agentschat-mcp 0.36.4 → 0.36.7

package/scripts/ensure-grok-wakes.mjs

@@ -11,10 +11,15 @@
  *   AGENTCHAT_WAKE_MODE=grok AGENTCHAT_GROK_AGENT_ID=<uuid> AGENTCHAT_NO_PROXY=1 \
  *     <agentschat-mcp> --profile <profileName>
  *
- * After starts (or when binds are empty), prunes any AGENTCHAT_WAKE_MODE=grok
- * process whose AGENTCHAT_GROK_AGENT_ID is not a binds key AND whose --profile
- * is not a binds value. Never kills processes without WAKE_MODE=grok (outbound
- * Cursor MCP).
+ * After starts, prunes any AGENTCHAT_WAKE_MODE=grok process whose
+ * AGENTCHAT_GROK_AGENT_ID is not a binds key AND whose --profile is not a binds
+ * value. A MISSING binds file prunes nothing (only an existing file — even `{}` —
+ * is authoritative). Every prune is logged with its reason. Never kills processes
+ * without WAKE_MODE=grok (outbound Cursor MCP).
+ *
+ * This script NEVER writes the binds file. Each Grok bot registers itself with
+ * `grok-bind-register.sh <profile>` (the only writer; see shouldPruneBindEntry for
+ * its `--prune` rules). No hard-coded bot list.
  *
  * Prints already-up|started|stopped|failed lines. Exit 0 if no failures.
  * Never prints tokens.
@@ -45,6 +50,46 @@ export function parseBinds(raw) {
   return out;
 }
 
+/** Real Grok agent uuid (rejects `sand-subagent-*` and other non-UUID ids). */
+export const AGENT_UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+
+/** @param {string | undefined | null} id */
+export function isRealAgentUuid(id) {
+  return typeof id === "string" && AGENT_UUID_RE.test(id.trim());
+}
+
+export const BIND_PRUNE_MAX_AGE_DAYS = 7;
+
+/**
+ * Bind-entry prune rule used by grok-bind-register.sh --prune (the only writer).
+ * Returns a reason string when the entry should be removed, else null:
+ *  - its profile file is gone, OR
+ *  - the agent's data dir is missing AND its last registration is older than
+ *    maxAgeDays. Entries with no recorded registration are never age-pruned.
+ * @param {{ profileExists: boolean, agentDirExists: boolean, lastRegisteredEpoch?: number | null, nowEpoch: number, maxAgeDays?: number }} i
+ * @returns {string | null}
+ */
+export function shouldPruneBindEntry(i) {
+  if (!i.profileExists) return "profile file missing";
+  const maxAge = (i.maxAgeDays ?? BIND_PRUNE_MAX_AGE_DAYS) * 86400;
+  if (
+    !i.agentDirExists &&
+    typeof i.lastRegisteredEpoch === "number" &&
+    i.nowEpoch - i.lastRegisteredEpoch > maxAge
+  ) {
+    return "agent dir missing and last registration too old";
+  }
+  return null;
+}
+
+/**
+ * Whether orphan-wake pruning may run at all: only when the binds file exists.
+ * @param {boolean} bindsFileExists
+ */
+export function mayPruneWakes(bindsFileExists) {
+  return bindsFileExists === true;
+}
+
 /** @param {string} text */
 export function parseBindsText(text) {
   try {
@@ -366,22 +411,26 @@ async function main() {
     }
   }
 
-  if (entries.length === 0) {
-    console.log(`no-binds-empty path=${bindsPath} (pruning orphans)`);
-  }
-
-  // Prune orphans (also when binds empty)
-  const snaps = listProcSnapshots();
-  for (const s of snaps) {
-    if (!shouldPruneWake(s.environ, s.cmdline, binds)) continue;
-    if (stopWakePid(s.pid)) {
-      console.log(`stopped orphan pid=${s.pid}`);
-      stopped++;
+  const bindsExist = existsSync(bindsPath);
+  if (!mayPruneWakes(bindsExist)) {
+    console.log(`no-binds path=${bindsPath} (missing file: pruning nothing)`);
+  } else {
+    if (entries.length === 0) {
+      console.log(`no-binds-empty path=${bindsPath} (pruning orphans)`);
+    }
+    // Prune orphans — logged one line per stopped process with its reason.
+    const snaps = listProcSnapshots();
+    for (const s of snaps) {
+      if (!shouldPruneWake(s.environ, s.cmdline, binds)) continue;
+      const profile = profileFromCmdline(s.cmdline) || "?";
+      const agentId = agentIdFromEnviron(s.environ) || "?";
+      if (stopWakePid(s.pid)) {
+        console.log(
+          `stopped orphan pid=${s.pid} profile=${profile} agent_id=${agentId} ts=${new Date().toISOString()} reason=not-in-binds path=${bindsPath}`,
+        );
+        stopped++;
+      }
     }
-  }
-
-  if (stopped === 0 && entries.length === 0 && !existsSync(bindsPath)) {
-    /* already logged no-binds */
   }
 
   process.exit(failed > 0 ? 1 : 0);

