greprag 5.74.21 → 5.76.0

package/dist/commands/inbox-watch.js

@@ -50,14 +50,17 @@ var __importStar = (this && this.__importStar) || (function () {
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.CONSUMER_GONE_EXIT_CODE = void 0;
+exports.resolveWatchPlatform = resolveWatchPlatform;
 exports.getConfig = getConfig;
 exports.fmtDuration = fmtDuration;
 exports.parseEventBlock = parseEventBlock;
 exports.withTruncatedSessions = withTruncatedSessions;
+exports.isWatchQuiet = isWatchQuiet;
 exports.runInboxWatch = runInboxWatch;
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
 const session_id_1 = require("../session-id");
+const harness_1 = require("../harness");
 const mechanic_friction_1 = require("../mechanic-friction");
 const inbox_watch_supervisor_1 = require("./inbox-watch-supervisor");
 const API_URL_DEFAULT = 'https://api.greprag.com';
@@ -83,6 +86,14 @@ exports.CONSUMER_GONE_EXIT_CODE = 65;
 // than waiting for the next real message that may never come. Env-overridable
 // for tests (the idle path otherwise takes the full 30s to observe).
 const CONSUMER_PROBE_MS = Number(process.env.GREPRAG_WATCH_PROBE_MS) || 30_000;
+const WATCH_PLATFORMS = new Set(['claude-code', 'codex', 'opencode', 'grok']);
+/** Platform tag for this watch attach. Explicit opt wins; else infer. */
+function resolveWatchPlatform(explicit) {
+    if (explicit && WATCH_PLATFORMS.has(explicit))
+        return explicit;
+    const h = (0, harness_1.inferCurrentHarness)();
+    return (h && WATCH_PLATFORMS.has(h)) ? h : undefined;
+}
 // -- Config (mirrors the loader in index.ts/discover.ts) -------------------
 function loadEnvFile(filePath) {
     try {
@@ -166,9 +177,9 @@ function parseEventBlock(block) {
         return null;
     return { event, id, data: dataLines.join('\n') };
 }
-/** Truncate every session_id field on a StreamMessage to its 8-hex form.
- *  Used for both the JSON --json line and the pretty-printed display.
- *  Exported for tests. adr: adr/session-id-awareness.md */
+/** Truncate every session_id field on a StreamMessage to its short form
+ *  (8-hex, or 16-hex for UUIDv7). Used for both the JSON --json line and
+ *  the pretty-printed display. Exported for tests. adr: adr/session-id-awareness.md */
 function withTruncatedSessions(msg) {
     const fromShort = (0, session_id_1.truncateSessionId)(msg.from.session_id ?? null);
     const toShort = (0, session_id_1.truncateSessionId)(msg.to_session_id ?? null);
@@ -347,6 +358,9 @@ async function readStream(url, apiKey, signal, initialId, json, idleTimeoutMs, s
                         catch {
                             continue;
                         }
+                        if (session && msg.to_session_id && !(0, session_id_1.sameSessionId)(session, msg.to_session_id)) {
+                            continue;
+                        }
                         const displayMsg = withTruncatedSessions(msg);
                         emitDmReplyDirective(displayMsg, session);
                         if (json)
@@ -362,14 +376,14 @@ async function readStream(url, apiKey, signal, initialId, json, idleTimeoutMs, s
                             const data = JSON.parse(ev.data || '{}');
                             if (typeof data.count === 'number' && data.count > 0) {
                                 const plural = data.count === 1 ? '' : 's';
-                                console.error(`${LOG_PREFIX} replayed ${data.count} missed row${plural}, resuming live tail`);
+                                watchErr(`${LOG_PREFIX} replayed ${data.count} missed row${plural}, resuming live tail`);
                             }
                         }
                         catch { /* malformed control payload — ignore */ }
                     }
                     else if (ev.event === 'error') {
                         // Surface server-side error then let the loop reconnect.
-                        console.error(`${LOG_PREFIX} server error: ${ev.data}`);
+                        watchErr(`${LOG_PREFIX} server error: ${ev.data}`);
                         return lastId;
                     }
                     // "open" event is informational — ignored at print time.
@@ -388,7 +402,7 @@ async function readStream(url, apiKey, signal, initialId, json, idleTimeoutMs, s
         signal.removeEventListener('abort', onOuterAbort);
     }
 }
-function buildUrl(apiUrl, project, session, since, receptionist, assistant, mechanic) {
+function buildUrl(apiUrl, project, session, since, receptionist, assistant, mechanic, platform) {
     const u = new URL(apiUrl.replace(/\/+$/, '') + '/v1/inbox/stream');
     if (project)
         u.searchParams.set('project', project);
@@ -402,6 +416,8 @@ function buildUrl(apiUrl, project, session, since, receptionist, assistant, mech
         u.searchParams.set('role', 'mechanic');
     else if (assistant)
         u.searchParams.set('role', 'assistant');
+    if (platform)
+        u.searchParams.set('platform', platform);
     return u.toString();
 }
 /** Public entry for `greprag inbox watch`. Dispatches by mode:
@@ -423,13 +439,30 @@ function buildUrl(apiUrl, project, session, since, receptionist, assistant, mech
  *  carries its stdout into chat is destroyed on reload, by design). See
  *  adr/monitor-resilience.md (2026-06-02 + 2026-06-03 entries).
