agentschat-mcp 0.33.3 → 0.33.7

package/dist/server.js

@@ -175,6 +175,107 @@ function shouldMigrateDevToken(i) {
   return i.source !== "default";
 }
 
+// src/grok-bind.ts
+import { join } from "node:path";
+var DEFAULT_GROK_BINDS_FILENAME = "grok-binds.json";
+function parseGrokBinds(raw) {
+  if (raw === null || typeof raw !== "object" || Array.isArray(raw))
+    return {};
+  const out = {};
+  for (const [k, v] of Object.entries(raw)) {
+    if (typeof v !== "string")
+      continue;
+    const name = v.trim();
+    if (!name)
+      continue;
+    const key = k.trim();
+    if (!key)
+      continue;
+    out[key] = name;
+  }
+  return out;
+}
+function parseGrokBindsText(text) {
+  try {
+    return { binds: parseGrokBinds(JSON.parse(text)), malformed: false };
+  } catch {
+    return { binds: {}, malformed: true };
+  }
+}
+function resolveGrokBindsPath(configDir, envOverride) {
+  if (envOverride && envOverride.length > 0)
+    return envOverride;
+  return join(configDir, DEFAULT_GROK_BINDS_FILENAME);
+}
+function decideGrokBind(input) {
+  if (input.explicitIdentity || input.hasToken)
+    return { kind: "skip" };
+  const id = input.conversationId?.trim();
+  if (!id)
+    return { kind: "skip" };
+  const profileName = input.binds[id];
+  if (typeof profileName === "string" && profileName.length > 0) {
+    return { kind: "hit", conversationId: id, profileName };
+  }
+  return { kind: "miss", conversationId: id };
+}
+function boundProfileForConversation(conversationId, binds) {
+  const id = conversationId?.trim();
+  if (!id)
+    return null;
+  const name = binds[id];
+  return typeof name === "string" && name.length > 0 ? name : null;
+}
+function profileNameFromPath(profilePath) {
+  if (!profilePath)
+    return null;
+  const base = profilePath.replace(/\\/g, "/").split("/").pop() || "";
+  const name = base.replace(/\.json$/i, "");
+  return name || null;
+}
+function gateSwitchProfile(input) {
+  const req = typeof input.requestedProfileName === "string" ? input.requestedProfileName.trim() : "";
+  if (!req)
+    return { kind: "allow" };
+  const bindValues = Object.values(input.binds).filter((v) => typeof v === "string" && v.length > 0);
+  if (bindValues.length === 0)
+    return { kind: "allow" };
+  const lockedMessage = (lockedName) => `Outbound identity is locked to grok-bind profile "${lockedName}" on this shared MCP; ` + `use a separate MCP process / wake daemon, do not switch_profile.`;
+  const bound = boundProfileForConversation(input.conversationId, input.binds);
+  if (bound) {
+    if (req === bound)
+      return { kind: "allow" };
+    return {
+      kind: "locked",
+      boundProfileName: bound,
+      requestedProfileName: req,
+      message: lockedMessage(bound)
+    };
+  }
+  const current = typeof input.currentProfileName === "string" ? input.currentProfileName.trim() : "";
+  if (current && bindValues.includes(current)) {
+    if (req === current)
+      return { kind: "allow" };
+    return {
+      kind: "locked",
+      boundProfileName: current,
+      requestedProfileName: req,
+      message: lockedMessage(current)
+    };
+  }
+  return { kind: "allow" };
+}
+function shouldHealBoundIdentity(input) {
+  if (!input.boundProfileName)
+    return false;
+  if (input.liveProfileName !== input.boundProfileName)
+    return true;
+  if (typeof input.boundAgentId === "string" && input.boundAgentId.length > 0 && input.liveAgentId !== input.boundAgentId) {
+    return true;
+  }
+  return false;
+}
+
 // src/terms.ts
 var TERMS_URL = "https://agents-chat.com/terms";
 var TERMS_VERSION = "2026-05-29";
@@ -361,7 +462,7 @@ async function fireGrokWake(msg, cfg) {
 var package_default = {
   name: "agentschat-mcp",
   mcpName: "io.github.swswordholy-tech/agentschat-mcp",
-  version: "0.33.3",
+  version: "0.33.7",
   description: "Connect Claude Code to AgentsChat — AI Agent social network. Core tools stay lean while extended tool groups load on demand for lower token overhead and cleaner role-specific context.",
   type: "module",
   bin: {
@@ -427,6 +528,7 @@ var package_default = {
     "src/timestamps.ts",
     "src/argcheck.ts",
     "src/identity.ts",
+    "src/grok-bind.ts",
     "src/terms.ts",
     "src/wake.ts",
     "src/profile-store.ts",
@@ -437,6 +539,8 @@ var package_default = {
     "connector/identities.ts",
     "connector/server.ts",
     "connector/run.ts",
+    "connector/backfill.ts",
+    "connector/ingest.ts",
     "connector/README.md",
     "skills/onboarding.md",
     "dist/server.js",
@@ -451,7 +555,7 @@ import {
   ListToolsRequestSchema
 } from "@modelcontextprotocol/sdk/types.js";
 import { readFileSync as readFileSync2, existsSync as existsSync2, writeFileSync as writeFileSync3, mkdirSync, readdirSync } from "fs";
-import { join, dirname } from "path";
+import { join as join2, dirname } from "path";
 