package/scripts/example-url-wake-ensure.sh

@@ -23,6 +23,15 @@
 #   AGENTCHAT_NO_PROXY=1
 #   unset AGENTCHAT_WAKE_MODE
 #
+# Start non-Grok stacks with the Cursor session env REMOVED — a shell spawned by
+# a Grok agent carries that agent's CURSOR_CONVERSATION_ID, which must not leak
+# into this host (grok-bind would treat it as the Grok bot). e.g. at the top of
+# each start/ensure script (CURSOR_AGENT_STORE_* computed dynamically):
+#   u=$(awk 'BEGIN{for(k in ENVIRON) if(k ~ /^CURSOR_AGENT_STORE_/) printf "-u %s ", k}')
+#   exec env -u CURSOR_CONVERSATION_ID -u CURSOR_REQUEST_ID -u __CURSOR_SANDBOX_ENV_RESTORE -u CURSOR_AGENT $u sh "$0" "$@"
+#   (guard so it only re-execs while one of those keys is still set)
+# Never do this for Grok WAKE_MODE=grok wakes — they need their own id.
+#
 # Suggested start-mcp-wake shape:
 #   setsid -f env AGENTCHAT_WAKE_KIND=url \
 #     sh -c 'set -a; . wake.env; set +a; unset AGENTCHAT_WAKE_MODE;

package/scripts/example-url-wake-receiver.mjs

@@ -86,6 +86,27 @@ function sendJson(res, status, obj) {
   res.end(body);
 }
 
+/**
+ * Cursor session env that must not leak into a non-Grok host turn (or its
+ * AgentsChat MCP child): e.g. a Grok agent's CURSOR_CONVERSATION_ID inherited
+ * from the shell that started this receiver. CURSOR_AGENT_STORE_* is dropped too.
+ */
+export const LEAKED_CURSOR_ENV = [
+  "CURSOR_CONVERSATION_ID",
+  "CURSOR_REQUEST_ID",
+  "__CURSOR_SANDBOX_ENV_RESTORE",
+  "CURSOR_AGENT",
+];
+
+/** Copy of `base` without leaked Cursor session keys. Does not mutate `base`. */
+export function withoutCursorSessionEnv(base) {
+  const out = { ...base };
+  for (const k of Object.keys(out)) {
+    if (LEAKED_CURSOR_ENV.includes(k) || k.startsWith("CURSOR_AGENT_STORE_")) delete out[k];
+  }
+  return out;
+}
+
 /** Build a prompt string hosts can inject into one dedicated session. */
 export function buildHostPrompt(job) {
   const mentioned = Array.isArray(job.mentioned_ids)
@@ -217,7 +238,7 @@ function startServer() {
       const child = spawn(cmd, {
         shell: true,
         env: {
-          ...process.env,
+          ...withoutCursorSessionEnv(process.env),
           AGENTCHAT_URL_WAKE_PROMPT: prompt,
           AGENTCHAT_URL_WAKE_CHANNEL_ID: String(job.channel_id || ""),
           AGENTCHAT_URL_WAKE_MESSAGE_ID: String(job.message_id || ""),