  *  adr: adr/monitor-resilience.md */
+function isWatchQuiet(opts) {
+    if (opts?.quiet)
+        return true;
+    if (process.env.GREPRAG_WATCH_QUIET === '1')
+        return true;
+    if (process.env.GROK_SESSION_ID)
+        return true;
+    return process.argv.includes('--quiet');
+}
+function watchErr(msg, opts) {
+    if (isWatchQuiet(opts))
+        return;
+    console.error(msg);
+}
 async function runInboxWatch(opts) {
+    const quiet = isWatchQuiet(opts);
+    if (quiet)
+        process.env.GREPRAG_WATCH_QUIET = '1';
     const directMode = !!opts.signal || !!opts.noSupervise;
     if (directMode)
-        return runWatchLoop(opts);
+        return runWatchLoop({ ...opts, quiet });
     if (process.env[inbox_watch_supervisor_1.SUPERVISE_ENV] === '1') {
         (0, inbox_watch_supervisor_1.installLastResortHandlers)();
-        return runWatchLoop(opts);
+        return runWatchLoop({ ...opts, quiet });
     }
     return (0, inbox_watch_supervisor_1.runSupervisor)();
 }
@@ -446,7 +479,7 @@ async function runInboxWatch(opts) {
  *  the deleted `while true` wrapper's job, done right: the watcher notices its
  *  own consumer is gone instead of an external shell keeping it alive forever.
  *  adr: adr/monitor-resilience.md */
-function bindToConsumer(onGone) {
+function bindToConsumer(onGone, quiet = false) {
     let gone = false;
     const trip = () => {
         if (gone)
@@ -457,26 +490,29 @@ function bindToConsumer(onGone) {
     const onErr = () => trip();
     process.stdout.on('error', onErr);
     process.stderr.on('error', onErr);
-    // A single NUL byte on stderr — the diagnostic channel, never surfaced as a
-    // Monitor notification (those key on stdout JSON lines), and invisible in
-    // logs. The write itself IS the probe: its callback fires with an error (and
-    // the stream emits 'error') when the read end has closed, i.e. the consumer is
-    // gone. Harmless while the pipe is alive.
-    const probe = setInterval(() => {
-        try {
-            process.stderr.write(String.fromCharCode(0), (err) => { if (err)
-                trip(); });
-        }
-        catch {
-            trip();
-        }
-    }, CONSUMER_PROBE_MS);
-    if (typeof probe.unref === 'function')
-        probe.unref();
+    // Claude Monitor keys notifications on stdout JSON; a NUL on stderr is
+    // invisible there. Grok monitor merges stderr into wake events, so the
+    // probe would ping the model every 30s and trip Grok's volume killer.
+    // adr: adr/grok-platform.md
+    let probe = null;
+    if (!quiet) {
+        probe = setInterval(() => {
+            try {
+                process.stderr.write(String.fromCharCode(0), (err) => { if (err)
+                    trip(); });
+            }
+            catch {
+                trip();
+            }
+        }, CONSUMER_PROBE_MS);
+        if (typeof probe.unref === 'function')
+            probe.unref();
+    }
     return {
         gone: () => gone,
         dispose: () => {
-            clearInterval(probe);
+            if (probe)
+                clearInterval(probe);
             process.stdout.removeListener('error', onErr);
             process.stderr.removeListener('error', onErr);
         },
@@ -514,14 +550,14 @@ async function runWatchLoop(opts) {
     // the consuming session is gone — abort and exit terminal so we don't orphan.
     // Skip in SDK/test mode (opts.signal present): those callers own the process
     // and their pipes aren't a Monitor consumer.
-    const consumer = opts.signal ? null : bindToConsumer(() => controller.abort());
+    const consumer = opts.signal ? null : bindToConsumer(() => controller.abort(), isWatchQuiet(opts));
     while (!controller.signal.aborted) {
         if (!isFirstAttempt) {
             const lastSeen = cursor ? cursor.slice(0, 8) : 'none';
-            console.error(`${LOG_PREFIX} reconnecting (last_seen_id=${lastSeen})`);
+            watchErr(`${LOG_PREFIX} reconnecting (last_seen_id=${lastSeen})`, opts);
         }
         isFirstAttempt = false;
-        const url = buildUrl(cfg.apiUrl, opts.project, opts.session, cursor, !!opts.receptionist, !!opts.assistant, !!opts.mechanic);
+        const url = buildUrl(cfg.apiUrl, opts.project, opts.session, cursor, !!opts.receptionist, !!opts.assistant, !!opts.mechanic, resolveWatchPlatform(opts.platform));
         try {
             const lastId = await readStream(url, cfg.apiKey, controller.signal, cursor, !!opts.json, idleTimeoutMs, opts.session);
             if (lastId)
@@ -543,11 +579,11 @@ async function runWatchLoop(opts) {
             // (no supervisor) still sees a non-zero exit.
             const m = /^HTTP (4\d\d)/.exec(msg);
             if (m) {
-                console.error(`${LOG_PREFIX} ${msg}`);
+                watchErr(`${LOG_PREFIX} ${msg}`, opts);
                 process.exit(inbox_watch_supervisor_1.FATAL_EXIT_CODE);
             }
             const lastSeen = cursor ? cursor.slice(0, 8) : 'none';
-            console.error(`${LOG_PREFIX} disconnect: ${msg} — retrying in ${fmtDuration(backoff)} (last_seen_id=${lastSeen})`);
+            watchErr(`${LOG_PREFIX} disconnect: ${msg} — retrying in ${fmtDuration(backoff)} (last_seen_id=${lastSeen})`, opts);
         }
         if (controller.signal.aborted)
             break;

