@webpresso/agent-kit 3.1.30 → 3.3.0

package/dist/esm/cli/commands/init/grok-privacy-smoke.d.ts

@@ -0,0 +1,52 @@
+export interface GrokPrivacyFlow {
+    readonly hostname: string;
+    readonly method: string;
+    readonly requestCount: number;
+    readonly requestBytes: number;
+    readonly responseBytes: number;
+}
+export interface GrokPrivacyBaseline {
+    readonly schemaVersion: 1;
+    readonly cliVersion: string;
+    readonly authMode: "local-session";
+    readonly transportVarianceBytes: number;
+    readonly maxAggregateRequestBytes: number;
+    readonly flows: readonly {
+        readonly hostname: string;
+        readonly method: string;
+        readonly maxRequestCount: number;
+        readonly maxRequestBytes: number;
+    }[];
+}
+export interface GrokPrivacyEvidence {
+    readonly schemaVersion: 1;
+    readonly host: "grok";
+    readonly cliVersion: string;
+    readonly authMode: "local-session";
+    readonly reviewedSha: string;
+    readonly traceSha256: string;
+    readonly sentinelObserved: false;
+    readonly native: {
+        readonly hooksTrusted: true;
+        readonly hookDenial: true;
+        readonly inspect: true;
+        readonly mcpList: true;
+        readonly mcpDoctor: true;
+        readonly localInference: true;
+    };
+    readonly flows: readonly GrokPrivacyFlow[];
+}
+export declare function buildGrokPrivacyEvidence(input: {
+    baseline: GrokPrivacyBaseline;
+    cliVersion: string;
+    reviewedSha: string;
+    sentinelObserved: boolean;
+    hooksTrusted: boolean;
+    hookDenialPassed: boolean;
+    inspectPassed: boolean;
+    mcpListPassed: boolean;
+    mcpDoctorPassed: boolean;
+    localInferencePassed: boolean;
+    flows: readonly GrokPrivacyFlow[];
+}): GrokPrivacyEvidence;
+export declare function serializeGrokPrivacyEvidence(evidence: GrokPrivacyEvidence): string;