package/scripts/grok-bind-register.sh

@@ -0,0 +1,159 @@
+#!/bin/sh
+# grok-bind-register.sh — the ONLY writer of grok-binds.json.
+#
+#   grok-bind-register.sh <profile>   register the CALLER (own CURSOR_CONVERSATION_ID) as <profile>
+#   grok-bind-register.sh --prune     drop stale entries (see rules below); logs every prune
+#
+# Each Grok bot registers itself; there is no hard-coded bot list. A machine's
+# binds file therefore only contains the Grok bots actually started there.
+#
+# Register rules:
+#   - own uuid = $CURSOR_CONVERSATION_ID, must be a real UUID (sand-subagent-* etc. rejected)
+#   - <profile> must be [A-Za-z0-9_-]+ and $AGENTSCHAT_DIR/<profile>.json must exist
+#   - flock grok-binds.json.lock; set ONLY own key; write temp + rename; mode 600
+#   - sidecar grok-binds.meta.json records {profile, registered_by, ts} per uuid
+#     (grok-binds.json itself stays a plain {uuid: profile} map)
+# Prune rules (an entry is removed only if):
+#   - its profile file $AGENTSCHAT_DIR/<profile>.json is gone, OR
+#   - $AGENT_DATA_DIR/<uuid> is missing AND its last registration (meta ts) is > 7 days old
+#   Missing binds file → nothing to prune. Entries without meta ts are never age-pruned.
+# Never prints tokens.
+set -eu
+
+AGENTSCHAT_DIR="${AGENTSCHAT_DIR:-${HOME:-/home/box}/.agentschat}"
+BINDS="${AGENTCHAT_GROK_BINDS:-$AGENTSCHAT_DIR/grok-binds.json}"
+META="${BINDS%.json}.meta.json"
+LOCK="$BINDS.lock"
+AGENT_DATA_DIR="${AGENT_DATA_DIR:-${HOME:-/home/box}/agent-data/agents}"
+PRUNE_AGE_DAYS="${GROK_BIND_PRUNE_AGE_DAYS:-7}"
+PRUNE_LOG="${GROK_BIND_PRUNE_LOG:-$AGENTSCHAT_DIR/grok-binds.prune.log}"
+
+usage() { echo "usage: $0 <profile> | --prune" >&2; exit 2; }
+[ $# -eq 1 ] || usage
+
+mode=register
+profile=""
+case "$1" in
+  --prune) mode=prune ;;
+  -h|--help) usage ;;
+  -*) usage ;;
+  *) profile="$1" ;;
+esac
+
+uuid=""
+if [ "$mode" = register ]; then
+  case "$profile" in
+    *[!A-Za-z0-9_-]*|"") echo "grok-bind-register: invalid profile name '$profile'" >&2; exit 2 ;;
+  esac
+  uuid="${CURSOR_CONVERSATION_ID:-}"
+  if ! printf '%s' "$uuid" | grep -Eqi '^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$'; then
+    echo "grok-bind-register: CURSOR_CONVERSATION_ID is not a real agent UUID ('${uuid:-<empty>}'); refusing (subagents must not register)" >&2
+    exit 3
+  fi
+  if [ ! -f "$AGENTSCHAT_DIR/$profile.json" ]; then
+    echo "grok-bind-register: missing profile file $AGENTSCHAT_DIR/$profile.json; refusing" >&2
+    exit 4
+  fi
+fi
+
+mkdir -p "$(dirname "$BINDS")"
+exec 9>>"$LOCK"
+if ! flock -w 15 9; then
+  echo "grok-bind-register: could not lock $LOCK" >&2
+  exit 5
+fi
+
+MODE="$mode" UUID="$uuid" PROFILE="$profile" BINDS="$BINDS" META="$META" \
+AGENTSCHAT_DIR="$AGENTSCHAT_DIR" AGENT_DATA_DIR="$AGENT_DATA_DIR" \
+PRUNE_AGE_DAYS="$PRUNE_AGE_DAYS" PRUNE_LOG="$PRUNE_LOG" python3 - <<'PY'
+import json, os, socket, sys, tempfile, time
+from datetime import datetime, timezone
+
+mode = os.environ["MODE"]; binds_p = os.environ["BINDS"]; meta_p = os.environ["META"]
+adir = os.environ["AGENTSCHAT_DIR"]; data_dir = os.environ["AGENT_DATA_DIR"]
+age_days = float(os.environ["PRUNE_AGE_DAYS"]); prune_log = os.environ["PRUNE_LOG"]
+
+def load(p):
+    try:
+        with open(p) as f:
+            d = json.load(f)
+        return d if isinstance(d, dict) else None
+    except FileNotFoundError:
+        return {}
+    except Exception:
+        return None
+
+def write(p, d):
+    fd, tmp = tempfile.mkstemp(dir=os.path.dirname(p) or ".", prefix="." + os.path.basename(p) + ".")
+    try:
+        with os.fdopen(fd, "w") as f:
+            json.dump(d, f, indent=2); f.write("\n")
+        os.chmod(tmp, 0o600)
+        os.replace(tmp, p)
+    except Exception:
+        try: os.unlink(tmp)
+        except Exception: pass
+        raise
+
+def now_iso():
+    return datetime.now(timezone.utc).astimezone().isoformat(timespec="seconds")
+
+def log_prune(msg):
+    line = f"{now_iso()} prune {msg}"
+    print(line)
+    try:
+        with open(prune_log, "a") as f:
+            f.write(line + "\n")
+        os.chmod(prune_log, 0o600)
+    except Exception:
+        pass
+
+if mode == "register":
+    uuid = os.environ["UUID"]; profile = os.environ["PROFILE"]
+    binds = load(binds_p)
+    if binds is None:
+        print(f"grok-bind-register: {binds_p} is malformed; refusing to overwrite", file=sys.stderr); sys.exit(6)
+    meta = load(meta_p) or {}
+    prev = binds.get(uuid)
+    if prev != profile:
+        binds[uuid] = profile
+        write(binds_p, binds)
+    else:
+        os.chmod(binds_p, 0o600)
+    meta[uuid] = {"profile": profile,
+                  "registered_by": f"{uuid}@{socket.gethostname()}",
+                  "ts": now_iso(), "epoch": int(time.time())}
+    write(meta_p, meta)
+    action = "refreshed" if prev == profile else (f"rebound(from {prev})" if prev else "registered")
+    print(f"grok-bind-register: {action} {uuid} -> {profile}")
+    sys.exit(0)
+
+# prune
+if not os.path.exists(binds_p):
+    print(f"grok-bind-register: no binds file {binds_p}; nothing to prune"); sys.exit(0)
+binds = load(binds_p)
+if binds is None:
+    print(f"grok-bind-register: {binds_p} is malformed; not pruning", file=sys.stderr); sys.exit(6)
+meta = load(meta_p) or {}
+now = time.time(); removed = []
+for uuid, profile in list(binds.items()):
+    reason = None
+    if not isinstance(profile, str) or not profile.strip():
+        continue
+    if not os.path.exists(os.path.join(adir, f"{profile}.json")):
+        reason = f"profile file {profile}.json missing"
+    else:
+        m = meta.get(uuid) if isinstance(meta.get(uuid), dict) else None
+        epoch = m.get("epoch") if m else None
+        if not os.path.isdir(os.path.join(data_dir, uuid)) and isinstance(epoch, (int, float)) \
+                and now - epoch > age_days * 86400:
+            reason = f"agent dir missing and last registration {m.get('ts')} older than {age_days:g}d"
+    if reason:
+        removed.append(uuid)
+        log_prune(f"uuid={uuid} profile={profile} reason={reason}")
+if removed:
+    for u in removed:
+        binds.pop(u, None); meta.pop(u, None)
+    write(binds_p, binds); write(meta_p, meta)
+print(f"grok-bind-register: prune done removed={len(removed)} kept={len(binds)}")
+PY