package/dist/commands/init.js

@@ -40,6 +40,7 @@ var __importStar = (this && this.__importStar) || (function () {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.GREPRAG_SECTIONS = void 0;
 exports.runInit = runInit;
+exports.applyGrokHooks = applyGrokHooks;
 exports.applyCodexHooks = applyCodexHooks;
 exports.applySettings = applySettings;
 exports.patchClaudeMdContent = patchClaudeMdContent;
@@ -140,6 +141,13 @@ function detectAgentTargets(cwd = process.cwd()) {
         opencodeEvidence.push('~/.config/opencode exists');
     if (opencodeEvidence.length > 0)
         detections.push({ target: 'opencode', evidence: opencodeEvidence });
+    const grokEvidence = [];
+    if (process.env.GROK_SESSION_ID || process.env.GROK_HOOK_EVENT)
+        grokEvidence.push('GROK_* environment is set');
+    if (home && fs.existsSync(path.join(home, '.grok')))
+        grokEvidence.push('~/.grok exists');
+    if (grokEvidence.length > 0)
+        detections.push({ target: 'grok', evidence: grokEvidence });
     return detections;
 }
 function describeTarget(target) {
@@ -147,6 +155,8 @@ function describeTarget(target) {
         return 'Claude Code';
     if (target === 'codex')
         return 'Codex';
+    if (target === 'grok')
+        return 'Grok Build';
     return 'OpenCode';
 }
 function explicitInitHint() {
@@ -155,6 +165,7 @@ function explicitInitHint() {
         '  greprag init --codex --tenant-id <your-handle>',
         '  greprag init --claude --tenant-id <your-handle>',
         '  greprag init --opencode --tenant-id <your-handle>',
+        '  greprag init --grok --tenant-id <your-handle>',
     ].join('\n');
 }
 function normalizeHandle(raw) {
@@ -220,13 +231,16 @@ async function chooseInitTarget() {
     console.log('    1. Codex');
     console.log('    2. Claude Code');
     console.log('    3. OpenCode');
-    const answer = (await prompt('  Choose 1, 2, or 3: ')).trim().toLowerCase();
+    console.log('    4. Grok Build');
+    const answer = (await prompt('  Choose 1, 2, 3, or 4: ')).trim().toLowerCase();
     if (answer === '1' || answer === 'codex')
         return 'codex';
     if (answer === '2' || answer === 'claude' || answer === 'claude code')
         return 'claude';
     if (answer === '3' || answer === 'opencode' || answer === 'open code')
         return 'opencode';
+    if (answer === '4' || answer === 'grok' || answer === 'grok build')
+        return 'grok';
     console.error('  Error: no agent target selected.');
     console.error(explicitInitHint());
     process.exit(1);
@@ -247,9 +261,9 @@ async function runInit(opts) {
     if (opts.global) {
         return runGlobalInit(opts.name);
     }
-    const explicitTargets = [opts.claude, opts.codex, opts.opencode].filter(Boolean).length;
+    const explicitTargets = [opts.claude, opts.codex, opts.opencode, opts.grok].filter(Boolean).length;
     if (explicitTargets > 1) {
-        console.error('  Error: choose only one target: --claude, --codex, or --opencode.');
+        console.error('  Error: choose only one target: --claude, --codex, --opencode, or --grok.');
         process.exit(1);
     }
     // --opencode: configure for OpenCode instead of Claude Code.
@@ -260,12 +274,17 @@ async function runInit(opts) {
     if (opts.codex) {
         return runCodexInit(opts);
     }
+    if (opts.grok) {
+        return runGrokInit(opts);
+    }
     if (!opts.claude) {
         const target = await chooseInitTarget();
         if (target === 'codex')
             return runCodexInit(opts);
         if (target === 'opencode')
             return runOpenCodeInit(opts);
+        if (target === 'grok')
+            return runGrokInit(opts);
     }
     console.log('\n  greprag init — Setting up agent memory for Claude Code\n');
     // Step 1: Get API key
@@ -640,6 +659,156 @@ async function runCodexInit(opts) {
     console.log('  Inbox messages for Codex surface on SessionStart and UserPromptSubmit hook boundaries.');
     console.log('  Hooks will activate after the Codex host restart; starting only a new task is not sufficient after hook changes.\n');
 }
+const GROK_RULES = `# GrepRAG on Grok Build
+
+Before other work this session:
+1. If \`~/.greprag/grok-context/<16-hex>.md\` exists, Read it. Else run \`greprag memory recap\`.