package/dist/esm/cli/commands/init/grok-privacy-smoke.js

@@ -0,0 +1,91 @@
+import { createHash } from "node:crypto";
+const EVIDENCE_KEYS = [
+    "schemaVersion",
+    "host",
+    "cliVersion",
+    "authMode",
+    "reviewedSha",
+    "traceSha256",
+    "sentinelObserved",
+    "native",
+    "flows",
+];
+function normalizedFlows(flows) {
+    return [...flows]
+        .map((flow) => ({
+        hostname: flow.hostname.toLowerCase(),
+        method: flow.method.toUpperCase(),
+        requestCount: flow.requestCount,
+        requestBytes: flow.requestBytes,
+        responseBytes: flow.responseBytes,
+    }))
+        .sort((a, b) => `${a.hostname}\0${a.method}`.localeCompare(`${b.hostname}\0${b.method}`));
+}
+export function buildGrokPrivacyEvidence(input) {
+    const { baseline } = input;
+    if (input.cliVersion !== baseline.cliVersion) {
+        throw new Error(`Grok privacy proof requires pinned CLI ${baseline.cliVersion}; observed ${input.cliVersion}`);
+    }
+    if (!/^[a-f0-9]{40}$/u.test(input.reviewedSha)) {
+        throw new Error("Grok privacy proof requires a full reviewed git SHA");
+    }
+    if (input.sentinelObserved) {
+        throw new Error("Grok privacy proof detected the fixture sentinel in an outbound request");
+    }
+    if (!input.hooksTrusted ||
+        !input.hookDenialPassed ||
+        !input.inspectPassed ||
+        !input.mcpListPassed ||
+        !input.mcpDoctorPassed ||
+        !input.localInferencePassed) {
+        throw new Error("Grok privacy proof requires trusted hooks and passing native discovery");
+    }
+    const flows = normalizedFlows(input.flows);
+    const allowed = new Map(baseline.flows.map((flow) => [
+        `${flow.hostname.toLowerCase()}\0${flow.method.toUpperCase()}`,
+        flow,
+    ]));
+    for (const flow of flows) {
+        const expected = allowed.get(`${flow.hostname}\0${flow.method}`);
+        if (!expected) {
+            throw new Error(`Grok privacy proof observed unapproved flow ${flow.method} ${flow.hostname}`);
+        }
+        if (flow.requestCount > expected.maxRequestCount) {
+            throw new Error(`Grok privacy proof exceeded request count for ${flow.hostname}`);
+        }
+        if (flow.requestBytes > expected.maxRequestBytes + baseline.transportVarianceBytes) {
+            throw new Error(`Grok privacy proof exceeded request bytes for ${flow.hostname}`);
+        }
+    }
+    const aggregateRequestBytes = flows.reduce((total, flow) => total + flow.requestBytes, 0);
+    if (aggregateRequestBytes > baseline.maxAggregateRequestBytes + baseline.transportVarianceBytes) {
+        throw new Error("Grok privacy proof exceeded aggregate request bytes");
+    }
+    const trace = JSON.stringify(flows);
+    return {
+        schemaVersion: 1,
+        host: "grok",
+        cliVersion: input.cliVersion,
+        authMode: "local-session",
+        reviewedSha: input.reviewedSha,
+        traceSha256: createHash("sha256").update(trace).digest("hex"),
+        sentinelObserved: false,
+        native: {
+            hooksTrusted: true,
+            hookDenial: true,
+            inspect: true,
+            mcpList: true,
+            mcpDoctor: true,
+            localInference: true,
+        },
+        flows,
+    };
+}
+export function serializeGrokPrivacyEvidence(evidence) {
+    const keys = Object.keys(evidence);
+    if (keys.length !== EVIDENCE_KEYS.length ||
+        keys.some((key) => !EVIDENCE_KEYS.includes(key))) {
+        throw new Error("Grok privacy evidence contains an unknown field");
+    }
+    return `${JSON.stringify(evidence, null, 2)}\n`;
+}

package/dist/esm/cli/commands/init/host-native-proof.d.ts

@@ -0,0 +1,18 @@
+export declare const CLAUDE_NATIVE_PROOF_TOOL = "mcp__plugin_agent-kit_webpresso__wp_session_stats";
+type JsonRecord = Record<string, unknown>;
+export interface ClaudeNativeProofRecord {
+    readonly host: "claude";
+    readonly cliVersion: string;
+    readonly toolName: typeof CLAUDE_NATIVE_PROOF_TOOL;
+    readonly emptyArguments: true;
+    readonly success: true;
+    readonly elapsedMs: number;
+    readonly terminalEventSha256: string;
+}
+export declare function parseJsonLines(raw: string): JsonRecord[];
+export declare function verifyClaudeNativeProof(events: readonly JsonRecord[], input: {
+    cliVersion: string;
+    elapsedMs: number;
+}): ClaudeNativeProofRecord;
+export declare function serializeClaudeNativeProof(record: ClaudeNativeProofRecord): string;
+export {};