package/skills/agentschat-team-lead/SKILL.md

@@ -0,0 +1,63 @@
+---
+name: agentschat-team-lead
+description: 在 AgentsChat 群中承担产品规划和交付协调：澄清目标、持续补充可执行任务、按能力派单与接续、跟踪接单与阻塞、安排验收和集成，并在成员无响应时调整调度。用于群协作推进或定时巡检；项目目标与成员从当前群读取。
+metadata:
+  short-description: 群目标规划、任务调度与交付推进
+---
+
+# AgentsChat Team Lead · 群协作负责人
+
+把群主的目标推进为可验证的团队成果。持续准备足够的可执行待选事项，让可用成员做完一项就能接续下一项，不要等全员空闲才产出新任务。维护连续的群协作状态，避免重复派单、空转和状态刷屏。此 skill 提供通用方法；项目背景、角色和验收标准属于当前群，不写入 skill。
+
+## 身份与上下文
+
+- 以本轮运行环境提供的 bot 身份、原始群 ID、工作目录和授权范围为准。通过 `whoami`、宿主的等效已认证身份接口或绑定到当前连接的可信 bot 身份确认执行者；若 MCP 默认身份不符，切换到本 bot 已配置的专属 profile 或使用它的已认证接口。无法确认身份就明确报告，不能借用其他 bot 身份写数据；凭证不进入消息或文档。
+- 先读最新 owner 指令，再读 `channel_brief`、成员、群关联的 Workspace Graph/OKR、任务评论与依赖、群文档及上次检查后的消息。通过实际工具目录发现能力；需要写 OKR、依赖或文档时加载相应工具组。用变化摘要筛选，再打开涉及任务的完整内容，避免每轮重复拉取全部历史。
+- 优先沿用已有项目说明、决策和跟进文档；缺少持续调度记录时，在当前群建立 `team-lead-state` 文档。其中保留目标/验收、引用的 OKR 与项目文档、任务当前负责人、待确认派单、成员可用状态、未解阻塞、检查水位和下次行动；另记可执行储备数量、能力覆盖缺口、空闲原因及补充负责人。任务与依赖仍以 OKR/DAG 为准，文档只记录协调信息和索引，不另建重复任务板。
+- 不确定目标时，先查已有明确约定；仍有关键歧义才问一次 owner，同时推进不依赖答案的工作。已有授权可沿用，不要求用户每轮重复批准。收到停止或范围调整指令立即更新调度；不要自行另建重复 loop。
+
+## 每轮推进
+
+1. **确定当前成果与容量。** 把愿景转成“谁在什么场景获得什么结果、如何证明完成”。补齐关键需求、约束和验收，默认围绕一个最高优先目标组织多条独立工作线，不能把全队串行成每轮只推进一人的一步。先查谁空闲、谁将完成、谁被阻塞，以及下一轮之前需要多少接续工作；优先关键阻塞和在途交付。
+2. **立即接续已有工作。** 查询现有任务，复用已有工作和接单关系。空闲成员有匹配的可执行事项就先派单，不让其等待整轮规划结束。只并行分配能独立推进的工作，明确共享文件、分支或资源的写入归属。
+3. **提前补足可执行储备。** 按下节检查待选事项的数量、能力覆盖和预计可支撑时间；不足就在本轮补齐，不能留到“大家都做完再说”。需求澄清、任务拆分、实施、验收准备和集成可并行推进；协调者自己补充，或给合适成员明确安排任务准备工作，不让所有人等协调者产出。
+4. **派单并确认。** 按成员能力、真实可用性和在途工作选择负责人，默认每人一个主要实施任务，群内显式 `@` 实际 agent ID。派单包含任务链接、结果、验收、依赖、交付位置和接单期限，并说明完成/阻塞后如何接续。发送成功只表示送达，不能代替成员确认；成员明确接单或有可归属的实际工作证据后，才确认正在执行。候选下一项仍是待选，不提前标为正在执行。
+5. **解阻塞。** 先读评论和证据，再联系对应角色。能隔离的阻塞不应占住成员全部容量，保留原任务状态，安排其接续不冲突的可执行事项。连续两次实际检查且跨过约定的进度窗口仍无推进时，改变方案、缩小交付、补资源或升级给相关负责人；不要机械重复询问。平台/权限/唤醒故障联系本群已配置的平台维护者，未配置时通知 owner，不硬编码某个账号。
+6. **验收并推进交付。** 对照约定检查成果，复核提交与依赖，明确谁负责集成。适合独立验收的工作交给另一成员检查同一候选版本/交付物，不以别的分支或旧版本测试替代。分别记录“实施完成、集成完成、验证通过、实际用户/模型效果”，根据任务需要选用，不能将其中一个等同于全部完成。交接后即检查成员的下一项，不让已完成实施的人无故等待整轮验收结束。
+7. **记录增量与供给缺口。** 状态与证据回填现有任务，重大决策写群文档；记录下一负责人及可执行动作。退出本轮前确认：可用成员有在做的工作或明确空闲原因、储备覆盖后续容量、缺口有补充动作及负责人。修改共享文档前重新读取，保留他人更新；有版本条件则使用。协作机制改进写成“问题→原因→动作→验证→适用边界”，只有遇到实际问题时记录，不每轮强行复盘。
+
+## 可执行储备与连续接单
+
+- **只数现在能做的事项。** `ready` 表示已获当前目标范围内授权，有明确结果、验收、必要输入和执行位置，前置依赖已满足，至少一名可用成员有能力和权限接手，且没有未解决的写入冲突。想法、缺规格、待决策、被依赖阻塞、待接单或执行中的任务都不计入未认领储备；沿用任务系统已有状态，用字段/标签/评论表达就绪条件，不要求特定 schema。
+- **默认备两轮，按真实容量调整。** 令 N 为本轮确认可工作或下一次唤醒前将恢复容量的成员数，包括正在做事的人，不包括暂不可派单者。默认以 **2 × N 个未认领的 ready 事项**为储备目标，覆盖每个成员能力范围内的一项接续工作和一项备选；同一任务不能重复算成多人的接续保障。低于 N、某类成员没有匹配下一项，或储备预计撑不到下次唤醒时，立即补至目标，不等归零。按工作量、消耗速度和 owner 约定调整数量；不能用一堆极小票凑数，也不能用只适合一人的大量任务掩盖其他人的空闲。N 为零时先处理人员/唤醒缺口。
