grok-bot-cli 0.6.0 → 0.7.0

package/dist/mcp/mcp-grok-bot-b8c2461e-flight.mjs

@@ -13650,6 +13650,37 @@ __webpack_require__.d(__webpack_exports__, {
 });
 
 
+},
+"./src/core/grok-approval-routes.ts"(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
+/* import */ var zod__rspack_import_3 = __webpack_require__("./node_modules/zod/v4/classic/schemas.js");
+/* import */ var _gateway_js__rspack_import_0 = __webpack_require__("./src/core/gateway.js");
+/* import */ var _grok_approvals_js__rspack_import_1 = __webpack_require__("./src/core/grok-approvals.js");
+/* import */ var _gbot_js__rspack_import_2 = __webpack_require__("./src/gbot.ts");
+
+
+
+
+const listSchema = zod__rspack_import_3/* .strictObject */.rej({
+    target: zod__rspack_import_3/* .string */.YjP().min(1).max(1024)
+});
+const respondSchema = _grok_approvals_js__rspack_import_1/* .grokApprovalResponseSchema */.T5;
+const resultSchema = zod__rspack_import_3/* .record */.g1P(zod__rspack_import_3/* .string */.YjP(), zod__rspack_import_3/* .json */.Pq9());
+const listOperation = (input)=>(0,_gbot_js__rspack_import_2/* .withRedactedErrors */.yF)(async ()=>(0,_gateway_js__rspack_import_0/* .listGrokApprovals */.MI)(await (0,_gateway_js__rspack_import_0/* .connectGateway */.Vq)(), listSchema.parse(input).target));
+const respondOperation = (input)=>(0,_gbot_js__rspack_import_2/* .withRedactedErrors */.yF)(async ()=>{
+        const { target, ...response } = respondSchema.parse(input);
+        return (0,_gateway_js__rspack_import_0/* .respondGrokApproval */.OR)(await (0,_gateway_js__rspack_import_0/* .connectGateway */.Vq)(), target, response);
+    });
+
+__webpack_require__.d(__webpack_exports__, {
+}, {
+  FD: resultSchema,
+  cE: listSchema,
+  gi: listOperation,
+  lr: respondOperation,
+  v1: respondSchema
+});
+
+
 },
 "./src/core/relay/routes.ts"(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
 /* import */ var _agent_bundle_runtime__rspack_import_4 = __webpack_require__("./node_modules/@agent-bundle/runtime/dist/40.js");
@@ -14043,9 +14074,9 @@ const resultSchema = zod__rspack_import_4/* .union */.KCZ([
     const context = await (0,_agent_bundle_runtime__rspack_import_5/* .agent */.MA)();
     if (input.replyToGrok || input.bindingId) {
         const out = await (0,_core_relay_routes_js__rspack_import_3/* .codexReturnOperation */.lt)(input, context);
-        return /*#__PURE__*/ (0,react_jsx_runtime__rspack_import_0.jsx)(_agent_bundle_runtime__rspack_import_6/* .Agent.Result */.g6.Result, {
+        return /*#__PURE__*/ (0,react_jsx_runtime__rspack_import_0.jsx)(_agent_bundle_runtime__rspack_import_6/* .Agent.Result */.g.Result, {
             value: out,
-            children: /*#__PURE__*/ (0,react_jsx_runtime__rspack_import_0.jsx)(_agent_bundle_runtime__rspack_import_6/* .Agent.Text */.g6.Text, {
+            children: /*#__PURE__*/ (0,react_jsx_runtime__rspack_import_0.jsx)(_agent_bundle_runtime__rspack_import_6/* .Agent.Text */.g.Text, {
                 children: `Delivery ${out.delivery}; terminal answer returns to Grok automatically.`
             })
         });
@@ -14056,9 +14087,9 @@ const resultSchema = zod__rspack_import_4/* .union */.KCZ([
     }, context.signal, (message)=>context.progress.report({
             message
         }));
-    return /*#__PURE__*/ (0,react_jsx_runtime__rspack_import_0.jsx)(_agent_bundle_runtime__rspack_import_6/* .Agent.Result */.g6.Result, {
+    return /*#__PURE__*/ (0,react_jsx_runtime__rspack_import_0.jsx)(_agent_bundle_runtime__rspack_import_6/* .Agent.Result */.g.Result, {
