grok-bot-cli 0.4.2 → 0.5.0

package/dist/install.mjs

@@ -7,7 +7,7 @@ import { basename, dirname, isAbsolute, join, relative, resolve, sep } from 'nod
 import { fileURLToPath } from 'node:url';
 
 const pluginName = "gbot";
-const pluginVersion = "0.4.2";
+const pluginVersion = "0.5.0";
 const receiptFile = ".agent-bundle-install.json";
 const receiptFormat = "agent-bundle-install-receipt/2";
 const legacyReceiptFormat = "agent-bundle-install-receipt/1";

package/dist/mcp/mcp-grok-bot-b8c2461e-flight.mjs

@@ -13424,7 +13424,7 @@ if (process.env.NODE_ENV === 'production') {
 
 // Hosts and the CLI print thrown error text (and stack), and a fetch or proxy failure can echo
 // a credential. Rewrap with a redacted message; keep `name` and own fields such as `reason`,
-// `delivery`, `mode`, and `envelope` so outcome documents still classify the failure.
+// `delivery`, `mode`, and correlation ids so outcome documents still classify the failure.
 const withRedactedErrors = async (run)=>{
     try {
         return await run();
@@ -13673,7 +13673,9 @@ const inputSchema = zod__rspack_import_3/* .object */.Ikc({
         after,
         limit
     });
-    const entries = (0,_gbot_js__rspack_import_2/* .transcriptEntries */.xw)(delta.entries);
+    const entries = (0,_gbot_js__rspack_import_2/* .transcriptEntries */.xw)({
+        entries: delta.entries
+    });
     const summary = delta.gapReset ? `${delta.entryCount} entries; gap reset` : after === undefined ? `${delta.entryCount} entries` : `${delta.entryCount} new`;
     const receipt = {
         cursor: delta.cursor,
@@ -25083,19 +25085,17 @@ class GatewayError extends Error {
 const GATEWAY_TIMEOUT_MS = 30000;
 const GATEWAY_MAX_RESPONSE_BYTES = 2 * 1024 * 1024;
 function backendBase() {
-    return (process.env.SAND_BACKEND_URL || process.env.CURSOR_API_BASE_URL || "https://api2.cursor.sh").replace(/\/$/, "");
+    return (process.env.CURSOR_API_BASE_URL || "https://api2.cursor.sh").replace(/\/$/, "");
 }
 function accessTokenFromEnv() {
-    return (process.env.CURSOR_ACCESS_TOKEN || process.env.GROK_BOT_ACCESS_TOKEN || process.env.SAND_ACCESS_TOKEN || "").trim();
+    return (process.env.CURSOR_ACCESS_TOKEN || "").trim();
 }
 function gatewayTokenFromEnv() {
-    return (process.env.GROK_BOT_GATEWAY_TOKEN || process.env.SAND_HOST_GATEWAY_TOKEN || process.env.SAND_GATEWAY_TOKEN || "").trim();
+    return (process.env.GROK_BOT_GATEWAY_TOKEN || "").trim();
 }
 function gatewayOverride() {
     const token = gatewayTokenFromEnv();
-    const explicitUrl = (process.env.GROK_BOT_GATEWAY_URL || process.env.SAND_HOST_GATEWAY_URL || "").trim();
-    const localUrl = token ? "http://127.0.0.1:" + (process.env.SAND_HOST_PORT || "1340") : "";
-    const url = explicitUrl || localUrl;
+    const url = (process.env.GROK_BOT_GATEWAY_URL || "").trim();
     if (url && token) {
         return {
             gatewayUrl: (0,_url_policy_js__rspack_import_3/* .assertAllowedCredentialUrl */.Re)(url.replace(/\/$/, ""), {
@@ -25415,14 +25415,13 @@ async function removeGroupMember(session, groupRef, memberRef) {
     const next = group.memberIds.filter((id)=>id !== member.id);
     return setGroupMembers(session, group.id, next);
 }
-async function sendPrompt(session, ref, prompt, extra = {}) {
+async function sendPrompt(session, ref, prompt) {
     const rec = await resolveRef(session, ref);
     const body = {
         agentId: rec.id,
         prompt,
-        clientNonce: extra.clientNonce || (0,node_crypto__rspack_import_0.randomUUID)()
+        clientNonce: (0,node_crypto__rspack_import_0.randomUUID)()
     };
-    if (extra.replyToId) body.replyToId = extra.replyToId;
     let data;
     try {
         data = await gatewayCall(session, "sendPrompt", body);
@@ -25613,10 +25612,7 @@ function isUuid(value) {
 function defaultCandidateRoots() {
     const home = homedir();
     const env = [
-        process.env.GROK_BOT_AGENTS_DIR,
-        process.env.SAND_AGENTS_DIR,
-        process.env.SAND_DATA_ROOT && join(process.env.SAND_DATA_ROOT, "agents"),
-        process.env.SAND_DATA_ROOT && join(process.env.SAND_DATA_ROOT, "agent-data", "agents")
+        process.env.GROK_BOT_AGENTS_DIR
     ].filter(Boolean);
     return [
         ...env,
@@ -25876,7 +25872,6 @@ function removeGroupMember(root, groupRef, memberRef) {
 