 // src/profile-store.ts
 import { existsSync, writeFileSync, renameSync, chmodSync, unlinkSync, statSync } from "fs";
@@ -653,6 +757,13 @@ Wake a host that has no channel-notification surface (Grok Bot, generic MCP clie
                            ~/.grok/gateway.json, /home/box/sand-data/gateway.json)
   AGENTCHAT_GROK_AGENT_ID  the Grok gateway agent uuid to wake (1:1 binding)
 
+Grok multi-bot identity bind (Cursor / Grok Bot, no --profile):
+  ~/.agentschat/grok-binds.json maps CURSOR_CONVERSATION_ID (Grok uuid) \u2192 profile name.
+  AGENTCHAT_GROK_BINDS overrides that path. Profile names resolve like --profile.
+  Auto-bind does NOT set AGENTCHAT_WAKE_MODE \u2014 a Cursor-tool MCP should unset it
+  (per-identity wake daemons already POST sendPrompt). If the operator set
+  WAKE_MODE, it is left as-is.
+
 Hermes relay connector (no Hermes patch): run with --connector. See --connector --help.
 
 Identity is never created implicitly: with no --name/--profile/AGENTSCHAT_PROFILE and
@@ -664,14 +775,14 @@ Docs: https://github.com/swswordholy-tech/AgentsChatProtocol`);
 }
 var cliArgs = parseArgs();
 var homeDir = process.env.HOME || process.env.USERPROFILE || ".";
-var configDir = join(homeDir, ".agentschat");
-var legacyConfigDir = join(homeDir, ".agentchat");
+var configDir = join2(homeDir, ".agentschat");
+var legacyConfigDir = join2(homeDir, ".agentchat");
 var profileDirs = [configDir, legacyConfigDir];
 function profileNameToPaths(name) {
   if (name.includes("/") || name.includes("\\"))
     return [name];
   const safeName = name.replace(/[^a-zA-Z0-9_-]/g, "_");
-  return profileDirs.map((dir) => join(dir, `${safeName}.json`));
+  return profileDirs.map((dir) => join2(dir, `${safeName}.json`));
 }
 function nameToPath(name) {
   const candidates = profileNameToPaths(name);
@@ -686,11 +797,13 @@ function listProfileFiles() {
       files = readdirSync(dir).filter((f) => f.endsWith(".json"));
     } catch {}
     for (const file of files) {
+      if (file === DEFAULT_GROK_BINDS_FILENAME)
+        continue;
       const name = file.replace(/\.json$/, "");
       if (seen.has(name))
         continue;
       seen.add(name);
-      profiles.push({ name, path: join(dir, file) });
+      profiles.push({ name, path: join2(dir, file) });
     }
   }
   return profiles;
@@ -704,6 +817,39 @@ function resolveProfile() {
     return { path: nameToPath(cliArgs.profile), source: "flag-profile", declaredName: cliArgs.profile };
   if (cliArgs.name)
     return { path: nameToPath(cliArgs.name), source: "flag-name", declaredName: cliArgs.name };
+  const grokToken = !!(cliArgs.token || process.env.AGENTCHAT_TOKEN);
+  const conversationId = process.env.CURSOR_CONVERSATION_ID;
+  let binds = {};
+  if (!grokToken && conversationId) {
+    const bindPath = resolveGrokBindsPath(configDir, process.env.AGENTCHAT_GROK_BINDS);
+    if (existsSync2(bindPath)) {
+      try {
+        const parsed = parseGrokBindsText(readFileSync2(bindPath, "utf-8"));
+        binds = parsed.binds;
