grok-bot-cli 0.4.1 → 0.4.5

package/dist/install.mjs

@@ -7,7 +7,7 @@ import { basename, dirname, isAbsolute, join, relative, resolve, sep } from 'nod
 import { fileURLToPath } from 'node:url';
 
 const pluginName = "gbot";
-const pluginVersion = "0.4.1";
+const pluginVersion = "0.4.5";
 const receiptFile = ".agent-bundle-install.json";
 const receiptFormat = "agent-bundle-install-receipt/2";
 const legacyReceiptFormat = "agent-bundle-install-receipt/1";

package/dist/mcp/mcp-grok-bot-b8c2461e-flight.mjs

@@ -25987,6 +25987,8 @@ __webpack_require__.d(__webpack_exports__, {
  * never *.cursorvm.com, so a CURSOR_ACCESS_TOKEN cannot be pointed at a box host.
  * Local/dev gateways: http(s)://127.0.0.1|localhost|::1 when GROK_BOT_ALLOW_LOCAL_GATEWAY=1.
  * Escape hatch: GROK_BOT_ALLOW_ANY_GATEWAY=1 (unsafe; disables host checks; warns once).
+ * Test mode (GROK_BOT_TEST=1 or NODE_ENV=test): loopback only, for gateway and backend
+ * alike, and the escape hatches are ignored — a test can never reach a live thread.
  */ function truthyEnv(name) {
     const v = (process.env[name] || "").trim().toLowerCase();
     return v === "1" || v === "true" || v === "yes";
@@ -25997,6 +25999,9 @@ function allowAnyGateway() {
 function allowLocalGateway() {
     return truthyEnv("GROK_BOT_ALLOW_LOCAL_GATEWAY");
 }
+function testMode() {
+    return truthyEnv("GROK_BOT_TEST") || process.env.NODE_ENV === "test";
+}
 const warned = new Set();
 function warnOnce(key, message) {
     if (warned.has(key)) return;
@@ -26036,6 +26041,12 @@ function isCursorGatewayHostname(hostname) {
     if (parsed.username || parsed.password) {
         throw new Error("Rejected " + label + ": userinfo is not allowed.");
     }
+    if (testMode()) {
+        if (!isLocalHostname(parsed.hostname) || parsed.protocol !== "http:" && parsed.protocol !== "https:") {
+            throw new Error("Rejected " + label + " host \"" + parsed.hostname + "\": test mode (GROK_BOT_TEST / NODE_ENV=test) only allows http(s) loopback gateways.");
+        }
+        return String(rawUrl).replace(/\/$/, "");
+    }
     if (allowAnyGateway()) {
         warnOnce("ALLOW_ANY", "warning: GROK_BOT_ALLOW_ANY_GATEWAY is set; credential host checks are disabled.");
         return String(rawUrl).replace(/\/$/, "");
@@ -26173,7 +26184,7 @@ globalThis.__rspack_rsc_manifest__ ??= Object.freeze({
 });
 if (node_worker_threads__rspack_import_0.parentPort === null) throw new Error('Generated Flight worker requires a parent port.');
 process.stdout.write = process.stderr.write.bind(process.stderr);
-const ARTIFACT_EPOCH = "gbot@0.4.1";
+const ARTIFACT_EPOCH = "gbot@0.4.5";
 const processLifetime = {
     hits: 0,
     instanceId: crypto.randomUUID(),

package/dist/mcp/mcp-grok-bot-b8c2461e.mjs

@@ -106202,7 +106202,7 @@ __webpack_require__.r(__webpack_exports__);
 const route0 = Object.assign({}, Reflect.get(_home_runner_work_grok_bot_cli_grok_bot_cli_src_mcp_grok_bot_tools_gbot_send_tsx__rspack_import_3, 'default'), _home_runner_work_grok_bot_cli_grok_bot_cli_src_mcp_grok_bot_tools_gbot_send_tsx__rspack_import_3);
 