 },
 "./src/core/transcript.js"(__unused_rspack___webpack_module__, __webpack_exports__, __webpack_require__) {
-// Shared by `gbot thread` and the grok-bot plugin's gbot_thread tool.
 /** Coerce anything to a string without throwing (numbers, BigInt, unserializable objects). */ function toSafeText(value) {
     if (typeof value === "string") return value;
     if (value == null) return "";
@@ -25914,15 +25909,12 @@ function entryTextRaw(e) {
     return typeof e.preview === "string" ? e.preview : "";
 }
 function transcriptEntries(payload) {
-    if (Array.isArray(payload)) return payload;
     if (!payload || typeof payload !== "object") return [];
-    const entries = payload.entries || payload.messages || payload.items;
-    return Array.isArray(entries) ? entries : [];
+    return Array.isArray(payload.entries) ? payload.entries : [];
 }
 function sourceEntryId(entry) {
     if (!entry || typeof entry !== "object") return "";
-    if (typeof entry.id === "string" && entry.id) return entry.id;
-    return typeof entry.messageId === "string" ? entry.messageId : "";
+    return typeof entry.id === "string" ? entry.id : "";
 }
 function lastSourceId(entries, fallback = "") {
     for(let index = entries.length - 1; index >= 0; index -= 1){
@@ -25987,6 +25979,8 @@ __webpack_require__.d(__webpack_exports__, {
  * never *.cursorvm.com, so a CURSOR_ACCESS_TOKEN cannot be pointed at a box host.
  * Local/dev gateways: http(s)://127.0.0.1|localhost|::1 when GROK_BOT_ALLOW_LOCAL_GATEWAY=1.
  * Escape hatch: GROK_BOT_ALLOW_ANY_GATEWAY=1 (unsafe; disables host checks; warns once).
+ * Test mode (GROK_BOT_TEST=1 or NODE_ENV=test): loopback only, for gateway and backend
+ * alike, and the escape hatches are ignored — a test can never reach a live thread.
  */ function truthyEnv(name) {
     const v = (process.env[name] || "").trim().toLowerCase();
     return v === "1" || v === "true" || v === "yes";
@@ -25997,6 +25991,9 @@ function allowAnyGateway() {
 function allowLocalGateway() {
     return truthyEnv("GROK_BOT_ALLOW_LOCAL_GATEWAY");
 }
+function testMode() {
+    return truthyEnv("GROK_BOT_TEST") || process.env.NODE_ENV === "test";
+}
 const warned = new Set();
 function warnOnce(key, message) {
     if (warned.has(key)) return;
@@ -26036,6 +26033,12 @@ function isCursorGatewayHostname(hostname) {
     if (parsed.username || parsed.password) {
         throw new Error("Rejected " + label + ": userinfo is not allowed.");
     }
+    if (testMode()) {
+        if (!isLocalHostname(parsed.hostname) || parsed.protocol !== "http:" && parsed.protocol !== "https:") {
+            throw new Error("Rejected " + label + " host \"" + parsed.hostname + "\": test mode (GROK_BOT_TEST / NODE_ENV=test) only allows http(s) loopback gateways.");
+        }
+        return String(rawUrl).replace(/\/$/, "");
+    }
     if (allowAnyGateway()) {
         warnOnce("ALLOW_ANY", "warning: GROK_BOT_ALLOW_ANY_GATEWAY is set; credential host checks are disabled.");
         return String(rawUrl).replace(/\/$/, "");
@@ -26173,7 +26176,7 @@ globalThis.__rspack_rsc_manifest__ ??= Object.freeze({
 });
 if (node_worker_threads__rspack_import_0.parentPort === null) throw new Error('Generated Flight worker requires a parent port.');
 process.stdout.write = process.stderr.write.bind(process.stderr);
-const ARTIFACT_EPOCH = "gbot@0.4.2";
+const ARTIFACT_EPOCH = "gbot@0.5.0";
 const processLifetime = {
     hits: 0,
     instanceId: crypto.randomUUID(),