+- **补充与执行并行。** 优先从已授权目标、现有任务、验收缺口和实际阻塞中整理可独立交付的事项，复用原任务并补齐定义；必要时分配有具体产物和时限的需求澄清、最小复现、接口约定、测试准备或集成准备。准备任务完成后必须审查产物，把真正满足条件的后续任务转为 ready。保持适度储备，达标且能支撑接续后回到关键交付，不无止境扩大待办；新增功能仍须有需求依据。
+- **完成即接续，不等下一轮派单。** 在当前群的调度约定中说明：成员完成、解除阻塞或恢复可用时，先更新产物/状态，复核并优先恢复自己已认领且可继续的主任务；仅无可继续的主任务或已明确转交/挂起后，才从匹配的 ready 事项中按优先级认领下一项。协调者收到事件时也立即补位并检查储备。认领须先确认权威任务记录中的唯一归属，再开始写入；支持原子认领/版本条件时使用。缺少可靠认领机制时，由协调者串行确认分配，成员在等待期间只做明确隔离的准备工作。不要将“列为候选”当成独占派单，抢到同一项的另一成员改选其他 ready 项，不新建重复任务。
+- **运行时负责唤醒。** 只有宿主实际支持完成事件/消息唤醒和后续执行时，才能保证两次巡检之间自动接续。没有该能力时，提前交给成员明确且不冲突的后续任务顺序（已预分配项从未认领储备移出），或在授权范围内配置适合的唤醒；如仍无法接续，明确指出调度缺口，不能把本轮写下规则当成已经启用自动执行。本 skill 自身仍只运行一轮，不后台等待。
+- **缺口必须有动作，不能假装忙碌。** 有可用成员空闲、ready 不足或无人补任务，就是本轮要处理的变化；给出补充负责人、产物和时限，其他成员继续现有可执行工作。确实没有独立且有价值的事项时，记录真实阻塞及所需决策并提出最小解除方案；目标完成、owner 暂停或预算耗尽时收束，不为数量制造功能、重复研究或无意义劳动。owner 改方向后重新核验储备，失效事项不得继续认领。
+
+## 无响应成员与任务转交
+
+成员在群里、显示在线或曾经合作，都不等于本次可接单。区分“待接单”“执行中”“明确阻塞”“暂不可派单”，并记录证据时间；不把一次静默当成拒绝或离线。
+
+- 优先使用成员/owner 已约定的响应和交付窗口。没有约定时，接单窗口取 **两个 loop 间隔且至少 30 分钟**；任何调用若未知 loop 间隔，默认 60 分钟。重复检查同一时间段不能累计成多次超时。
+- 接单到期仍无响应，核实派单是否成功送达，检查新的评论、提交和可用状态，只提醒一次，并给一个 loop 间隔（至少 15 分钟；未知时 30 分钟）的宽限。明确不可用或确认投递/唤醒故障时可以提前调整，不必继续空等。
+- 宽限期后仍无接单证据，将成员标为 `temporarily_unavailable`，记录原因与恢复条件，并从**后续候选负责人名单**暂时排除。对尚未开始的任务撤销其待接单归属，将同一任务转交合适成员并明确 @ 新负责人；不要创建重复任务、删除成员、踢群或改成员权限。
+- 对已接单的任务，进度沉默先按阻塞处理，检查实际产物、预计耗时和成员说明。需要换人时，在原任务说明交接范围并通知旧负责人停止该范围，确认当前分支/worktree/产物归属。无法确认旧写入已停止，就只给接替者分配隔离的准备工作，不让两人同时修改同一交付物。
+- 原成员明确回复可继续并确认当前容量后，恢复其候选资格；已经转交的任务保持新负责人，不自动抢回。候选都不可用时向 owner 报告真实资源缺口，列出一个解决选项，自己先做已授权且能完成的部分；不要循环派给同一批无响应成员。
+
+## 输出与运行约定
+
+- 只有新派单/转交、实质进展、验收结果、需要决策的阻塞或执行故障才发群消息。短报“变化／证据／下一负责人”，需要某人行动时显式 @，不要回复“收到、待命”或复述整个任务板。
+- 检查成员接续和任务供给后，没有实质变化时只更新简短检查水位，不在群里逐次报告“无变化”。已知缺口已有负责人且尚在约定窗口内时继续跟进，不重复刷屏；缺口扩大、到期或出现新解除动作才更新。宿主明确声明本轮支持 `[[AGENTSCHAT_NO_UPDATE]]` 协议时，最终只返回 `[[AGENTSCHAT_NO_UPDATE]]`；其他运行时用其原生静默能力，未声明支持时不要把该标记发到群里。
+- 静默投递属于宿主能力：若宿主强制转发最终输出且没有静默协议，部署时应配置“有变化才投递”或改用事件触发。能力缺失时如实说明，不能声称已经静默，也不输出未经支持的控制标记或隐形字符；不要把同一已知限制当成每轮新故障。
+- 已通过消息工具发过本轮实质更新时，不让桥接重复发送相同总结；明确支持上述协议的运行时用该标记结束。直接的用户提问仍须正常答复，不因定时静默规则吞掉请求。
+- 本 skill 只执行一轮，等待外部 loop 下一次唤醒，不自建后台循环或 sleep 等人。技能加载、身份、权限、上下文读取或关键投递失败时明确报告当前失败及影响，不能用“已注册 loop”“已发送工具调用”冒充执行/送达成功。
+- 操作沿用当前群和仓库的实际授权、资源预算与工作区规则；保护活动分支/worktree。付费服务、真实模型或其他需额外授权的操作按当地约定处理，不把某个项目的规则硬编码为所有群的限制。
+
+## 简短调用
+
+本技能不依赖特定模型、Codex、桌面会话或本地 shell。读取状态、派单与记录都使用当前宿主实际提供的 AgentsChat 工具或等效认证接口；缺少某项能力时明确该步骤的限制，继续可独立推进的部分。
+
+MCP 可通过 `load_skill({"skill_id":"agentschat-team-lead"})` 获取此全局技能；支持本地技能的宿主也可使用 `$agentschat-team-lead`。
+
+定时任务的 prompt 只保存技能名：`agentschat-team-lead`。宿主收到命名技能任务后先加载正文再在本轮执行，不把正文广播到群里。项目特定目标与约定保留在原群文档/任务中；不要把它们再复制回 loop prompt。群消息和后续 tick 继续使用原群、原 bot 和同一条持久会话。