+2. Session id is \`$GROK_SESSION_ID\` (UUIDv7). Short form is **16 hex**, not 8. 8-hex collides for ~65s. Send with \`--from-session $GROK_SESSION_ID\` (full UUID).
+3. Idle wake: Grok \`monitor\` persistent:true, command:
+   \`greprag inbox watch --session $GROK_SESSION_ID --json --quiet\`
+   Not Claude Monitor. No bash while-true. \`--quiet\` required (stderr is a wake).
+   If a greprag inbox monitor is already listed in this session, do not start another. Instant exit = already armed, not a crash.
+4. Chip: \`greprag load grok-chip-spawn\` then \`greprag grok spawn\` (real TUI + inbox). Helper: \`spawn_subagent\` background=true. Child arms its own quiet watch with ITS \`$GROK_SESSION_ID\`. Parent sends:
+   \`greprag send "…" --to travis@greprag.com/<child-full-uuid> --from-session $GROK_SESSION_ID\`
+   Parent keeps ONE watch, for itself. Child watch events may appear on the parent TUI — resume the child to act. Do not arm a second parent watch.
+5. Tool shell: stdin redirected + \`-NonInteractive\`. \`Read-Host\` throws. \`Start-Process\` windows die with the tool Job Object. Secret paste: \`~/.claude/scripts/prompt-secret.ps1\`. Sticky console: \`schtasks /Create … /IT\` then \`schtasks /Run\`. npm Hello: \`npm login --auth-type=web\` in that window; browser Use security key; page token ≠ Hello PIN.
+`;
+function getGrokHooksPath() {
+    const home = process.env.HOME || process.env.USERPROFILE || os.homedir();
+    return path.join(home, '.grok', 'hooks', 'greprag.json');
+}
+function getGrokRulesPath() {
+    const home = process.env.HOME || process.env.USERPROFILE || os.homedir();
+    return path.join(home, '.grok', 'rules', 'greprag.md');
+}
+function grokCommand(sub, timeout) {
+    const script = path.resolve(__dirname, '..', 'hook.js');
+    const command = fs.existsSync(script)
+        ? `node ${shellQuote(script)} ${sub}`
+        : (process.platform === 'win32' ? `greprag-hook.cmd ${sub}` : `greprag-hook ${sub}`);
+    return { type: 'command', command, timeout };
+}
+function applyGrokHooks(config) {
+    const changes = [];
+    if (!config.hooks)
+        config.hooks = {};
+    // Empty matcher = every SessionStart source (startup, resume, /new, dashboard
+    // dispatch, fork). `startup|resume` missed /new and dashboard agents, so this
+    // session never got a recap sidecar. adr: adr/grok-platform.md
+    const sessionStartMatcher = '';
+    if (!config.hooks.SessionStart)
+        config.hooks.SessionStart = [];
+    const retargeted = ['recap', 'session-id', 'drain'].reduce((n, sub) => (n + retargetGrepragHookMatcher(config.hooks.SessionStart, sub, ['startup|resume'], sessionStartMatcher)), 0);
+    if (retargeted)
+        changes.push(`Retargeted Grok SessionStart matcher (${retargeted})`);
+    const add = (event, matcher, sub, timeout, label) => {
+        if (hasGrepragHook(config.hooks[event], sub)) {
+            changes.push(`Grok ${event} ${label} already configured (skipped)`);
+            return;
+        }
+        if (!config.hooks[event])
+            config.hooks[event] = [];
+        config.hooks[event].push({ matcher, hooks: [grokCommand(sub, timeout)] });
+        changes.push(`Added Grok ${event} hook (${label})`);
+    };
+    add('SessionStart', sessionStartMatcher, 'recap', 15, 'memory recap');
+    add('SessionStart', sessionStartMatcher, 'session-id', 5, 'session-id');
+    add('SessionStart', sessionStartMatcher, 'drain', 8, 'inbox drain');
+    add('UserPromptSubmit', '', 'notify', 8, 'prompt cache');
+    add('PreToolUse', 'Bash|run_terminal_command', 'crush-wrap', 5, 'crush-wrap');
+    add('PreToolUse', '*', 'guard', 5, 'guard');
+    add('Stop', '', 'store', 15, 'turn capture');
+    add('Stop', '', 'drain', 8, 'inbox drain');
+    add('PostCompact', '', 'session-id', 5, 'session-id');
+    return changes;
+}
+function writeGrokRules() {
+    const file = getGrokRulesPath();
+    fs.mkdirSync(path.dirname(file), { recursive: true });
+    if (fs.existsSync(file) && fs.readFileSync(file, 'utf-8') === GROK_RULES) {
+        return 'Grok rules already current';
+    }
+    fs.writeFileSync(file, GROK_RULES);
+    return `Wrote ${file}`;
+}
+/** greprag init --grok
+ *  Dedicated Grok Build adapter. Does not ride ~/.claude/settings.json.