 const route1 = Object.assign({}, Reflect.get(_home_runner_work_grok_bot_cli_grok_bot_cli_src_mcp_grok_bot_tools_gbot_thread_tsx__rspack_import_4, 'default'), _home_runner_work_grok_bot_cli_grok_bot_cli_src_mcp_grok_bot_tools_gbot_thread_tsx__rspack_import_4);
-const ARTIFACT_EPOCH = "gbot@0.4.1";
+const ARTIFACT_EPOCH = "gbot@0.4.5";
 const pluginRoot = (0,_agent_bundle_runtime__rspack_import_5/* .resolvePluginRoot */.E7)({
     fallback: (0,node_url__rspack_import_0.fileURLToPath)(new URL('..', import.meta.url)),
     stateAnchor: 'user-data'
@@ -106291,7 +106291,7 @@ const routes = Object.freeze({
         lineage: lineage.registry,
         plugin: {
             "name": "gbot",
-            "version": "0.4.1"
+            "version": "0.4.5"
         },
         pluginRoot: pluginRoot.identity,
         routes
@@ -107476,6 +107476,8 @@ __webpack_require__.d(__webpack_exports__, {
  * never *.cursorvm.com, so a CURSOR_ACCESS_TOKEN cannot be pointed at a box host.
  * Local/dev gateways: http(s)://127.0.0.1|localhost|::1 when GROK_BOT_ALLOW_LOCAL_GATEWAY=1.
  * Escape hatch: GROK_BOT_ALLOW_ANY_GATEWAY=1 (unsafe; disables host checks; warns once).
+ * Test mode (GROK_BOT_TEST=1 or NODE_ENV=test): loopback only, for gateway and backend
+ * alike, and the escape hatches are ignored — a test can never reach a live thread.
  */ function truthyEnv(name) {
     const v = (process.env[name] || "").trim().toLowerCase();
     return v === "1" || v === "true" || v === "yes";
@@ -107486,6 +107488,9 @@ function allowAnyGateway() {
 function allowLocalGateway() {
     return truthyEnv("GROK_BOT_ALLOW_LOCAL_GATEWAY");
 }
+function testMode() {
+    return truthyEnv("GROK_BOT_TEST") || process.env.NODE_ENV === "test";
+}
 const warned = new Set();
 function warnOnce(key, message) {
     if (warned.has(key)) return;
@@ -107525,6 +107530,12 @@ function isCursorGatewayHostname(hostname) {
     if (parsed.username || parsed.password) {
         throw new Error("Rejected " + label + ": userinfo is not allowed.");
     }
+    if (testMode()) {
+        if (!isLocalHostname(parsed.hostname) || parsed.protocol !== "http:" && parsed.protocol !== "https:") {
+            throw new Error("Rejected " + label + " host \"" + parsed.hostname + "\": test mode (GROK_BOT_TEST / NODE_ENV=test) only allows http(s) loopback gateways.");
+        }
+        return String(rawUrl).replace(/\/$/, "");
+    }
     if (allowAnyGateway()) {
         warnOnce("ALLOW_ANY", "warning: GROK_BOT_ALLOW_ANY_GATEWAY is set; credential host checks are disabled.");
         return String(rawUrl).replace(/\/$/, "");

package/dist/package.json

@@ -1,6 +1,6 @@
 {
   "name": "grok-bot-cli",
-  "version": "0.4.1",
+  "version": "0.4.5",
   "description": "CLI and Agent Bundle plugin for Grok Bot agents and groups: create, update, message, inspect threads, and automate cleanup",
   "type": "module",
   "engines": {

package/dist/plugin.json

@@ -1 +1 @@
-{"$schema":"https://agent-plugins.org/schemas/1.0.0/plugin.schema.json","author":{"name":"Zack Jackson","url":"https://github.com/ScriptedAlchemy"},"description":"Message Grok Bot bots and groups and read their threads from Codex, Claude Code, and Cursor.","homepage":"https://github.com/ScriptedAlchemy/grok-bot-cli#readme","keywords":["grok","grok-bot","grokbot","gbot","cursor","ai-agents","automation","terminal","cli","agent-bundle"],"license":"MIT","name":"gbot","repository":"https://github.com/ScriptedAlchemy/grok-bot-cli","version":"0.4.1"}
+{"$schema":"https://agent-plugins.org/schemas/1.0.0/plugin.schema.json","author":{"name":"Zack Jackson","url":"https://github.com/ScriptedAlchemy"},"description":"Message Grok Bot bots and groups and read their threads from Codex, Claude Code, and Cursor.","homepage":"https://github.com/ScriptedAlchemy/grok-bot-cli#readme","keywords":["grok","grok-bot","grokbot","gbot","cursor","ai-agents","automation","terminal","cli","agent-bundle"],"license":"MIT","name":"gbot","repository":"https://github.com/ScriptedAlchemy/grok-bot-cli","version":"0.4.5"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "grok-bot-cli",
-  "version": "0.4.1",
+  "version": "0.4.5",
   "description": "CLI and Agent Bundle plugin for Grok Bot agents and groups: create, update, message, inspect threads, and automate cleanup",
   "type": "module",
   "bin": {