         value: out,
-        children: /*#__PURE__*/ (0,react_jsx_runtime__rspack_import_0.jsx)(_agent_bundle_runtime__rspack_import_6/* .Agent.Text */.g6.Text, {
+        children: /*#__PURE__*/ (0,react_jsx_runtime__rspack_import_0.jsx)(_agent_bundle_runtime__rspack_import_6/* .Agent.Text */.g.Text, {
             children: (0,_core_codex_routes_js__rspack_import_2/* .resultText */.D6)(out)
         })
     });
@@ -14112,9 +14143,9 @@ __webpack_require__.r(__webpack_exports__);
 }, async (input)=>{
     const context = await (0,_agent_bundle_runtime__rspack_import_3/* .agent */.MA)();
     const out = await (0,_core_codex_routes_js__rspack_import_2/* .threadsOperation */.$c)(input);
-    return /*#__PURE__*/ (0,react_jsx_runtime__rspack_import_0.jsx)(_agent_bundle_runtime__rspack_import_4/* .Agent.Result */.g6.Result, {
+    return /*#__PURE__*/ (0,react_jsx_runtime__rspack_import_0.jsx)(_agent_bundle_runtime__rspack_import_4/* .Agent.Result */.g.Result, {
         value: out,
-        children: /*#__PURE__*/ (0,react_jsx_runtime__rspack_import_0.jsx)(_agent_bundle_runtime__rspack_import_4/* .Agent.Text */.g6.Text, {
+        children: /*#__PURE__*/ (0,react_jsx_runtime__rspack_import_0.jsx)(_agent_bundle_runtime__rspack_import_4/* .Agent.Text */.g.Text, {
             children: (0,_core_codex_routes_js__rspack_import_2/* .resultText */.D6)(out)
         })
     });
@@ -14186,9 +14217,9 @@ __webpack_require__.r(__webpack_exports__);
     const out = await (0,_core_codex_routes_js__rspack_import_2/* .observeOperation */.gT)('wait', input, context.signal, (message)=>context.progress.report({
             message
         }));
-    return /*#__PURE__*/ (0,react_jsx_runtime__rspack_import_0.jsx)(_agent_bundle_runtime__rspack_import_4/* .Agent.Result */.g6.Result, {
+    return /*#__PURE__*/ (0,react_jsx_runtime__rspack_import_0.jsx)(_agent_bundle_runtime__rspack_import_4/* .Agent.Result */.g.Result, {
         value: out,
-        children: /*#__PURE__*/ (0,react_jsx_runtime__rspack_import_0.jsx)(_agent_bundle_runtime__rspack_import_4/* .Agent.Text */.g6.Text, {
+        children: /*#__PURE__*/ (0,react_jsx_runtime__rspack_import_0.jsx)(_agent_bundle_runtime__rspack_import_4/* .Agent.Text */.g.Text, {
             children: (0,_core_codex_routes_js__rspack_import_2/* .resultText */.D6)(out)
         })
     });
@@ -14253,9 +14284,9 @@ __webpack_require__.r(__webpack_exports__);
     const out = await (0,_core_codex_routes_js__rspack_import_2/* .observeOperation */.gT)('watch', input, context.signal, (message)=>context.progress.report({
             message
         }));
-    return /*#__PURE__*/ (0,react_jsx_runtime__rspack_import_0.jsx)(_agent_bundle_runtime__rspack_import_4/* .Agent.Result */.g6.Result, {
+    return /*#__PURE__*/ (0,react_jsx_runtime__rspack_import_0.jsx)(_agent_bundle_runtime__rspack_import_4/* .Agent.Result */.g.Result, {
         value: out,
-        children: /*#__PURE__*/ (0,react_jsx_runtime__rspack_import_0.jsx)(_agent_bundle_runtime__rspack_import_4/* .Agent.Text */.g6.Text, {
+        children: /*#__PURE__*/ (0,react_jsx_runtime__rspack_import_0.jsx)(_agent_bundle_runtime__rspack_import_4/* .Agent.Text */.g.Text, {
             children: (0,_core_codex_routes_js__rspack_import_2/* .resultText */.D6)(out)
         })
     });
@@ -14319,9 +14350,9 @@ __webpack_require__.r(__webpack_exports__);
     }
 }, async (input)=>{
     const out = await (0,_core_relay_routes_js__rspack_import_2/* .bridgeOperation */.n1)('startBinding', input, await (0,_agent_bundle_runtime__rspack_import_3/* .agent */.MA)());