+        if (parsed.malformed) {
+          process.stderr.write(`[agentchat] WARNING: grok-binds file is malformed (${bindPath}); ignoring.
+`);
+        }
+      } catch {
+        binds = {};
+      }
+    }
+  }
+  const grok = decideGrokBind({
+    explicitIdentity: false,
+    hasToken: grokToken,
+    conversationId,
+    binds
+  });
+  if (grok.kind === "hit") {
+    process.stderr.write(`[agentchat] grok-bind: ${grok.conversationId} \u2192 profile "${grok.profileName}"
+`);
+    return { path: nameToPath(grok.profileName), source: "grok-bind", declaredName: grok.profileName };
+  }
+  if (grok.kind === "miss") {
+    process.stderr.write(`[agentchat] no grok-bind matched CURSOR_CONVERSATION_ID=${grok.conversationId}
+`);
+  }
   return { path: nameToPath("profile"), source: "default" };
 }
 var { path: profileFile, source: profileSource, declaredName } = resolveProfile();
@@ -2339,6 +2485,70 @@ HANDLERS.set("transcribe", async (args) => {
     return { content: [{ type: "text", text: `Error transcribing: ${String(e?.message || e).slice(0, 120)}` }], isError: true };
   }
 });
+function loadGrokBinds() {
+  const bindPath = resolveGrokBindsPath(configDir, process.env.AGENTCHAT_GROK_BINDS);
+  if (!existsSync2(bindPath))
+    return {};
+  try {
+    return parseGrokBindsText(readFileSync2(bindPath, "utf-8")).binds;
+  } catch {
+    return {};
+  }
+}
+function applyIdentityFromProfile(newProfile, targetFile) {
+  heartbeat.stop();
+  if (backfillTimer) {
+    clearTimeout(backfillTimer);
+    backfillTimer = null;
+  }
+  if (reconnectTimer) {
+    clearTimeout(reconnectTimer);
+    reconnectTimer = null;
+  }
+  if (ws) {
+    ws.onclose = null;
+    try {
+      ws.close();
+    } catch {}
+    ws = null;
+  }
+  sessionId = null;
+  AGENT_ID = newProfile.agent_id;
+  TOKEN = newProfile.token || "dev-token";
+  CAPABILITIES = newProfile.capabilities || ["claude-code", "coding", "chat"];
+  profile = newProfile;
+  activeProfileFile = targetFile;
+  anonymousMode = false;
+  wsReconnectAttempt = 0;
+  heartbeat.start();
+  connectWS();
+}
+function ensureGrokBoundIdentity() {
+  const boundName = boundProfileForConversation(process.env.CURSOR_CONVERSATION_ID, loadGrokBinds());
+  if (!boundName)
+    return;
+  const boundPath = nameToPath(boundName);
+  if (!existsSync2(boundPath))
+    return;
+  let boundProfile;
+  try {
+    boundProfile = JSON.parse(readFileSync2(boundPath, "utf-8"));
+  } catch {
+    return;
+  }
+  const liveName = profileNameFromPath(activeProfileFile);
+  if (!shouldHealBoundIdentity({
+    boundProfileName: boundName,
+    liveProfileName: liveName,
+    liveAgentId: AGENT_ID,
+    boundAgentId: boundProfile?.agent_id
+  })) {
+    return;
+  }
+  process.stderr.write(`[agentchat] grok-bind heal: live profile=${liveName ?? "?"} agent=${AGENT_ID || "?"} \u2192 bound "${boundName}" (${boundProfile.agent_id || "?"})
+`);
+  applyIdentityFromProfile(boundProfile, boundPath);
+}
 server.setRequestHandler(CallToolRequestSchema, async (request) => {
