grok-bot-cli 0.2.1 → 0.2.3

package/README.md

@@ -14,7 +14,7 @@ Manage [Grok Bot](https://cursor.com/help/grok-bot/plans) agents, groups, and me
 npm install --global grok-bot-cli
 ```
 
-Requires Node.js 18+ and the Grok Bot macOS app. Open Grok Bot and sign in once; `gbot` automatically uses the app's encrypted session and routing credentials. No token copying is required.
+Requires Node.js 18+ and the Grok Bot desktop app on macOS or Linux. Open Grok Bot and sign in once; `gbot` automatically uses the app's encrypted session and routing credentials. No token copying is required. On Linux the app keeps its session under `~/.config/Grok Bot` (or `$XDG_CONFIG_HOME`); when it is stored in the system keyring, `gbot` reads the key with `secret-tool` (package `libsecret-tools`).
 
 ## Use
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "grok-bot-cli",
-  "version": "0.2.1",
+  "version": "0.2.3",
   "description": "CLI for Grok Bot agents and groups: create, update, message, inspect threads, and automate cleanup",
   "type": "module",
   "bin": {
@@ -43,6 +43,6 @@
     "LICENSE"
   ],
   "devDependencies": {
-    "@changesets/cli": "2.31.1"
+    "@changesets/cli": "3.0.1"
   }
 }

package/src/app-session.js

@@ -4,15 +4,71 @@ import { existsSync, readFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { join } from "node:path";
 
-const SAFE_STORAGE_PREFIX = Buffer.from("v10");
+// Chromium OSCrypt: "v10" = fixed password (macOS: the Keychain password; Linux: "peanuts"),
+// "v11" = Linux Secret Service password. macOS stretches with 1003 PBKDF2 rounds, Linux with 1.
+const SAFE_STORAGE_PREFIX_V10 = "v10";
+const SAFE_STORAGE_PREFIX_V11 = "v11";
+const LINUX_BASIC_TEXT_PASSWORD = "peanuts";
+const SUPPORTED_PLATFORMS = new Set(["darwin", "linux"]);
 
-export function decryptSafeStorageString(encryptedBase64, password) {
+export class GrokBotGatewaySessionError extends Error {
+  constructor(code, message) {
+    super(message);
+    this.name = "GrokBotGatewaySessionError";
+    this.code = code;
+  }
+}
+
+function encryptedPayload(wrapped) {
+  if (wrapped.version != null && wrapped.version !== 1 && wrapped.version !== 2) {
+    throw new GrokBotGatewaySessionError(
+      "UNSUPPORTED_VERSION",
+      `Unsupported Grok Bot gateway descriptor version ${wrapped.version}.`,
+    );
+  }
+  let encrypted;
+  if (wrapped.version === 2) {
+    const entries = Object.values(wrapped.entries ?? {});
+    if (entries.length === 0) {
+      throw new GrokBotGatewaySessionError(
+        "EMPTY_ENTRIES",
+        "Grok Bot gateway descriptor has no saved gateway entries.",
+      );
+    }
+    if (entries.length > 1) {
+      throw new GrokBotGatewaySessionError(
+        "AMBIGUOUS_ENTRIES",
+        "Grok Bot gateway descriptor has multiple saved gateway entries and no active entry selection.",
+      );
+    }
+    encrypted = entries[0]?.encrypted;
+  } else {
+    encrypted = wrapped.encrypted;
+  }
+  if (typeof encrypted !== "string" || !encrypted) {
+    throw new GrokBotGatewaySessionError(
+      "MISSING_ENCRYPTED_PAYLOAD",
+      "Grok Bot gateway descriptor is missing an encrypted payload.",
+    );
+  }
+  return encrypted;
+}
+
+function safeStorageKey(password, platform) {
+  const iterations = platform === "linux" ? 1 : 1003;
+  return crypto.pbkdf2Sync(password, "saltysalt", iterations, 16, "sha1");
+}
+
+export function decryptSafeStorageString(encryptedBase64, password, platform = "darwin") {
   const encrypted = Buffer.from(encryptedBase64, "base64");
-  if (!encrypted.subarray(0, 3).equals(SAFE_STORAGE_PREFIX)) {
+  const prefix = encrypted.subarray(0, 3).toString("latin1");
+  const linuxBasicText = platform === "linux" && prefix === SAFE_STORAGE_PREFIX_V10;
+  const keyring = prefix === SAFE_STORAGE_PREFIX_V10 || (platform === "linux" && prefix === SAFE_STORAGE_PREFIX_V11);
+  if (!keyring) {
     throw new Error("Unsupported Grok Bot Safe Storage format.");
   }
 
-  const key = crypto.pbkdf2Sync(password, "saltysalt", 1003, 16, "sha1");
+  const key = safeStorageKey(linuxBasicText ? LINUX_BASIC_TEXT_PASSWORD : password, platform);
   const decipher = crypto.createDecipheriv(
     "aes-128-cbc",
     key,
@@ -24,7 +80,11 @@ export function decryptSafeStorageString(encryptedBase64, password) {
   ]).toString("utf8");
 }
 
-export function grokBotGatewayDescriptorPath(home = homedir()) {
+export function grokBotGatewayDescriptorPath(home = homedir(), platform = process.platform, env = process.env) {
+  if (platform === "linux") {
+    const configHome = env.XDG_CONFIG_HOME || join(home, ".config");