package/dist/esm/cli/commands/init/host-native-proof.js

@@ -0,0 +1,88 @@
+import { createHash } from "node:crypto";
+export const CLAUDE_NATIVE_PROOF_TOOL = "mcp__plugin_agent-kit_webpresso__wp_session_stats";
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+export function parseJsonLines(raw) {
+    return raw
+        .split(/\r?\n/u)
+        .filter((line) => line.trim() !== "")
+        .map((line) => {
+        const parsed = JSON.parse(line);
+        if (!isRecord(parsed))
+            throw new Error("Claude stream event must be a JSON object");
+        return parsed;
+    });
+}
+export function verifyClaudeNativeProof(events, input) {
+    const init = events.find((event) => event["type"] === "system" && event["subtype"] === "init");
+    if (!init)
+        throw new Error("Claude native proof missing system/init");
+    const pluginErrors = init["plugin_errors"];
+    if (Array.isArray(pluginErrors) && pluginErrors.length > 0) {
+        throw new Error("Claude native proof reported plugin load errors");
+    }
+    const plugins = Array.isArray(init["plugins"]) ? init["plugins"] : [];
+    const pluginNames = plugins
+        .map((plugin) => (isRecord(plugin) ? plugin["name"] : undefined))
+        .filter((name) => typeof name === "string");
+    if (pluginNames.length !== 1 || pluginNames[0] !== "agent-kit") {
+        throw new Error(`Claude native proof expected only agent-kit plugin; observed ${JSON.stringify(pluginNames)}`);
+    }
+    const tools = Array.isArray(init["tools"])
+        ? init["tools"].filter((tool) => typeof tool === "string")
+        : [];
+    if (tools.length !== 1 || tools[0] !== CLAUDE_NATIVE_PROOF_TOOL) {
+        throw new Error(`Claude native proof expected exactly ${CLAUDE_NATIVE_PROOF_TOOL}; observed tools=${JSON.stringify(tools)} mcp_servers=${JSON.stringify(init["mcp_servers"] ?? [])}`);
+    }
+    const mcpServers = Array.isArray(init["mcp_servers"]) ? init["mcp_servers"] : [];
+    const expectedServers = mcpServers.filter((server) => isRecord(server) &&
+        server["name"] === "plugin:agent-kit:webpresso" &&
+        server["status"] === "connected");
+    if (expectedServers.length !== 1) {
+        throw new Error(`Claude native proof expected one connected Agent Kit MCP server; observed ${JSON.stringify(mcpServers)}`);
+    }
+    const toolUses = events.flatMap((event) => {
+        const message = isRecord(event["message"]) ? event["message"] : null;
+        const content = message && Array.isArray(message["content"]) ? message["content"] : [];
+        return content.filter((block) => isRecord(block) && block["type"] === "tool_use");
+    });
+    if (toolUses.length !== 1) {
+        throw new Error(`Claude native proof expected exactly one tool use; observed ${toolUses.length}`);
+    }
+    const toolUse = toolUses[0];
+    if (toolUse["name"] !== CLAUDE_NATIVE_PROOF_TOOL) {
+        throw new Error(`Claude native proof observed unexpected tool: ${String(toolUse["name"])}`);
+    }
+    if (!isRecord(toolUse["input"]) || Object.keys(toolUse["input"]).length !== 0) {
+        throw new Error("Claude native proof tool arguments must be an empty object");
+    }
+    const terminal = events.findLast((event) => event["type"] === "result");
+    if (!terminal || terminal["subtype"] !== "success" || terminal["is_error"] === true) {
+        throw new Error("Claude native proof missing successful terminal result");
+    }
+    return {
+        host: "claude",
+        cliVersion: input.cliVersion,
+        toolName: CLAUDE_NATIVE_PROOF_TOOL,
+        emptyArguments: true,
+        success: true,
+        elapsedMs: Math.max(0, Math.min(Math.round(input.elapsedMs), 300_000)),
+        terminalEventSha256: createHash("sha256").update(JSON.stringify(terminal)).digest("hex"),
+    };
+}
+export function serializeClaudeNativeProof(record) {
+    const allowedKeys = [
+        "host",
+        "cliVersion",
+        "toolName",
+        "emptyArguments",
+        "success",
+        "elapsedMs",
+        "terminalEventSha256",
+    ];
+    if (Object.keys(record).some((key) => !allowedKeys.includes(key))) {
+        throw new Error("Claude native proof record contains an unknown field");
+    }
+    return `${JSON.stringify(record, null, 2)}\n`;
+}