package/dist/mcp/mcp-grok-bot-b8c2461e.mjs

@@ -10996,7 +10996,7 @@ if (process.env.NODE_ENV === 'production') {
 
 // Hosts and the CLI print thrown error text (and stack), and a fetch or proxy failure can echo
 // a credential. Rewrap with a redacted message; keep `name` and own fields such as `reason`,
-// `delivery`, `mode`, and `envelope` so outcome documents still classify the failure.
+// `delivery`, `mode`, and correlation ids so outcome documents still classify the failure.
 const withRedactedErrors = async (run)=>{
     try {
         return await run();
@@ -11245,7 +11245,9 @@ const inputSchema = zod__rspack_import_3/* .object */.Ikc({
         after,
         limit
     });
-    const entries = (0,_gbot_js__rspack_import_2/* .transcriptEntries */.xw)(delta.entries);
+    const entries = (0,_gbot_js__rspack_import_2/* .transcriptEntries */.xw)({
+        entries: delta.entries
+    });
     const summary = delta.gapReset ? `${delta.entryCount} entries; gap reset` : after === undefined ? `${delta.entryCount} entries` : `${delta.entryCount} new`;
     const receipt = {
         cursor: delta.cursor,
@@ -106202,7 +106204,7 @@ __webpack_require__.r(__webpack_exports__);
 const route0 = Object.assign({}, Reflect.get(_home_runner_work_grok_bot_cli_grok_bot_cli_src_mcp_grok_bot_tools_gbot_send_tsx__rspack_import_3, 'default'), _home_runner_work_grok_bot_cli_grok_bot_cli_src_mcp_grok_bot_tools_gbot_send_tsx__rspack_import_3);
 
 const route1 = Object.assign({}, Reflect.get(_home_runner_work_grok_bot_cli_grok_bot_cli_src_mcp_grok_bot_tools_gbot_thread_tsx__rspack_import_4, 'default'), _home_runner_work_grok_bot_cli_grok_bot_cli_src_mcp_grok_bot_tools_gbot_thread_tsx__rspack_import_4);
-const ARTIFACT_EPOCH = "gbot@0.4.2";
+const ARTIFACT_EPOCH = "gbot@0.5.0";
 const pluginRoot = (0,_agent_bundle_runtime__rspack_import_5/* .resolvePluginRoot */.E7)({
     fallback: (0,node_url__rspack_import_0.fileURLToPath)(new URL('..', import.meta.url)),
     stateAnchor: 'user-data'
@@ -106291,7 +106293,7 @@ const routes = Object.freeze({
         lineage: lineage.registry,
         plugin: {
             "name": "gbot",
-            "version": "0.4.2"
+            "version": "0.5.0"
         },
         pluginRoot: pluginRoot.identity,
         routes
@@ -106572,19 +106574,17 @@ class GatewayError extends Error {
 const GATEWAY_TIMEOUT_MS = 30000;
 const GATEWAY_MAX_RESPONSE_BYTES = 2 * 1024 * 1024;
 function backendBase() {
-    return (process.env.SAND_BACKEND_URL || process.env.CURSOR_API_BASE_URL || "https://api2.cursor.sh").replace(/\/$/, "");
+    return (process.env.CURSOR_API_BASE_URL || "https://api2.cursor.sh").replace(/\/$/, "");
 }
 function accessTokenFromEnv() {
-    return (process.env.CURSOR_ACCESS_TOKEN || process.env.GROK_BOT_ACCESS_TOKEN || process.env.SAND_ACCESS_TOKEN || "").trim();
+    return (process.env.CURSOR_ACCESS_TOKEN || "").trim();
 }
 function gatewayTokenFromEnv() {
-    return (process.env.GROK_BOT_GATEWAY_TOKEN || process.env.SAND_HOST_GATEWAY_TOKEN || process.env.SAND_GATEWAY_TOKEN || "").trim();
+    return (process.env.GROK_BOT_GATEWAY_TOKEN || "").trim();
 }
 function gatewayOverride() {
     const token = gatewayTokenFromEnv();
-    const explicitUrl = (process.env.GROK_BOT_GATEWAY_URL || process.env.SAND_HOST_GATEWAY_URL || "").trim();
-    const localUrl = token ? "http://127.0.0.1:" + (process.env.SAND_HOST_PORT || "1340") : "";
-    const url = explicitUrl || localUrl;
+    const url = (process.env.GROK_BOT_GATEWAY_URL || "").trim();
     if (url && token) {
         return {
             gatewayUrl: (0,_url_policy_js__rspack_import_3/* .assertAllowedCredentialUrl */.Re)(url.replace(/\/$/, ""), {
@@ -106904,14 +106904,13 @@ async function removeGroupMember(session, groupRef, memberRef) {
     const next = group.memberIds.filter((id)=>id !== member.id);
     return setGroupMembers(session, group.id, next);
 }
-async function sendPrompt(session, ref, prompt, extra = {}) {
+async function sendPrompt(session, ref, prompt) {
     const rec = await resolveRef(session, ref);
     const body = {
         agentId: rec.id,
         prompt,
-        clientNonce: extra.clientNonce || (0,node_crypto__rspack_import_0.randomUUID)()
+        clientNonce: (0,node_crypto__rspack_import_0.randomUUID)()
     };
-    if (extra.replyToId) body.replyToId = extra.replyToId;
     let data;
     try {
         data = await gatewayCall(session, "sendPrompt", body);
@@ -107102,10 +107101,7 @@ function isUuid(value) {
 function defaultCandidateRoots() {
     const home = homedir();
     const env = [
-        process.env.GROK_BOT_AGENTS_DIR,
-        process.env.SAND_AGENTS_DIR,
-        process.env.SAND_DATA_ROOT && join(process.env.SAND_DATA_ROOT, "agents"),
-        process.env.SAND_DATA_ROOT && join(process.env.SAND_DATA_ROOT, "agent-data", "agents")
+        process.env.GROK_BOT_AGENTS_DIR
     ].filter(Boolean);
     return [
         ...env,
@@ -107365,7 +107361,6 @@ function removeGroupMember(root, groupRef, memberRef) {
 