+ *  adr: adr/grok-platform.md */
+async function runGrokInit(opts) {
+    console.log('\n  greprag init — Setting up agent memory for Grok Build\n');
+    let apiKey = opts.apiKey || readSharedApiKey();
+    if (!apiKey) {
+        const tenantId = await resolveProvisionHandle(opts);
+        console.log(`  Provisioning API key for public handle ${tenantId}@greprag.com...`);
+        const result = await provision(tenantId);
+        if (!result.ok) {
+            console.error(`  Error: ${result.error}`);
+            process.exit(1);
+        }
+        apiKey = result.apiKey;
+        console.log(`  API key created: ${apiKey.slice(0, 17)}...`);
+    }
+    console.log('  Validating API key...');
+    const valid = await validateKey(apiKey);
+    if (!valid) {
+        console.error('  Error: API key validation failed.');
+        process.exit(1);
+    }
+    console.log('  Key validated against api.greprag.com');
+    const changes = [];
+    writeGrepragEnv(apiKey);
+    changes.push('Wrote ~/.greprag/.env for Grok hooks');
+    await cacheIdentity(apiKey);
+    const anchor = (0, project_anchor_1.ensureAnchor)(process.cwd());
+    if (anchor.source === 'git') {
+        changes.push(`Project anchor: ${anchor.projectName} (${anchor.projectId.slice(0, 8)}) — derived from git history`);
+    }
+    else {
+        changes.push(`Project anchor: ${anchor.projectName} (${anchor.projectId.slice(0, 8)}) — stored in .greprag/project.json`);
+        const gitignoreResult = ensureAnchorTrackable(process.cwd());
+        if (gitignoreResult)
+            changes.push(gitignoreResult);
+    }
+    const globalAnchor = (0, project_anchor_1.ensureGlobalAnchor)();
+    changes.push(`Global anchor: ${globalAnchor.projectName} (${globalAnchor.projectId.slice(0, 8)})`);
+    writeProjectPath(anchor.projectName, process.cwd());
+    changes.push(`Registered repo path for ${anchor.projectName} → ~/.greprag/projects.json`);
+    const grokSkill = installCoreSkill('grok');
+    if (grokSkill)
+        changes.push(`Skill: installed → ${grokSkill}`);
+    changes.push(writeGrokRules());
+    try {
+        const res = await fetch(`${API_URL}/v1/inbox/projects/register`, {
+            method: 'POST',
+            headers: {
+                'Authorization': `Bearer ${apiKey}`,
+                'Content-Type': 'application/json',
+            },
+            body: JSON.stringify({ project_id: anchor.projectId, project_name: anchor.projectName }),
+        });
+        const reg = await res.json();
+        changes.push(reg.ok ? 'Project registered for inbox addressing' : `Inbox registration: ${reg.error || 'failed'}`);
+    }
+    catch {
+        changes.push('Inbox registration skipped (network)');
+    }
+    const hooksPath = getGrokHooksPath();
+    const hooks = readCodexHooks(hooksPath);
+    const hookChanges = applyGrokHooks(hooks);
+    writeCodexHooks(hooksPath, hooks);
+    changes.push(...hookChanges);
+    console.log('\n  Setup complete!\n');
+    for (const change of changes) {
+        console.log(`    - ${change}`);
+    }
+    console.log(`\n  Grok hooks file: ${hooksPath}`);
+    console.log(`  Grok rules:      ${getGrokRulesPath()}`);
+    console.log(`  Project anchor:  ${anchor.anchorPath}`);
+    console.log('  Reload hooks in Grok (/hooks then r) or start a fresh session.');
+    console.log('  Recap lands in ~/.greprag/grok-context/<16-hex>.md — Grok ignores SessionStart stdout.');
+    console.log('  Idle inbox: Grok monitor + `greprag inbox watch --session $GROK_SESSION_ID --json --quiet`.');
+    console.log('  Second session: `greprag grok spawn` (TUI) or spawn_subagent; child arms its own watch; parent keeps one.\n');
+}
 /** greprag init --global
  *  Creates ~/.greprag/project.json with a stable UUID.
  *  Designed for Cowork / any agent session whose cwd has no repo-level anchor.
@@ -979,7 +1148,7 @@ function getSkillRoot() {
     return path.join(__dirname, '../../skill');
 }
 function skillTargetRoot(target) {
-    const dir = target === 'codex' ? '.codex' : '.claude';
+    const dir = target === 'codex' ? '.codex' : target === 'grok' ? '.grok' : '.claude';
     return path.join(os.homedir(), dir, 'skills');
 }
 function installCoreSkill(target) {