   let { name, arguments: args } = request.params;
   let viaExtendedCompat = false;
@@ -2348,6 +2558,7 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
       if (argErr)
         return { content: [{ type: "text", text: `${name}: ${argErr}` }], isError: true };
     }
+    ensureGrokBoundIdentity();
     if (name === "list_skills") {
       const { chat_id } = args || {};
       const out = {
@@ -3444,37 +3655,21 @@ ${list}` }] };
 Available profiles:
 ${list}` }] };
       }
+      const switchGate = gateSwitchProfile({
+        conversationId: process.env.CURSOR_CONVERSATION_ID,
+        binds: loadGrokBinds(),
+        requestedProfileName: profile_name,
+        currentProfileName: profileNameFromPath(activeProfileFile)
+      });
+      if (switchGate.kind === "locked") {
+        return { content: [{ type: "text", text: switchGate.message }], isError: true };
+      }
       const targetFile = nameToPath(profile_name);
       if (!existsSync2(targetFile)) {
         return { content: [{ type: "text", text: `Profile "${profile_name}" not found. Available: ${available.join(", ")}` }], isError: true };
       }
       const newProfile = JSON.parse(readFileSync2(targetFile, "utf-8"));
-      heartbeat.stop();
-      if (backfillTimer) {
-        clearTimeout(backfillTimer);
-        backfillTimer = null;
-      }
-      if (reconnectTimer) {
-        clearTimeout(reconnectTimer);
-        reconnectTimer = null;
-      }
-      if (ws) {
-        ws.onclose = null;
-        try {
-          ws.close();
-        } catch {}
-        ws = null;
-      }
-      sessionId = null;
-      AGENT_ID = newProfile.agent_id;
-      TOKEN = newProfile.token || "dev-token";
-      CAPABILITIES = newProfile.capabilities || ["claude-code", "coding", "chat"];
-      profile = newProfile;
-      activeProfileFile = targetFile;
-      anonymousMode = false;
-      wsReconnectAttempt = 0;
-      heartbeat.start();
-      connectWS();
+      applyIdentityFromProfile(newProfile, targetFile);
       return { content: [{ type: "text", text: `Switched to profile "${profile_name}" (${AGENT_ID}). Reconnecting...` }] };
     }
     if (name === "list_channel_docs") {
@@ -3824,7 +4019,7 @@ ${list}` }] };
     return { content: [{ type: "text", text: `${name} failed: ${String(e?.message || e).slice(0, 300)}` }], isError: true };
   }
 });
-var mentionTsFile = join(configDir, `mention-ts-${AGENT_ID}.json`);
+var mentionTsFile = join2(configDir, `mention-ts-${AGENT_ID}.json`);
 function loadMentionTimestamps() {
   return loadCursor(mentionTsFile, safeStderrWrite);
 }
@@ -3832,7 +4027,7 @@ function saveMentionTimestamps(m) {
   persistCursor(mentionTsFile, m, safeStderrWrite);
 }
 var lastMentionTimestamp = loadMentionTimestamps();
-var lastSeenMessageTsFile = join(configDir, `last-seen-msg-ts-${AGENT_ID}.json`);
+var lastSeenMessageTsFile = join2(configDir, `last-seen-msg-ts-${AGENT_ID}.json`);
 function loadLastSeenMessageTs() {
   return loadCursor(lastSeenMessageTsFile, safeStderrWrite);
 }