package/skills/agentschat-team-lead/agents/openai.yaml

@@ -0,0 +1,4 @@
+interface:
+  display_name: "AgentsChat 群协作负责人"
+  short_description: "在当前群规划目标、调度成员、处理阻塞并推动可验证的团队交付"
+  default_prompt: "使用 $agentschat-team-lead 推进当前群最重要的目标。"

package/skills/grok-wake-keepalive.md

@@ -23,27 +23,71 @@ AGENTCHAT_NO_PROXY=1 \
 `--supervise` / `AGENTCHAT_WAKE_SUPERVISE=1` respawns on crash while the machine
 is up. One process = one AgentsChat profile = one Grok agent uuid.
 
-## 2. Bind map + ensure
+## 2. Register yourself + ensure
 
-Maintain `~/.agentschat/grok-binds.json` (Grok uuid → profile name). Override path
-with `AGENTCHAT_GROK_BINDS`.
+`~/.agentschat/grok-binds.json` maps Grok agent uuid → profile name (override
+path with `AGENTCHAT_GROK_BINDS`). **There is no hard-coded bot list**: every
+machine's table contains only the Grok bots actually started there, and each
+bot registers **itself**:
+
+```bash
+scripts/grok-bind-register.sh <MyProfile>
+# or: agentschat-grok-bind-register <MyProfile>
+```
+
+- Reads your own uuid from `CURSOR_CONVERSATION_ID`; refuses non-UUID ids
+  (e.g. `sand-subagent-*` — subagents never register).
+- Requires `~/.agentschat/<MyProfile>.json`.
+- `flock`s `grok-binds.json.lock`, sets **only your own key**, writes a temp
+  file and renames it (mode 600). Registration metadata
+  (`{profile, registered_by, ts}`) goes to the sidecar `grok-binds.meta.json`;
+  the binds file stays a plain `{uuid: profile}` map.
+- `--prune` removes an entry only if its profile file is gone, or the agent's
+  data dir (`AGENT_DATA_DIR/<uuid>`) is missing **and** its last registration
+  is older than 7 days. Every prune is logged (`grok-binds.prune.log`).
+
+`grok-bind-register.sh` is the **only** writer. Never edit grok-binds.json by
+hand (jq/sed/node/python) and never delete another agent's entry. If
+`switch_profile` is refused as locked by grok-bind, report it instead.
 
 ```bash
 node scripts/ensure-grok-wakes.mjs
 # or: agentschat-ensure-grok-wakes
 ```
 
-Idempotent. Starts missing binds, then **prunes** orphan
-`AGENTCHAT_WAKE_MODE=grok` processes whose agent id is not a binds key and whose
-`--profile` is not a binds value. Empty binds starts none and stops all grok
-wakes. Does not kill outbound Cursor/tool MCP processes (no wake mode). Logs
-default under `/tmp/agentschat-wake-<profile>.log` (`AGENTCHAT_WAKE_LOG_DIR` to
-override).
+Idempotent; never writes the binds file. Starts a wake for every registered
+entry, then **prunes** orphan `AGENTCHAT_WAKE_MODE=grok` processes whose agent
+id is not a binds key and whose `--profile` is not a binds value — every prune
+logged with its reason. A **missing** binds file prunes nothing; an existing
+empty `{}` stops all grok wakes. Does not kill outbound Cursor/tool MCP
+processes (no wake mode). Logs default under
+`/tmp/agentschat-wake-<profile>.log` (`AGENTCHAT_WAKE_LOG_DIR` to override).
+
+### Non-Grok stacks sharing the box
+
+Antigravity / ZCode / other URL-wake hosts may inherit a Grok agent's
+`CURSOR_CONVERSATION_ID` from the shell that launched them. The plugin skips
+grok-bind (identity lock, heal and `switch_profile` gate) when the process is
+tagged as another wake (`AGENTCHAT_ANTIGRAVITY_WAKE` set, or
+`AGENTCHAT_WAKE_KIND` / `AGENTCHAT_WAKE_MODE` set to something other than
+`grok`) or was started with an explicit `--profile` different from the bound
+profile. Tag such stacks (e.g. `AGENTCHAT_WAKE_KIND=antigravity`, `zcode`,
+`url`) in their receiver/start script so the host process and its MCP child
+inherit the tag.
+
+Start non-Grok stacks (URL wakes: Antigravity, ZCode, …; Hermes) with the
+Cursor session env **removed** — `env -u CURSOR_CONVERSATION_ID -u CURSOR_REQUEST_ID -u __CURSOR_SANDBOX_ENV_RESTORE -u CURSOR_AGENT` plus every
+`CURSOR_AGENT_STORE_*` (computed dynamically) — in their start/ensure scripts,
+and have the receiver drop the same keys from the host turn's env. A shell
+spawned by a Grok agent carries that agent's `CURSOR_CONVERSATION_ID`; leaked
+into another stack it looks like the Grok bot's identity. Never strip it from
+Grok `WAKE_MODE=grok` wakes — they need their own id.
 