package/dist/commands/load-primer-reminder.js

@@ -19,7 +19,7 @@
  *  load-primer` / `chip-spawn-pointer`). Announce-only: detect → silent,
  *  reminder → null. adr: docs/load-system.md, docs/reminder-interrupt.md */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.codexChipSpawnPointerModule = exports.chipSpawnPointerModule = exports.loadPrimerModule = exports.CODEX_CHIP_SPAWN_POINTER = exports.OPENCODE_CHIP_SPAWN_POINTER = exports.CHIP_SPAWN_POINTER = exports.LOAD_PRIMER = void 0;
+exports.codexChipSpawnPointerModule = exports.chipSpawnPointerModule = exports.loadPrimerModule = exports.CODEX_CHIP_SPAWN_POINTER = exports.GROK_CHIP_SPAWN_POINTER = exports.OPENCODE_CHIP_SPAWN_POINTER = exports.CHIP_SPAWN_POINTER = exports.LOAD_PRIMER = void 0;
 /** PRIMER — teaches the loader itself. Resident (fires every SessionStart +
  *  re-teaches after compaction). Terse: it is in context every session. */
 exports.LOAD_PRIMER = [
@@ -43,6 +43,11 @@ exports.OPENCODE_CHIP_SPAWN_POINTER = [
     '[greprag chips — agent coordination is built in (messaging plumbing in the inbox primer).]',
     '• Delegating a component of a plan to an isolated chip session, or `greprag fix spawn` just printed a FIX-chip mission? → run `greprag load chip-bootloader` FIRST for the method: OpenCode chips spawn natively via `greprag opencode chip goal create` + `greprag opencode chip spawn` (HTTP child session; manual paste only when the API is down). ≥2 chips at one objective → `greprag load chip-leader-opencode` BEFORE the first spawn.',
 ].join('\n');
+/** POINTER — Grok Build TUI chip. Real window + inbox mesh, not spawn_subagent. */
+exports.GROK_CHIP_SPAWN_POINTER = [
+    '[greprag chips — agent coordination is built in (messaging plumbing in the inbox primer).]',
+    '• About to spawn a chip? → run `greprag load grok-chip-spawn` FIRST. Vehicle is `greprag grok spawn` (cmd /k TUI bootloader). Child arms its own quiet inbox watch; parent keeps one and talks via `greprag send`. `spawn_subagent` is a helper, not a chip. ≥2 chips at one objective → `greprag load chip-leader` BEFORE the first spawn.',
+].join('\n');
 /** POINTER — Codex Desktop's native chip path. This is intentionally distinct
  *  from Claude Code spawn_task: different lifecycle, runtime, and handoff. */
 exports.CODEX_CHIP_SPAWN_POINTER = [
@@ -70,6 +75,8 @@ exports.chipSpawnPointerModule = {
             return null;
         if (env.platform === 'opencode')
             return exports.OPENCODE_CHIP_SPAWN_POINTER;
+        if (env.platform === 'grok')
+            return exports.GROK_CHIP_SPAWN_POINTER;
         return exports.CHIP_SPAWN_POINTER;
     },
     reminder: () => null,