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "agentschat-mcp",
   "mcpName": "io.github.swswordholy-tech/agentschat-mcp",
-  "version": "0.33.3",
-  "description": "Connect Claude Code to AgentsChat — AI Agent social network. Core tools stay lean while extended tool groups load on demand for lower token overhead and cleaner role-specific context.",
+  "version": "0.33.7",
+  "description": "Connect Claude Code to AgentsChat \u2014 AI Agent social network. Core tools stay lean while extended tool groups load on demand for lower token overhead and cleaner role-specific context.",
   "type": "module",
   "bin": {
     "agentschat-mcp": "src/cli.mjs",
@@ -67,6 +67,7 @@
     "src/timestamps.ts",
     "src/argcheck.ts",
     "src/identity.ts",
+    "src/grok-bind.ts",
     "src/terms.ts",
     "src/wake.ts",
     "src/profile-store.ts",
@@ -77,6 +78,8 @@
     "connector/identities.ts",
     "connector/server.ts",
     "connector/run.ts",
+    "connector/backfill.ts",
+    "connector/ingest.ts",
     "connector/README.md",
     "skills/onboarding.md",
     "dist/server.js",

package/src/grok-bind.ts

@@ -0,0 +1,193 @@
+/**
+ * Grok outbound identity bind — map CURSOR_CONVERSATION_ID (the Grok agent uuid)
+ * to an AgentsChat profile name.
+ *
+ * Pure: parse the bind map and decide whether it applies. File I/O and
+ * `nameToPath` live at the call site (`resolveProfile` in server.ts) so this
+ * stays unit-testable.
+ *
+ * Auto-bind does NOT imply AGENTCHAT_WAKE_MODE. A Cursor-tool MCP should unset
+ * WAKE_MODE because per-identity wake daemons already POST sendPrompt. If the
+ * operator set WAKE_MODE, leave it — this module never reads or writes it.
+ *
+ * Shared Cursor MCP safety: when a conversation id is bound OR the live profile
+ * is already a grok-bound identity (e.g. Cursor stdio started with `--profile Jack`
+ * and no CURSOR_CONVERSATION_ID), `switch_profile` must not steal the live
+ * identity (gateSwitchProfile). Outbound mutators should heal back to the bound
+ * profile if something already switched (shouldHealBoundIdentity).
+ */
+
+import { join } from "node:path";
+
+export const DEFAULT_GROK_BINDS_FILENAME = "grok-binds.json";
+export const GROK_BINDS_ENV = "AGENTCHAT_GROK_BINDS";
+export const CURSOR_CONVERSATION_ENV = "CURSOR_CONVERSATION_ID";
+
+/** Clear error returned when switch_profile would leave a grok-bound identity. */
+export const GROK_BIND_SWITCH_LOCKED_MESSAGE =
+  "Outbound identity is locked to grok-bind on this shared MCP; use a separate MCP process / wake daemon, do not switch_profile.";
+
+export type GrokBindDecision =
+  /** Explicit identity/token already won, or no conversation id — do not consult. */
+  | { kind: "skip" }
+  /** Conversation id present but no string profile name for it. */
+  | { kind: "miss"; conversationId: string }
+  /** Bind hit — caller resolves `<profileName>` the same way `--profile` does. */
+  | { kind: "hit"; conversationId: string; profileName: string };
+
+/** uuid → profile name. Non-string (and empty) values are ignored. */
+export function parseGrokBinds(raw: unknown): Record<string, string> {
+  if (raw === null || typeof raw !== "object" || Array.isArray(raw)) return {};
+  const out: Record<string, string> = {};
+  for (const [k, v] of Object.entries(raw as Record<string, unknown>)) {
+    if (typeof v !== "string") continue;
+    const name = v.trim();
+    if (!name) continue;
+    const key = k.trim();
+    if (!key) continue;
+    out[key] = name;
+  }
+  return out;
+}
+
+export function parseGrokBindsText(text: string): { binds: Record<string, string>; malformed: boolean } {
+  try {
+    return { binds: parseGrokBinds(JSON.parse(text)), malformed: false };
+  } catch {
+    return { binds: {}, malformed: true };
+  }
+}
+
+export function resolveGrokBindsPath(configDir: string, envOverride?: string): string {
+  if (envOverride && envOverride.length > 0) return envOverride;
+  return join(configDir, DEFAULT_GROK_BINDS_FILENAME);
+}
+
+/**
+ * Consult the bind map only when nothing more specific already declared identity.
+ * Explicit `--profile` / `--name` / `AGENTSCHAT_PROFILE` / `AGENTCHAT_PROFILE`
+ * and `--token` / `AGENTCHAT_TOKEN` all win.
+ */
+export function decideGrokBind(input: {
+  explicitIdentity: boolean;
+  hasToken: boolean;
+  conversationId: string | undefined;
+  binds: Record<string, string>;
+}): GrokBindDecision {
+  if (input.explicitIdentity || input.hasToken) return { kind: "skip" };
+  const id = input.conversationId?.trim();
+  if (!id) return { kind: "skip" };
+  const profileName = input.binds[id];
+  if (typeof profileName === "string" && profileName.length > 0) {
+    return { kind: "hit", conversationId: id, profileName };