-    return /*#__PURE__*/ (0,react_jsx_runtime__rspack_import_0.jsx)(_agent_bundle_runtime__rspack_import_4/* .Agent.Result */.g6.Result, {
+    return /*#__PURE__*/ (0,react_jsx_runtime__rspack_import_0.jsx)(_agent_bundle_runtime__rspack_import_4/* .Agent.Result */.g.Result, {
         value: out,
-        children: /*#__PURE__*/ (0,react_jsx_runtime__rspack_import_0.jsx)(_agent_bundle_runtime__rspack_import_4/* .Agent.Text */.g6.Text, {
+        children: /*#__PURE__*/ (0,react_jsx_runtime__rspack_import_0.jsx)(_agent_bundle_runtime__rspack_import_4/* .Agent.Text */.g.Text, {
             children: JSON.stringify(out)
         })
     });
@@ -14369,9 +14400,9 @@ __webpack_require__.r(__webpack_exports__);
     }
 }, async (input)=>{
     const out = await (0,_core_relay_routes_js__rspack_import_2/* .bridgeOperation */.n1)('status', input, await (0,_agent_bundle_runtime__rspack_import_3/* .agent */.MA)());
-    return /*#__PURE__*/ (0,react_jsx_runtime__rspack_import_0.jsx)(_agent_bundle_runtime__rspack_import_4/* .Agent.Result */.g6.Result, {
+    return /*#__PURE__*/ (0,react_jsx_runtime__rspack_import_0.jsx)(_agent_bundle_runtime__rspack_import_4/* .Agent.Result */.g.Result, {
         value: out,
-        children: /*#__PURE__*/ (0,react_jsx_runtime__rspack_import_0.jsx)(_agent_bundle_runtime__rspack_import_4/* .Agent.Text */.g6.Text, {
+        children: /*#__PURE__*/ (0,react_jsx_runtime__rspack_import_0.jsx)(_agent_bundle_runtime__rspack_import_4/* .Agent.Text */.g.Text, {
             children: JSON.stringify(out)
         })
     });
@@ -14422,9 +14453,9 @@ __webpack_require__.r(__webpack_exports__);
     }
 }, async (input)=>{
     const out = await (0,_core_relay_routes_js__rspack_import_2/* .bridgeOperation */.n1)('stop', input, await (0,_agent_bundle_runtime__rspack_import_3/* .agent */.MA)());
-    return /*#__PURE__*/ (0,react_jsx_runtime__rspack_import_0.jsx)(_agent_bundle_runtime__rspack_import_4/* .Agent.Result */.g6.Result, {
+    return /*#__PURE__*/ (0,react_jsx_runtime__rspack_import_0.jsx)(_agent_bundle_runtime__rspack_import_4/* .Agent.Result */.g.Result, {
         value: out,
-        children: /*#__PURE__*/ (0,react_jsx_runtime__rspack_import_0.jsx)(_agent_bundle_runtime__rspack_import_4/* .Agent.Text */.g6.Text, {
+        children: /*#__PURE__*/ (0,react_jsx_runtime__rspack_import_0.jsx)(_agent_bundle_runtime__rspack_import_4/* .Agent.Text */.g.Text, {
             children: JSON.stringify(out)
         })
     });
@@ -14502,9 +14533,9 @@ __webpack_require__.r(__webpack_exports__);
     }
 }, async (input)=>{
     const out = await (0,_core_relay_routes_js__rspack_import_2/* .bridgeOperation */.n1)('respond', input, await (0,_agent_bundle_runtime__rspack_import_3/* .agent */.MA)());
-    return /*#__PURE__*/ (0,react_jsx_runtime__rspack_import_0.jsx)(_agent_bundle_runtime__rspack_import_4/* .Agent.Result */.g6.Result, {
+    return /*#__PURE__*/ (0,react_jsx_runtime__rspack_import_0.jsx)(_agent_bundle_runtime__rspack_import_4/* .Agent.Result */.g.Result, {
         value: out,
-        children: /*#__PURE__*/ (0,react_jsx_runtime__rspack_import_0.jsx)(_agent_bundle_runtime__rspack_import_4/* .Agent.Text */.g6.Text, {
+        children: /*#__PURE__*/ (0,react_jsx_runtime__rspack_import_0.jsx)(_agent_bundle_runtime__rspack_import_4/* .Agent.Text */.g.Text, {
             children: JSON.stringify(out)
         })
     });
@@ -14517,6 +14548,120 @@ __webpack_require__.d(__webpack_exports__, {
 });
 
 
+},