package/dist/commands/load.js

@@ -73,6 +73,10 @@ const LIBRARY = {
         files: ['skill/templates/codex-chip-spawn.md'],
         purpose: 'Spawn an independent writable native Codex Desktop task with an isolated worktree and native completion/cleanup.',
     },
+    'grok-chip-spawn': {
+        files: ['skill/templates/grok-chip-spawn.md'],
+        purpose: 'Spawn a Grok TUI chip (cmd /k bootloader + isolated worktree). Child arms its own inbox watch; parent talks via greprag send. Not spawn_subagent.',
+    },
     'skill-change': {
         files: ['skill/templates/skill-change.md'],
         purpose: 'Internal bundled schema for safely updating a skill after a run: when to edit, Convention A/B shapes, and when to propose instead.',

package/dist/commands/os-primer-reminder.js

@@ -20,7 +20,8 @@ function buildOsPrimer(env) {
     // vehicle is the chip-bootloader entry: native `greprag opencode chip` spawn).
     const spawnEntry = env?.platform === 'codex' ? 'codex-chip-spawn'
         : env?.platform === 'opencode' ? 'chip-bootloader'
-            : 'chip-spawn';
+            : env?.platform === 'grok' ? 'grok-chip-spawn'
+                : 'chip-spawn';
     return [
         '[grepragOS — the operating laws. Full doctrine: `greprag load os`.]',
         '• Doctrine vs state: methods ship in the CLI (`greprag load`); live state lives in the repo. A skill that depends on repo state carries a "STATE — read these first" block naming exact paths.',

package/dist/commands/pipe-wrap.js

@@ -68,6 +68,7 @@ exports.readPipeWrapConfig = readPipeWrapConfig;
 exports.runPipeWrap = runPipeWrap;
 const fs = __importStar(require("fs"));
 const project_anchor_1 = require("../project-anchor");
+const hook_runtime_1 = require("../hook-runtime");
 // ---------- Structural safety gates (pure) ----------------------------------
 /** True when single/double quotes balance with bash-style escaping
  *  (backslash escapes inside double quotes and bare text; not inside
@@ -282,11 +283,11 @@ function readPipeWrapConfig(cwd) {
         enabled = false;
     return { enabled };
 }
-/** PreToolUse[Bash] — returns the updatedInput envelope when the command
- *  qualifies for wrapping, null for silence. NO permissionDecision: the
- *  rewritten command still goes through the normal permission flow. */
+/** PreToolUse[Bash / run_terminal_command] — returns the updatedInput envelope
+ *  when the command qualifies for wrapping, null for silence. NO permissionDecision:
+ *  the rewritten command still goes through the normal permission flow. */
 function runPipeWrap(input) {
-    if (input.tool_name !== 'Bash')
+    if (!(0, hook_runtime_1.isShellTool)(input.tool_name))
         return null;
     const command = input.tool_input?.command;
     if (typeof command !== 'string' || !command.trim())
@@ -317,7 +318,7 @@ function runPipeWrap(input) {
     return {
         hookSpecificOutput: {
             hookEventName: 'PreToolUse',
-            updatedInput: { command: rewriteCommand(target, decision) },
+            updatedInput: { ...(input.tool_input || {}), command: rewriteCommand(target, decision) },
         },
     };
 }

package/dist/commands/search-guard.js

@@ -3,6 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.hazardousRgTargets = hazardousRgTargets;
 exports.buildSearchGuardReason = buildSearchGuardReason;
 exports.runSearchGuard = runSearchGuard;
+const hook_runtime_1 = require("../hook-runtime");
 const HAZARDOUS_DIRS = new Set([
     '.next',
     '.turbo',
@@ -151,7 +152,7 @@ function buildSearchGuardReason(targets) {
     ].join(' ');
 }
 function runSearchGuard(input) {
-    if (input.tool_name !== 'Bash')
+    if (!(0, hook_runtime_1.isShellTool)(input.tool_name))
         return null;
     const command = input.tool_input?.command;
     if (typeof command !== 'string' || !command.trim())