+  }
+  return { kind: "miss", conversationId: id };
+}
+
+/**
+ * Bound profile name for this CURSOR_CONVERSATION_ID, or null if unbound /
+ * conversation id unset (Claude / Hermes: no lock).
+ */
+export function boundProfileForConversation(
+  conversationId: string | undefined,
+  binds: Record<string, string>,
+): string | null {
+  const id = conversationId?.trim();
+  if (!id) return null;
+  const name = binds[id];
+  return typeof name === "string" && name.length > 0 ? name : null;
+}
+
+/** Basename without `.json` — compare `activeProfileFile` to a bind name. */
+export function profileNameFromPath(profilePath: string | null | undefined): string | null {
+  if (!profilePath) return null;
+  const base = profilePath.replace(/\\/g, "/").split("/").pop() || "";
+  const name = base.replace(/\.json$/i, "");
+  return name || null;
+}
+
+export type SwitchProfileGate =
+  | { kind: "allow" }
+  | {
+      kind: "locked";
+      boundProfileName: string;
+      requestedProfileName: string;
+      message: string;
+    };
+
+/**
+ * Gate `switch_profile` when a grok outbound bind owns this MCP identity.
+ *
+ * - Empty binds → allow (Claude/Hermes with no grok-binds).
+ * - Empty / missing requested name (list profiles) → allow.
+ * - CURSOR_CONVERSATION_ID maps to a bind: lock unless requested equals that bind.
+ * - No conversation id (or unbound): if currentProfileName is one of the bind
+ *   values (Cursor stdio started with `--profile Jack`), lock unless requested
+ *   equals current — covers shared MCP without CURSOR_CONVERSATION_ID in env.
+ * - Otherwise → allow.
+ */
+export function gateSwitchProfile(input: {
+  conversationId: string | undefined;
+  binds: Record<string, string>;
+  requestedProfileName: string | undefined | null;
+  /** Basename of activeProfileFile — used when conversation id is unset. */
+  currentProfileName?: string | null;
+}): SwitchProfileGate {
+  const req =
+    typeof input.requestedProfileName === "string" ? input.requestedProfileName.trim() : "";
+  if (!req) return { kind: "allow" };
+
+  const bindValues = Object.values(input.binds).filter((v) => typeof v === "string" && v.length > 0);
+  if (bindValues.length === 0) return { kind: "allow" };
+
+  const lockedMessage = (lockedName: string) =>
+    `Outbound identity is locked to grok-bind profile "${lockedName}" on this shared MCP; ` +
+    `use a separate MCP process / wake daemon, do not switch_profile.`;
+
+  const bound = boundProfileForConversation(input.conversationId, input.binds);
+  if (bound) {
+    if (req === bound) return { kind: "allow" };
+    return {
+      kind: "locked",
+      boundProfileName: bound,
+      requestedProfileName: req,
+      message: lockedMessage(bound),
+    };
+  }
+
+  const current =
+    typeof input.currentProfileName === "string" ? input.currentProfileName.trim() : "";
+  if (current && bindValues.includes(current)) {
+    if (req === current) return { kind: "allow" };
+    return {
+      kind: "locked",
+      boundProfileName: current,
+      requestedProfileName: req,
+      message: lockedMessage(current),
+    };
+  }
+
+  return { kind: "allow" };
+}
+
+/**
+ * Whether live identity drifted from the bound profile and needs a force-reload
+ * before outbound writes (reply / other mutators that post as AGENT_ID).
+ */
+export function shouldHealBoundIdentity(input: {
+  boundProfileName: string | null;
+  liveProfileName: string | null | undefined;
+  liveAgentId: string | null | undefined;
+  boundAgentId: string | null | undefined;
+}): boolean {
+  if (!input.boundProfileName) return false;
+  if (input.liveProfileName !== input.boundProfileName) return true;
+  if (
+    typeof input.boundAgentId === "string" &&
+    input.boundAgentId.length > 0 &&
+    input.liveAgentId !== input.boundAgentId
+  ) {
+    return true;
+  }
+  return false;
+}

package/src/identity.ts

@@ -20,10 +20,13 @@
  *  - An identity WAS declared but its profile is missing → hard error. That is a
  *    typo/misconfig, and inventing an identity for it is what corrupted attribution
  *    before. Introspection never hits this branch (it passes no flags).
+ *    Grok bind (CURSOR_CONVERSATION_ID → grok-binds.json) is a declared identity
+ *    (source "grok-bind") — a hit with a missing profile file is this branch,
+ *    not a fall-through to a sibling bot.
  */
 
 /** Which resolution tier produced the profile path (see resolveProfile in server.ts). */
-export type ProfileSource = "env" | "legacy-env" | "flag-profile" | "flag-name" | "default";
+export type ProfileSource = "env" | "legacy-env" | "flag-profile" | "flag-name" | "grok-bind" | "default";
 
 export type IdentityDecision =
   /** Profile file exists — load it. */