+"./src/mcp/grok-bot/tools/gbot_grok_approvals.tsx"(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
+__webpack_require__.r(__webpack_exports__);
+/* import */ var react_jsx_runtime__rspack_import_0 = __webpack_require__("./node_modules/react/jsx-runtime.react-server.js");
+/* import */ var _agent_bundle_runtime__rspack_import_3 = __webpack_require__("./node_modules/@agent-bundle/runtime/dist/506.js");
+/* import */ var agent_bundle_routes__rspack_import_1 = __webpack_require__("./node_modules/agent-bundle/dist/routes.js");
+/* import */ var _core_grok_approval_routes_js__rspack_import_2 = __webpack_require__("./src/core/grok-approval-routes.ts");
+
+
+
+
+
+/* export default */ const __rspack_default_export = ((0,agent_bundle_routes__rspack_import_1/* .defineTool */.uO)({
+    title: 'Pending Grok approvals',
+    description: 'List pending auto-review and local-tool approval cards in the latest 200 entries for a Grok bot. Older or unsupported requests require the owning Grok UI.',
+    annotations: {
+        readOnlyHint: true
+    },
+    inputSchema: _core_grok_approval_routes_js__rspack_import_2/* .listSchema */.cE,
+    resultSchema: _core_grok_approval_routes_js__rspack_import_2/* .resultSchema */.FD,
+    inputJsonSchema: {
+        type: 'object',
+        properties: {
+            target: {
+                type: 'string'
+            }
+        },
+        required: [
+            'target'
+        ],
+        additionalProperties: false
+    }
+}, async (input)=>{
+    const out = await (0,_core_grok_approval_routes_js__rspack_import_2/* .listOperation */.gi)(input);
+    return /*#__PURE__*/ (0,react_jsx_runtime__rspack_import_0.jsx)(_agent_bundle_runtime__rspack_import_3/* .Agent.Result */.g.Result, {
+        value: out,
+        children: /*#__PURE__*/ (0,react_jsx_runtime__rspack_import_0.jsx)(_agent_bundle_runtime__rspack_import_3/* .Agent.Text */.g.Text, {
+            children: JSON.stringify(out)
+        })
+    });
+}));
+
+__webpack_require__.d(__webpack_exports__, {
+  inputSchema: () => (/* reexport safe */ _core_grok_approval_routes_js__rspack_import_2.cE)
+}, {
+  "default": __rspack_default_export
+});
+
+
+},
+"./src/mcp/grok-bot/tools/gbot_grok_respond.tsx"(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
+__webpack_require__.r(__webpack_exports__);
+/* import */ var react_jsx_runtime__rspack_import_0 = __webpack_require__("./node_modules/react/jsx-runtime.react-server.js");
+/* import */ var _agent_bundle_runtime__rspack_import_3 = __webpack_require__("./node_modules/@agent-bundle/runtime/dist/506.js");
+/* import */ var agent_bundle_routes__rspack_import_1 = __webpack_require__("./node_modules/agent-bundle/dist/routes.js");
+/* import */ var _core_grok_approval_routes_js__rspack_import_2 = __webpack_require__("./src/core/grok-approval-routes.ts");
+
+
+
+
+
+/* export default */ const __rspack_default_export = ((0,agent_bundle_routes__rspack_import_1/* .defineTool */.uO)({
+    title: 'Respond to Grok approval',
+    description: 'Only after an explicit user decision: accept one current Grok approval once or decline it. Exact target, entryId and approval requestId required. Never auto-approve or grant persistent permissions. Success acknowledges response delivery, not execution.',
+    annotations: {
+        readOnlyHint: false
+    },
+    inputSchema: _core_grok_approval_routes_js__rspack_import_2/* .respondSchema */.v1,
+    resultSchema: _core_grok_approval_routes_js__rspack_import_2/* .resultSchema */.FD,
+    inputJsonSchema: {
+        type: 'object',