package/dist/commands/status.js

@@ -146,6 +146,9 @@ function readVersion() {
         return 'unknown';
     }
 }
+function grokHooksPath() {
+    return path.join(home(), '.grok', 'hooks', 'greprag.json');
+}
 function platformFromArgs(args) {
     if (args.includes('--claude'))
         return 'claude';
@@ -153,6 +156,8 @@ function platformFromArgs(args) {
         return 'codex';
     if (args.includes('--opencode'))
         return 'opencode';
+    if (args.includes('--grok'))
+        return 'grok';
     if (args.includes('--all-platforms'))
         return 'all';
     return 'all';
@@ -167,6 +172,8 @@ function buildStatus(cwd, platform = 'all') {
     const identityCache = (0, identity_1.readCache)(identityCachePath);
     const codexSkillPath = path.join(home(), '.codex', 'skills', 'greprag');
     const claudeSkillPath = path.join(home(), '.claude', 'skills', 'greprag');
+    const grokSkillPath = path.join(home(), '.grok', 'skills', 'greprag');
+    const grokHooks = readJson(grokHooksPath(), {});
     const opencodePluginPath = path.join(home(), '.config', 'opencode', 'plugins', 'greprag-memory.js');
     const claudeHooks = {
         session_start_recap: hasHook(settings.hooks?.SessionStart, 'recap'),
@@ -187,6 +194,15 @@ function buildStatus(cwd, platform = 'all') {
         post_compact_session_id: hasCodexHook(codexHooks.hooks?.PostCompact, 'session-id'),
     };
     const opencodePluginInstalled = fs.existsSync(opencodePluginPath);
+    const grokHookStatus = {
+        session_start_recap: hasCodexHook(grokHooks.hooks?.SessionStart, 'recap'),
+        session_id: hasCodexHook(grokHooks.hooks?.SessionStart, 'session-id'),
+        session_start_drain: hasCodexHook(grokHooks.hooks?.SessionStart, 'drain'),
+        user_prompt_submit: hasCodexHook(grokHooks.hooks?.UserPromptSubmit, 'notify'),
+        crush_wrap: hasCodexHook(grokHooks.hooks?.PreToolUse, 'crush-wrap'),
+        stop_store: hasCodexHook(grokHooks.hooks?.Stop, 'store'),
+        stop_drain: hasCodexHook(grokHooks.hooks?.Stop, 'drain'),
+    };
     return {
         installed: true,
         version: readVersion(),
@@ -212,6 +228,8 @@ function buildStatus(cwd, platform = 'all') {
             codex_pre_tool_use_safety: codexHookStatus.pre_tool_use_safety,
             codex_pre_tool_use_chip_guard: codexHookStatus.pre_tool_use_chip_guard,
             codex_stop_store: codexHookStatus.stop_store,
+            grok_session_start_recap: grokHookStatus.session_start_recap,
+            grok_stop_store: grokHookStatus.stop_store,
         },
         platforms: {
             claude: {
@@ -241,6 +259,16 @@ function buildStatus(cwd, platform = 'all') {
                 plugin_installed: opencodePluginInstalled,
                 note: 'OpenCode loads the GrepRAG plugin from its global plugin directory.',
             },
+            grok: {
+                configured: !!api.key && grokHookStatus.session_start_recap && grokHookStatus.stop_store
+                    && fs.existsSync(grokSkillPath),
+                config_path: grokHooksPath(),
+                config_present: fs.existsSync(grokHooksPath()),
+                skill_path: grokSkillPath,
+                skill_installed: fs.existsSync(grokSkillPath),
+                hooks: grokHookStatus,
+                note: 'Grok recap is a sidecar + ~/.grok/rules (SessionStart stdout is ignored). Idle inbox: Grok monitor + quiet watch. Stop drain injects unread mail only when unarmed.',
+            },
         },
         project: {
             cwd: path.resolve(cwd),
@@ -293,7 +321,7 @@ function renderPlatform(name, p) {
 }
 function renderHuman(s, docMirror) {
     const yes = (b) => b ? 'yes' : 'no';
-    const platformNames = s.platform === 'all' ? ['claude', 'codex', 'opencode'] : [s.platform];
+    const platformNames = s.platform === 'all' ? ['claude', 'codex', 'opencode', 'grok'] : [s.platform];
     return [
         `greprag ${s.version}`,
         `Shared env: ${s.shared_env_path}`,