package/dist/esm/cli/commands/init/host-visibility.d.ts

@@ -1,4 +1,4 @@
-export declare const AGENT_HOSTS: readonly ["codex", "claude", "opencode"];
+export declare const AGENT_HOSTS: readonly ["codex", "claude", "opencode", "grok"];
 export type AgentHost = (typeof AGENT_HOSTS)[number];
 export declare const REQUIRED_CORE_CAPABILITIES: readonly ["verify", "fix", "investigate", "ai-deslop", "plan-refine", "ralplan", "best-practice-research", "testing-philosophy", "tph", "claude", "codex", "grok", "opencode-go", "plan-eng-review", "plan-ceo-review", "plan-design-review", "plan-devex-review", "browse", "devex-review", "design-review", "hooks-doctor", "tech-debt", "lore-protocol", "deep-interview", "deep-research", "autoresearch", "ultragoal", "autopilot", "team"];
 export declare const VISIBILITY_STATUSES: readonly ["visible-now", "visible-after-restart", "not-visible"];
@@ -21,7 +21,7 @@ export interface HostVisibilityAudit {
     readonly requiredCapabilities: readonly string[];
     readonly results: readonly HostSkillVisibility[];
 }
-export declare const SETUP_SURFACE_HOSTS: readonly ["claude", "codex", "opencode"];
+export declare const SETUP_SURFACE_HOSTS: readonly ["claude", "codex", "opencode", "grok"];
 export type SetupSurfaceHost = (typeof SETUP_SURFACE_HOSTS)[number];
 export type SetupSurfaceArtifactStatus = "installed" | "missing" | "deferred";
 export type SetupSurfaceActiveStatus = "managed" | "not-installed";