+        properties: {
+            target: {
+                type: 'string'
+            },
+            entryId: {
+                type: 'string'
+            },
+            requestId: {
+                type: 'string'
+            },
+            decision: {
+                type: 'string',
+                enum: [
+                    'accept',
+                    'decline'
+                ]
+            }
+        },
+        required: [
+            'target',
+            'entryId',
+            'requestId',
+            'decision'
+        ],
+        additionalProperties: false
+    }
+}, async (input)=>{
+    const out = await (0,_core_grok_approval_routes_js__rspack_import_2/* .respondOperation */.lr)(input);
+    return /*#__PURE__*/ (0,react_jsx_runtime__rspack_import_0.jsx)(_agent_bundle_runtime__rspack_import_3/* .Agent.Result */.g.Result, {
+        value: out,
+        children: /*#__PURE__*/ (0,react_jsx_runtime__rspack_import_0.jsx)(_agent_bundle_runtime__rspack_import_3/* .Agent.Text */.g.Text, {
+            children: JSON.stringify(out)
+        })
+    });
+}));
+
+__webpack_require__.d(__webpack_exports__, {
+  inputSchema: () => (/* reexport safe */ _core_grok_approval_routes_js__rspack_import_2.v1)
+}, {
+  "default": __rspack_default_export
+});
+
+
 },
 "./src/mcp/grok-bot/tools/gbot_send.tsx"(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
 __webpack_require__.r(__webpack_exports__);
@@ -14582,9 +14727,9 @@ __webpack_require__.r(__webpack_exports__);
     }
 }, async (input)=>{
     const out = await (0,_core_relay_routes_js__rspack_import_2/* .grokSendOperation */.bv)(input, await (0,_agent_bundle_runtime__rspack_import_3/* .agent */.MA)());
-    return /*#__PURE__*/ (0,react_jsx_runtime__rspack_import_0.jsx)(_agent_bundle_runtime__rspack_import_4/* .Agent.Result */.g6.Result, {
+    return /*#__PURE__*/ (0,react_jsx_runtime__rspack_import_0.jsx)(_agent_bundle_runtime__rspack_import_4/* .Agent.Result */.g.Result, {
         value: out,
-        children: /*#__PURE__*/ (0,react_jsx_runtime__rspack_import_0.jsx)(_agent_bundle_runtime__rspack_import_4/* .Agent.Text */.g6.Text, {
+        children: /*#__PURE__*/ (0,react_jsx_runtime__rspack_import_0.jsx)(_agent_bundle_runtime__rspack_import_4/* .Agent.Text */.g.Text, {
             children: out.replyRoute.mode === 'auto' ? `Delivery ${out.delivery}; replies will arrive in Codex thread ${out.replyRoute.threadId}. Continue work; no polling needed.` : `Delivery ${out.delivery}${out.delivery === 'unknown' ? ' (no receipt; check the thread before resending)' : ''}; read the reply with gbot_thread.`
         })
     });
@@ -14676,9 +14821,9 @@ const inputSchema = zod__rspack_import_3/* .object */.Ikc({
         summary
     };
     if (!full) {
-        return /*#__PURE__*/ (0,react_jsx_runtime__rspack_import_0.jsx)(_agent_bundle_runtime__rspack_import_4/* .Agent.Result */.g6.Result, {
+        return /*#__PURE__*/ (0,react_jsx_runtime__rspack_import_0.jsx)(_agent_bundle_runtime__rspack_import_4/* .Agent.Result */.g.Result, {
             value: receipt,
-            children: /*#__PURE__*/ (0,react_jsx_runtime__rspack_import_0.jsx)(_agent_bundle_runtime__rspack_import_4/* .Agent.Text */.g6.Text, {
+            children: /*#__PURE__*/ (0,react_jsx_runtime__rspack_import_0.jsx)(_agent_bundle_runtime__rspack_import_4/* .Agent.Text */.g.Text, {
                 children: summary
             })
         });
@@ -14687,9 +14832,9 @@ const inputSchema = zod__rspack_import_3/* .object */.Ikc({
         ...receipt,