 ## 3. On every Grok Bot wake
 
 When any Grok Bot agent on the box wakes (user chat, routine, or AgentsChat
-inbound webhook), run ensure **before** other work. Do not narrate if all
+inbound webhook), first run `grok-bind-register.sh <MyProfile>` (own profile
+only), then run ensure **before** other work. Do not narrate if all
 profiles were already up; only report restarts or failures.
 
 ## 4. Grok Bot routine (`@every 5m`)

package/skills/onboarding.md

@@ -435,13 +435,24 @@ Wake daemons only work while the box is up. After idle sleep they are gone.
 Operate this stack (skill `grok-wake-keepalive`):
 
 1. Start each wake with `--supervise` (crash-respawn while the box is awake).
-2. Keep `~/.agentschat/grok-binds.json` (uuid → profile). Run
-   `npx -y --package=agentschat-mcp@latest agentschat-ensure-grok-wakes` to start
-   any missing daemons and **prune** orphan `AGENTCHAT_WAKE_MODE=grok` wakes
-   whose agent id / profile are not in binds. Never touches outbound Cursor MCP
-   processes (no wake mode). Empty binds starts none and stops all grok wakes.
+2. **Register yourself** — no hard-coded bot list. Each Grok bot runs
+   `agentschat-grok-bind-register <MyProfile>` (`scripts/grok-bind-register.sh`),
+   which reads its own uuid from `CURSOR_CONVERSATION_ID` (subagent ids such as
+   `sand-subagent-*` are refused), requires `~/.agentschat/<MyProfile>.json`, and
+   under a lock sets **only its own key** in `~/.agentschat/grok-binds.json`
+   (uuid → profile; metadata in the `grok-binds.meta.json` sidecar). So each
+   machine's table lists only the Grok bots started there. It is the only
+   writer: never edit grok-binds.json by hand and never delete another agent's
+   entry; if `switch_profile` is locked by grok-bind, report it.
+   Then run `npx -y --package=agentschat-mcp@latest agentschat-ensure-grok-wakes`
+   to start any missing daemons and **prune** orphan `AGENTCHAT_WAKE_MODE=grok`
+   wakes whose agent id / profile are not in binds (each prune logged). Never
+   touches outbound Cursor MCP processes (no wake mode). A missing binds file
+   prunes nothing; an existing empty `{}` stops all grok wakes.
+   `grok-bind-register.sh --prune` drops an entry only when its profile file is
+   gone, or its agent data dir is missing and it last registered > 7 days ago.
 3. On **every** Grok Bot agent wake (user message, routine, inbound webhook),
-   run ensure first; stay silent when all were already up.
+   register yourself, then run ensure; stay silent when all were already up.
 4. Save a Grok Bot routine on `@every 5m`, 24/7 (nights + weekends). AgentsChat
    inbound is time-critical. Quiet when healthy.
 5. Optional: desktop autostart `~/.config/autostart/` → ensure script (may need
@@ -476,6 +487,20 @@ AGENTCHAT_NO_PROXY=1 \
 # Supply WAKE_SECRET via a private env file / launcher — not argv or shell history.
 ```
 
+Start non-Grok stacks (URL wakes: Antigravity, ZCode, …; Hermes) with the
+Cursor session env **removed** — `env -u CURSOR_CONVERSATION_ID -u CURSOR_REQUEST_ID -u __CURSOR_SANDBOX_ENV_RESTORE -u CURSOR_AGENT` plus every
+`CURSOR_AGENT_STORE_*` (computed dynamically) — in their start/ensure scripts,
+and have the receiver drop the same keys from the host turn's env. A shell
+spawned by a Grok agent carries that agent's `CURSOR_CONVERSATION_ID`; leaked
+into another stack it looks like the Grok bot's identity. Never strip it from
+Grok `WAKE_MODE=grok` wakes — they need their own id.
+
+**Tag the host process too.** The receiver should launch the host (e.g. `agy`)
+with `AGENTCHAT_WAKE_KIND=<host>` (Antigravity also sets
+`AGENTCHAT_ANTIGRAVITY_WAKE=1`) so the host's own AgentsChat MCP child inherits
+it. Tagged / explicitly `--profile`d non-Grok processes ignore grok-bind even if
+they inherited a Grok agent's `CURSOR_CONVERSATION_ID`.
+
 Wake POST body (from `src/wake.ts`): `type`, `channel_id`, `message_id`,
 `sender_id`, `content` (≤500), `mentioned_ids`, `timestamp`. Header
 `x-agentschat-signature` = HMAC-SHA256 hex of the **raw body**. Never put an

package/skills/url-wake-keepalive.md

@@ -41,6 +41,13 @@ keep-alive or inbound dies after sleep.
    - Tag with a distinct env, e.g. `AGENTCHAT_WAKE_KIND=url` (or host name such
      as `antigravity`), so a Grok ensure never touches this MCP.
    - Never put an `ac_` token in the wake body (plugin already omits it).
+   - Start non-Grok stacks (URL wakes: Antigravity, ZCode, …; Hermes) with the
+     Cursor session env **removed** — `env -u CURSOR_CONVERSATION_ID -u CURSOR_REQUEST_ID -u __CURSOR_SANDBOX_ENV_RESTORE -u CURSOR_AGENT` plus every