 },
 "./src/core/transcript.js"(__unused_rspack___webpack_module__, __webpack_exports__, __webpack_require__) {
-// Shared by `gbot thread` and the grok-bot plugin's gbot_thread tool.
 /** Coerce anything to a string without throwing (numbers, BigInt, unserializable objects). */ function toSafeText(value) {
     if (typeof value === "string") return value;
     if (value == null) return "";
@@ -107403,15 +107398,12 @@ function entryTextRaw(e) {
     return typeof e.preview === "string" ? e.preview : "";
 }
 function transcriptEntries(payload) {
-    if (Array.isArray(payload)) return payload;
     if (!payload || typeof payload !== "object") return [];
-    const entries = payload.entries || payload.messages || payload.items;
-    return Array.isArray(entries) ? entries : [];
+    return Array.isArray(payload.entries) ? payload.entries : [];
 }
 function sourceEntryId(entry) {
     if (!entry || typeof entry !== "object") return "";
-    if (typeof entry.id === "string" && entry.id) return entry.id;
-    return typeof entry.messageId === "string" ? entry.messageId : "";
+    return typeof entry.id === "string" ? entry.id : "";
 }
 function lastSourceId(entries, fallback = "") {
     for(let index = entries.length - 1; index >= 0; index -= 1){
@@ -107476,6 +107468,8 @@ __webpack_require__.d(__webpack_exports__, {
  * never *.cursorvm.com, so a CURSOR_ACCESS_TOKEN cannot be pointed at a box host.
  * Local/dev gateways: http(s)://127.0.0.1|localhost|::1 when GROK_BOT_ALLOW_LOCAL_GATEWAY=1.
  * Escape hatch: GROK_BOT_ALLOW_ANY_GATEWAY=1 (unsafe; disables host checks; warns once).
+ * Test mode (GROK_BOT_TEST=1 or NODE_ENV=test): loopback only, for gateway and backend
+ * alike, and the escape hatches are ignored — a test can never reach a live thread.
  */ function truthyEnv(name) {
     const v = (process.env[name] || "").trim().toLowerCase();
     return v === "1" || v === "true" || v === "yes";
@@ -107486,6 +107480,9 @@ function allowAnyGateway() {
 function allowLocalGateway() {
     return truthyEnv("GROK_BOT_ALLOW_LOCAL_GATEWAY");
 }
+function testMode() {
+    return truthyEnv("GROK_BOT_TEST") || process.env.NODE_ENV === "test";
+}
 const warned = new Set();
 function warnOnce(key, message) {
     if (warned.has(key)) return;
@@ -107525,6 +107522,12 @@ function isCursorGatewayHostname(hostname) {
     if (parsed.username || parsed.password) {
         throw new Error("Rejected " + label + ": userinfo is not allowed.");
     }
+    if (testMode()) {
+        if (!isLocalHostname(parsed.hostname) || parsed.protocol !== "http:" && parsed.protocol !== "https:") {
+            throw new Error("Rejected " + label + " host \"" + parsed.hostname + "\": test mode (GROK_BOT_TEST / NODE_ENV=test) only allows http(s) loopback gateways.");
+        }
+        return String(rawUrl).replace(/\/$/, "");
+    }
     if (allowAnyGateway()) {
         warnOnce("ALLOW_ANY", "warning: GROK_BOT_ALLOW_ANY_GATEWAY is set; credential host checks are disabled.");
         return String(rawUrl).replace(/\/$/, "");