         entries
     };
-    return /*#__PURE__*/ (0,react_jsx_runtime__rspack_import_0.jsx)(_agent_bundle_runtime__rspack_import_4/* .Agent.Result */.g6.Result, {
+    return /*#__PURE__*/ (0,react_jsx_runtime__rspack_import_0.jsx)(_agent_bundle_runtime__rspack_import_4/* .Agent.Result */.g.Result, {
         value: value,
-        children: /*#__PURE__*/ (0,react_jsx_runtime__rspack_import_0.jsx)(_agent_bundle_runtime__rspack_import_4/* .Agent.Text */.g6.Text, {
+        children: /*#__PURE__*/ (0,react_jsx_runtime__rspack_import_0.jsx)(_agent_bundle_runtime__rspack_import_4/* .Agent.Text */.g.Text, {
             children: summary
         })
     });
@@ -15101,50 +15246,11 @@ const Agent = Object.freeze({
     Result: AgentResult,
     Text: AgentText
 });
-const Result = ({ children })=>createElement('agent-hook-result', null, children);
-const AdditionalContext = ({ children })=>createElement('agent-hook-additional-context', null, children);
-const Hook = (/* unused pure expression or super */ null && ({
-    AdditionalContext: AdditionalContext,
-    Result: Result
-}));
-const McpResult = ({ _meta, children, isError, structuredContent })=>createElement('mcp-result', {
-        _meta,
-        isError,
-        structuredContent
-    }, children);
-const McpText = ({ children })=>createElement('mcp-text', null, children);
-const McpImage = ({ data, mimeType })=>createElement('mcp-image', {
-        data,
-        mimeType
-    });
-const McpAudio = ({ data, mimeType })=>createElement('mcp-audio', {
-        data,
-        mimeType
-    });
-const McpResourceLink = ({ mimeType, name, uri })=>createElement('mcp-resource-link', {
-        mimeType,
-        name,
-        uri
-    });
-const McpEmbeddedResource = ({ blob, children, mimeType, text, uri })=>createElement('mcp-embedded-resource', {
-        blob,
-        mimeType,
-        text,
-        uri
-    }, children);
-const Mcp = (/* unused pure expression or super */ null && ({
-    Audio: McpAudio,
-    EmbeddedResource: McpEmbeddedResource,
-    Image: McpImage,
-    ResourceLink: McpResourceLink,
-    Result: McpResult,
-    Text: McpText
-}));
 
 
 __webpack_require__.d(__webpack_exports__, {
 }, {
-  g6: Agent
+  g: Agent
 });
 
 
@@ -17164,7 +17270,7 @@ function strictObject(shape, params) {
         type: "object",
         shape,
         catchall: never(),
-        ...util.normalizeParams(params),
+        ..._core_index_js__rspack_import_4/* .normalizeParams */.A2(params),
     });
 }
 // looseObject
@@ -17798,6 +17904,7 @@ __webpack_require__.d(__webpack_exports__, {
   euz: () => (literal),
   g1P: () => (record),
   k5n: () => (_enum),
+  rej: () => (strictObject),
   zMY: () => (boolean)
 });
 
@@ -27079,10 +27186,10 @@ function listDesktopProcesses(timeoutMs = DESKTOP_PROCESS_LIST_TIMEOUT_MS) {
     const lines = Array.isArray(listProcesses) ? listProcesses : String(listProcesses ?? "").split(/\r?\n/);
     for (const line of lines){
         if (!/app-server/.test(line)) continue;
-        // Desktop's bundled binary, Mac or Windows-style separators with optional .exe.
+        // Desktop's bundled binary only (Mac/Windows separators, optional .exe).
+        // Do NOT match probe shells whose cmdline merely mentions ChatGPT.app +
+        // app-server + codex-app-tools — that false-positives MATCH2 / Scout noise.
         if (/ChatGPT\.app[\\/].*Resources[\\/]codex(\.exe)?(["'\s]|$)/.test(line)) return "private-stdio";
-        // Same app-server line owned by ChatGPT.app carrying the app-tools override.
