoot } = input;
     const opencodePluginRegistered = hasOpenCodePluginRegistration(repoRoot);
@@ -210,7 +289,17 @@ export function auditHostSetupSurfaceVisibility(input) {
             active: opencodePluginRegistered ? "managed" : "not-installed",
             support: "full",
             required: false,
-            ownership: "native npm plugin registration via the opencode.json plugin entry @webpresso/opencode-plugin",
+            ownership: "native npm plugin registration via the opencode.json/opencode.jsonc plugin entry @webpresso/opencode-plugin",
+        },
+        {
+            host: "grok",
+            artifact: existsSync(join(repoRoot, ".grok", "config.toml")) ? "installed" : "deferred",
+            active: existsSync(join(repoRoot, ".grok", "hooks", "webpresso.json"))
+                ? "managed"
+                : "not-installed",
+            support: "full",
+            required: false,
+            ownership: "native project .grok/config.toml MCP server plus .grok/hooks/webpresso.json; run /hooks-trust once to arm the hooks",
         },
     ];
 }

package/dist/esm/cli/commands/init/index.d.ts

@@ -30,6 +30,7 @@ export interface InitFlags {
     repair?: boolean;
     profile?: string;
 }
+export declare function setupDeprecationWarnings(flags: InitFlags): string[];
 /**
  * Which tier surfaces a given adoption-ladder profile scaffolds. Strict
  * supersets (see docs/adoption-ladder.md): quality ⊂ guarded ⊂ full.