package/dist/package.json

@@ -1,6 +1,6 @@
 {
   "name": "grok-bot-cli",
-  "version": "0.4.2",
+  "version": "0.5.0",
   "description": "CLI and Agent Bundle plugin for Grok Bot agents and groups: create, update, message, inspect threads, and automate cleanup",
   "type": "module",
   "engines": {
@@ -14,7 +14,7 @@
     "release": "changeset publish",
     "test": "npm run test:unit && npm run test:routes",
     "test:routes": "rstest --config rstest.route-unit.config.ts",
-    "test:unit": "node scripts/run-unit-tests.mjs",
+    "test:unit": "node --env-file=test.env --test \"test/*.test.js\"",
     "typecheck": "tsc -p tsconfig.json --noEmit",
     "validate": "agent-bundle validate",
     "validate:artifact": "agent-bundle validate --artifact artifact"

package/dist/plugin.json

@@ -1 +1 @@
-{"$schema":"https://agent-plugins.org/schemas/1.0.0/plugin.schema.json","author":{"name":"Zack Jackson","url":"https://github.com/ScriptedAlchemy"},"description":"Message Grok Bot bots and groups and read their threads from Codex, Claude Code, and Cursor.","homepage":"https://github.com/ScriptedAlchemy/grok-bot-cli#readme","keywords":["grok","grok-bot","grokbot","gbot","cursor","ai-agents","automation","terminal","cli","agent-bundle"],"license":"MIT","name":"gbot","repository":"https://github.com/ScriptedAlchemy/grok-bot-cli","version":"0.4.2"}
+{"$schema":"https://agent-plugins.org/schemas/1.0.0/plugin.schema.json","author":{"name":"Zack Jackson","url":"https://github.com/ScriptedAlchemy"},"description":"Message Grok Bot bots and groups and read their threads from Codex, Claude Code, and Cursor.","homepage":"https://github.com/ScriptedAlchemy/grok-bot-cli#readme","keywords":["grok","grok-bot","grokbot","gbot","cursor","ai-agents","automation","terminal","cli","agent-bundle"],"license":"MIT","name":"gbot","repository":"https://github.com/ScriptedAlchemy/grok-bot-cli","version":"0.5.0"}

package/dist/skills/talk-to-grok-bot/SKILL.md

@@ -34,4 +34,6 @@ Framework argument/schema errors use stderr and exit 2. `--json` is reserved bef
 
 ## Auth
 
-Same order as `gbot`: explicit `GROK_BOT_GATEWAY_*`, else Grok Bot app session, else `CURSOR_ACCESS_TOKEN`. `gbot doctor` shows which source is present.
+Same order as `gbot`: `GROK_BOT_GATEWAY_URL` plus `GROK_BOT_GATEWAY_TOKEN`,
+else the Grok Bot app session, else `CURSOR_ACCESS_TOKEN`. `gbot doctor` shows
+which source is present.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "grok-bot-cli",
-  "version": "0.4.2",
+  "version": "0.5.0",
   "description": "CLI and Agent Bundle plugin for Grok Bot agents and groups: create, update, message, inspect threads, and automate cleanup",
   "type": "module",
   "bin": {
@@ -20,7 +20,7 @@
     "release": "changeset publish",
     "test": "npm run test:unit && npm run test:routes",
     "test:routes": "rstest --config rstest.route-unit.config.ts",
-    "test:unit": "node scripts/run-unit-tests.mjs",
+    "test:unit": "node --env-file=test.env --test \"test/*.test.js\"",
     "typecheck": "tsc -p tsconfig.json --noEmit",
     "validate": "agent-bundle validate",
     "validate:artifact": "agent-bundle validate --artifact artifact"