+    return join(configHome, "Grok Bot/gateway-descriptor.json");
+  }
   return join(
     home,
     "Library/Application Support/Grok Bot/gateway-descriptor.json",
@@ -34,11 +94,19 @@ export function grokBotGatewayDescriptorPath(home = homedir()) {
 export function hasGrokBotGatewaySession({
   platform = process.platform,
   home = homedir(),
+  env = process.env,
 } = {}) {
-  return platform === "darwin" && existsSync(grokBotGatewayDescriptorPath(home));
+  return SUPPORTED_PLATFORMS.has(platform) && existsSync(grokBotGatewayDescriptorPath(home, platform, env));
 }
 
-function readKeychainPassword() {
+function readKeychainPassword(platform = process.platform) {
+  if (platform === "linux") {
+    return execFileSync(
+      "secret-tool",
+      ["lookup", "xdg:schema", "chrome_libsecret_os_crypt_password_v2", "application", "Grok Bot"],
+      { encoding: "utf8" },
+    ).trimEnd();
+  }
   return execFileSync(
     "/usr/bin/security",
     ["find-generic-password", "-w", "-s", "Grok Bot Safe Storage"],
@@ -49,21 +117,30 @@ function readKeychainPassword() {
 export function loadGrokBotGatewaySession({
   platform = process.platform,
   home = homedir(),
+  env = process.env,
   getKeychainPassword = readKeychainPassword,
 } = {}) {
-  if (platform !== "darwin") return null;
+  if (!SUPPORTED_PLATFORMS.has(platform)) return null;
 
-  const path = grokBotGatewayDescriptorPath(home);
+  const path = grokBotGatewayDescriptorPath(home, platform, env);
   if (!existsSync(path)) return null;
 
   const wrapped = JSON.parse(readFileSync(path, "utf8"));
+  const encrypted = encryptedPayload(wrapped);
+  const prefix = Buffer.from(encrypted, "base64").subarray(0, 3).toString("latin1");
+  // Linux v10 is the keyring-less basic_text backend; no secret store to ask.
+  const needsKeychain = !(platform === "linux" && prefix === SAFE_STORAGE_PREFIX_V10);
   const clear = decryptSafeStorageString(
-    wrapped.encrypted,
-    getKeychainPassword(),
+    encrypted,
+    needsKeychain ? getKeychainPassword(platform) : LINUX_BASIC_TEXT_PASSWORD,
+    platform,
   );
   const descriptor = JSON.parse(clear);
   if (!descriptor.baseUrl || !descriptor.token) {
-    throw new Error("Grok Bot gateway descriptor is incomplete.");
+    throw new GrokBotGatewaySessionError(
+      "INCOMPLETE_DESCRIPTOR",
+      "Decrypted Grok Bot gateway descriptor is incomplete.",
+    );
   }
 
   return {
@@ -72,3 +149,20 @@ export function loadGrokBotGatewaySession({
     headers: descriptor.headers ?? {},
   };
 }
+
+export function inspectGrokBotGatewaySession(options = {}) {
+  if (!hasGrokBotGatewaySession(options)) {
+    return { present: false, usable: false };
+  }
+  try {
+    loadGrokBotGatewaySession(options);
+    return { present: true, usable: true };
+  } catch (error) {
+    return {
+      present: true,
+      usable: false,
+      code: error instanceof GrokBotGatewaySessionError ? error.code : "UNUSABLE_SESSION",
+      error: error instanceof Error ? error.message : String(error),
+    };
+  }
+}

package/src/cli.js

@@ -2,6 +2,7 @@
 import { AVATAR_COLORS, AVATAR_SHAPES, MAX_GROUP_MEMBERS, StoreError, defaultCandidateRoots, looksLikeAgentsRoot, resolveAgentsRoot } from "./store.js";
 import { hasGatewayAuth } from "./gateway.js";
 import { openBackend } from "./commands.js";
+import { inspectGrokBotGatewaySession } from "./app-session.js";
 
 function print(value) {
   if (typeof value === "string") process.stdout.write(value + "\n");
@@ -247,11 +248,16 @@ async function main(argv) {
       if (!(err instanceof StoreError)) throw err;
     }
     const note = "Live roster is on the box. Prefer CURSOR_ACCESS_TOKEN then EnsureSandBox then POST gateway /api/*.";
-    const payload = { resolved, found, candidates, gatewayAuthPresent: hasGatewayAuth(), note };
+    const gatewayAuthPresent = hasGatewayAuth();
+    const grokBotAppSession = inspectGrokBotGatewaySession();
+    const payload = { resolved, found, candidates, gatewayAuthPresent, grokBotAppSession, note };
     if (json) print(payload);
     else {
       print("resolved: " + (resolved ?? "(none)"));
-      print("gateway auth: " + (hasGatewayAuth() ? "yes (env)" : "no"));
+      print("gateway auth: " + (gatewayAuthPresent ? "present" : "no"));
+      if (grokBotAppSession.usable) print("Grok Bot app session: usable");
+      else if (grokBotAppSession.present) print("Grok Bot app session: present but unusable: " + grokBotAppSession.error);
+      else print("Grok Bot app session: not found");
       print("found:");
       print(found.length ? found.map((p) => "  " + p).join("\n") : "  (none)");
       print("candidates:");