package/dist/esm/cli/commands/init/host-visibility.js

@@ -6,10 +6,10 @@ import { SHARED_FAVORITE_SKILLS } from "./scaffold-agent.js";
 import { CLAUDE_DEV_ADAPTER_RELATIVE_PATH } from "./scaffolders/claude-plugin/index.js";
 import { CODEX_DEV_ADAPTER_RELATIVE_PATH } from "./scaffolders/codex-plugin/index.js";
 import { OPENCODE_PLUGIN_PACKAGE } from "./scaffolders/opencode-plugin/index.js";
-export const AGENT_HOSTS = ["codex", "claude", "opencode"];
+export const AGENT_HOSTS = ["codex", "claude", "opencode", "grok"];
 export const REQUIRED_CORE_CAPABILITIES = SHARED_FAVORITE_SKILLS;
 export const VISIBILITY_STATUSES = ["visible-now", "visible-after-restart", "not-visible"];
-export const SETUP_SURFACE_HOSTS = ["claude", "codex", "opencode"];
+export const SETUP_SURFACE_HOSTS = ["claude", "codex", "opencode", "grok"];
 export function parseAgentHosts(value) {
     if (value?.trim() === "none")
         return [];
@@ -103,6 +103,18 @@ export function hostSkillRoots(repoRoot, host, homeDir = homedir()) {
                 ],
                 global: [],
             };
+        case "grok":
+            // Grok reads AGENTS.md/CLAUDE.md natively for instructions; skills are
+            // shared from the Claude/agents surfaces plus a native `.grok/skills`.
+            return {
+                project: [
+                    join(repoRoot, ".grok", "skills"),
+                    join(repoRoot, ".claude", "skills"),
+                    join(repoRoot, ".agents", "skills"),
+                ],
+                user: [join(homeDir, ".grok", "skills"), join(homeDir, ".claude", "skills")],
+                global: [],
+            };
     }
 }
 export function auditHostSkillVisibility(input) {
@@ -164,11 +176,13 @@ function allExist(repoRoot, relativePaths) {
     return relativePaths.every((relativePath) => existsSync(join(repoRoot, relativePath)));
 }
 function hasOpenCodePluginRegistration(repoRoot) {
-    const configPath = join(repoRoot, "opencode.json");
+    const configPath = existsSync(join(repoRoot, "opencode.json"))
+        ? join(repoRoot, "opencode.json")
+        : join(repoRoot, "opencode.jsonc");
     if (!existsSync(configPath))
         return false;
     try {
-        const parsed = JSON.parse(readFileSync(configPath, "utf8"));
+        const parsed = JSON.parse(stripJsonc(readFileSync(configPath, "utf8")));
         return (Array.isArray(parsed.plugin) &&
             parsed.plugin.some((entry) => entry === OPENCODE_PLUGIN_PACKAGE));
     }
@@ -176,6 +190,71 @@ function hasOpenCodePluginRegistration(repoRoot) {
         return false;
     }
 }
+function stripJsonc(raw) {
+    let out = "";
+    let inString = false;
+    let quote = null;
+    let escaped = false;
+    for (let i = 0; i < raw.length; i += 1) {
+        const ch = raw[i];
+        const next = raw[i + 1];
+        if (inString) {
+            out += ch;
+            if (escaped)
+                escaped = false;
+            else if (ch === "\\")
+                escaped = true;
+            else if (ch === quote) {
+                inString = false;
+                quote = null;
+            }
+            continue;
+        }
+        if (ch === '"' || ch === "'") {
+            inString = true;
+            quote = ch;
+            out += ch;
+            continue;
+        }
+        if (ch === "/" && next === "/") {
+            while (i < raw.length && raw[i] !== "\n")
+                i += 1;
+            out += "\n";
+            continue;
+        }
+        if (ch === "/" && next === "*") {
+            i += 2;
+            while (i < raw.length && !(raw[i] === "*" && raw[i + 1] === "/"))
+                i += 1;
+            i += 1;
+            continue;
+        }
+        if (ch === ",") {
+            let j = i + 1;
+            while (j < raw.length) {
+                while (/\s/u.test(raw[j] ?? ""))
+                    j += 1;
+                if (raw[j] === "/" && raw[j + 1] === "/") {
+                    while (j < raw.length && raw[j] !== "\n")
+                        j += 1;
+                    continue;
+                }
+                if (raw[j] === "/" && raw[j + 1] === "*") {
+                    j += 2;
+                    while (j < raw.length && !(raw[j] === "*" && raw[j + 1] === "/"))
+                        j += 1;
+                    j += 2;
+                    continue;
+                }
+                break;
+            }
+            if (raw[j] === "}" || raw[j] === "]")
+                continue;
+        }
+        out += ch;
+    }
+    return out;
+}
 export function auditHostSetupSurfaceVisibility(input) {
     const { repoRoot, packageRoot } = input;
     const opencodePluginRegistered = hasOpenCodePluginRegistration(repoRoot);
@@ -210,7 +289,17 @@ export function auditHostSetupSurfaceVisibility(input) {
             active: opencodePluginRegistered ? "managed" : "not-installed",
             support: "full",
             required: false,
-            ownership: "native npm plugin registration via the opencode.json plugin entry @webpresso/opencode-plugin",
+            ownership: "native npm plugin registration via the opencode.json/opencode.jsonc plugin entry @webpresso/opencode-plugin",
+        },
+        {
+            host: "grok",
+            artifact: existsSync(join(repoRoot, ".grok", "config.toml")) ? "installed" : "deferred",
+            active: existsSync(join(repoRoot, ".grok", "hooks", "webpresso.json"))
+                ? "managed"
+                : "not-installed",
+            support: "full",
+            required: false,
+            ownership: "native project .grok/config.toml MCP server plus .grok/hooks/webpresso.json; run /hooks-trust once to arm the hooks",
         },
     ];
 }

package/dist/esm/cli/commands/init/index.d.ts

@@ -30,6 +30,7 @@ export interface InitFlags {
     repair?: boolean;
     profile?: string;
 }
+export declare function setupDeprecationWarnings(flags: InitFlags): string[];
 /**
  * Which tier surfaces a given adoption-ladder profile scaffolds. Strict
  * supersets (see docs/adoption-ladder.md): quality ⊂ guarded ⊂ full.
@@ -83,6 +84,8 @@ export interface ResolveCatalogDirOptions {
     readonly argv0?: string;
     readonly argv1?: string;
     readonly pathEnv?: string;
+    readonly pathExtEnv?: string;
+    readonly platform?: NodeJS.Platform;
 }
 export declare function resolveCatalogDir(options?: ResolveCatalogDirOptions): string;
 export declare function formatHostSetupSurfaceVisibility(input: {