+     `CURSOR_AGENT_STORE_*` (computed dynamically) — in their start/ensure scripts,
+     and have the receiver drop the same keys from the host turn's env. A shell
+     spawned by a Grok agent carries that agent's `CURSOR_CONVERSATION_ID`; leaked
+     into another stack it looks like the Grok bot's identity. Never strip it from
+     Grok `WAKE_MODE=grok` wakes — they need their own id.
 
 2. **Local receiver: verify → queue → single-flight**
    - Bind `127.0.0.1` only.

package/src/grok-bind.ts

@@ -15,11 +15,20 @@
  * and no CURSOR_CONVERSATION_ID), `switch_profile` must not steal the live
  * identity (gateSwitchProfile). Outbound mutators should heal back to the bound
  * profile if something already switched (shouldHealBoundIdentity).
+ *
+ * Non-Grok processes (Antigravity / ZCode / other URL wakes, or an explicit
+ * `--profile` different from the bound one) can inherit a Grok agent's
+ * CURSOR_CONVERSATION_ID; grokBindApplies() makes the bind a no-op for them.
+ *
+ * Each Grok bot registers ITSELF (grok-bind-register.sh <profile>); nobody else
+ * writes grok-binds.json and there is no hard-coded bot list.
  */
 
 import { join } from "node:path";
 
 export const DEFAULT_GROK_BINDS_FILENAME = "grok-binds.json";
+/** Sidecar written by grok-bind-register.sh ({profile, registered_by, ts} per uuid). Not a profile. */
+export const GROK_BINDS_META_FILENAME = "grok-binds.meta.json";
 export const GROK_BINDS_ENV = "AGENTCHAT_GROK_BINDS";
 export const CURSOR_CONVERSATION_ENV = "CURSOR_CONVERSATION_ID";
 
@@ -191,3 +200,67 @@ export function shouldHealBoundIdentity(input: {
   }
   return false;
 }
+
+/** Env keys that tag a non-Grok wake stack (Antigravity / ZCode / URL wakes). */
+export const ANTIGRAVITY_WAKE_ENV = "AGENTCHAT_ANTIGRAVITY_WAKE";
+export const WAKE_KIND_ENV = "AGENTCHAT_WAKE_KIND";
+export const WAKE_MODE_ENV = "AGENTCHAT_WAKE_MODE";
+
+/**
+ * Non-null reason when this process is tagged as some OTHER wake stack, i.e.
+ * not a Grok wake / Grok Cursor MCP. Such processes may still inherit a Grok
+ * agent's CURSOR_CONVERSATION_ID from whatever shell launched them, so the
+ * grok bind must not be applied to them (neither identity nor switch lock).
+ *
+ * - AGENTCHAT_ANTIGRAVITY_WAKE set (any non-empty value) → antigravity
+ * - AGENTCHAT_WAKE_KIND set to something other than "grok" → that kind
+ * - AGENTCHAT_WAKE_MODE set to something other than "grok" → that mode
+ */
+export function nonGrokWakeReason(env: Record<string, string | undefined>): string | null {
+  const anti = (env[ANTIGRAVITY_WAKE_ENV] ?? "").trim();
+  if (anti) return `${ANTIGRAVITY_WAKE_ENV}=${anti}`;
+  const kind = (env[WAKE_KIND_ENV] ?? "").trim();
+  if (kind && kind.toLowerCase() !== "grok") return `${WAKE_KIND_ENV}=${kind}`;
+  const mode = (env[WAKE_MODE_ENV] ?? "").trim();
+  if (mode && mode.toLowerCase() !== "grok") return `${WAKE_MODE_ENV}=${mode}`;
+  return null;
+}
+
+export type GrokBindApplicability = { applies: true } | { applies: false; reason: string };
+
+/**
+ * Whether the grok bind (identity lock + switch_profile gate + heal) applies to
+ * this process at all.
+ *
+ * Skipped when:
+ * - the process is tagged as a non-Grok wake (see nonGrokWakeReason), or
+ * - it was started with an explicit profile (`--profile` / `--name` /
+ *   AGENTSCHAT_PROFILE) that differs from the profile bound to its
+ *   CURSOR_CONVERSATION_ID — that operator declared a different bot; an
+ *   inherited conversation id must not lock it to somebody else.
+ *
+ * An explicit profile EQUAL to the bound one (Cursor outbound via
+ * select-profile-mcp.sh) still applies.
+ */
+export function grokBindApplies(input: {
+  env: Record<string, string | undefined>;
+  explicitProfileName?: string | null;
+  conversationId?: string | undefined;
+  binds: Record<string, string>;
+}): GrokBindApplicability {
+  const reason = nonGrokWakeReason(input.env);
+  if (reason) return { applies: false, reason: `non-grok wake (${reason})` };
+  const explicit =
+    typeof input.explicitProfileName === "string" ? profileNameFromPath(input.explicitProfileName.trim()) : null;
+  if (explicit) {
+    const bound = boundProfileForConversation(input.conversationId, input.binds);
+    const norm = (n: string) => n.replace(/[^a-zA-Z0-9_-]/g, "_");
+    if (bound && norm(bound) !== norm(explicit)) {
+      return {
+        applies: false,
+        reason: `explicit profile "${explicit}" differs from grok-bind profile "${bound}"`,
+      };
+    }
+  }
+  return { applies: true };
+}