-        if (/ChatGPT\.app/.test(line) && /(codex_app|mcp_servers\.codex_app|codex-app-tools)/.test(line)) return "private-stdio";
     }
     return "unknown";
 }
@@ -28769,10 +28876,12 @@ function socketStateOf(path) {
 },
 "./src/core/gateway.js"(__unused_rspack___webpack_module__, __webpack_exports__, __webpack_require__) {
 /* import */ var node_crypto__rspack_import_0 = __webpack_require__("node:crypto");
-/* import */ var _headers_js__rspack_import_4 = __webpack_require__("./src/core/headers.js");
+/* import */ var _headers_js__rspack_import_5 = __webpack_require__("./src/core/headers.js");
 /* import */ var _app_session_js__rspack_import_1 = __webpack_require__("./src/core/app-session.js");
 /* import */ var _store_js__rspack_import_2 = __webpack_require__("./src/core/store.js");
 /* import */ var _url_policy_js__rspack_import_3 = __webpack_require__("./src/core/url-policy.js");
+/* import */ var _grok_approvals_js__rspack_import_4 = __webpack_require__("./src/core/grok-approvals.js");
+
 
 
 
@@ -28822,7 +28931,7 @@ function gatewayOverride() {
                 kind: "gateway"
             }),
             gatewayToken: token,
-            gatewayHeaders: (0,_headers_js__rspack_import_4/* .headersFromEnv */.gx)()
+            gatewayHeaders: (0,_headers_js__rspack_import_5/* .headersFromEnv */.gx)()
         };
     }
     return null;
@@ -28843,7 +28952,7 @@ function sessionFromApp() {
             kind: "gateway"
         }),
         gatewayToken: loaded.gatewayToken,
-        gatewayHeaders: (0,_headers_js__rspack_import_4/* .mergeGatewayHeaders */.bQ)((0,_headers_js__rspack_import_4/* .normalizeHeaderMap */.dk)(loaded.headers), (0,_headers_js__rspack_import_4/* .headersFromEnv */.gx)())
+        gatewayHeaders: (0,_headers_js__rspack_import_5/* .mergeGatewayHeaders */.bQ)((0,_headers_js__rspack_import_5/* .normalizeHeaderMap */.dk)(loaded.headers), (0,_headers_js__rspack_import_5/* .headersFromEnv */.gx)())
     };
 }
 function hasGatewayAuth() {
@@ -28903,7 +29012,7 @@ async function ensureSandbox(accessToken, { signal } = {}) {
             method: "POST",
             redirect: "error",
             signal: gatewayDeadline(signal),
-            headers: (0,_headers_js__rspack_import_4/* .ensureSandboxHeaders */._6)(accessToken),
+            headers: (0,_headers_js__rspack_import_5/* .ensureSandboxHeaders */._6)(accessToken),
             body: "{}"
         });
         body = await readJson(res);
@@ -28929,7 +29038,7 @@ async function ensureSandbox(accessToken, { signal } = {}) {
             kind: "gateway"
         }),
         gatewayToken: String(gatewayToken),
-        gatewayHeaders: (0,_headers_js__rspack_import_4/* .mergeGatewayHeaders */.bQ)((0,_headers_js__rspack_import_4/* .headersFromEnsureSandbox */.Ew)(body), (0,_headers_js__rspack_import_4/* .headersFromEnv */.gx)())
+        gatewayHeaders: (0,_headers_js__rspack_import_5/* .mergeGatewayHeaders */.bQ)((0,_headers_js__rspack_import_5/* .headersFromEnsureSandbox */.Ew)(body), (0,_headers_js__rspack_import_5/* .headersFromEnv */.gx)())
     };
 }
 async function connectGateway({ signal } = {}) {
@@ -28959,7 +29068,7 @@ async function gatewayCall(session, method, body = {}, { signal } = {}) {
         method: "POST",
         redirect: "error",
         signal: gatewayDeadline(prompt ? undefined : signal),
-        headers: (0,_headers_js__rspack_import_4/* .requestHeaders */.A1)(session),
+        headers: (0,_headers_js__rspack_import_5/* .requestHeaders */.A1)(session),
         body: JSON.stringify(body)
     };
     assertGatewayActive(signal); // Final synchronous boundary before transmission.
@@ -29226,14 +29335,115 @@ async function getThread(session, ref, rootId) {
         thread: data
     };
 }
+async function listGrokApprovals(session, ref) {
+    const { target, transcript } = await getTranscriptTail(session, ref, 200);
+    if (!Array.isArray(transcript?.entries) || transcript.entries.length > 200) throw new GatewayError("Invalid approval transcript coverage");
+    return {
+        target: {
+            id: target.id,
+            name: target.name
+        },
+        approvals: transcript.entries.map(_grok_approvals_js__rspack_import_4/* .grokApproval */.Ny).filter(Boolean),
+        coverage: "Latest 200 transcript entries only; older requests require the owning Grok UI."
+    };
+}
+async function respondGrokApproval(session, ref, input) {
+    const { entryId, requestId, decision } = _grok_approvals_js__rspack_import_4/* .grokApprovalResponseSchema.parse */.T5.parse({
+        ...input,
+        target: ref
+    });
+    const { target, approvals } = await listGrokApprovals(session, ref);
+    const matches = approvals.filter((card)=>card.entryId === entryId && card.requestId === requestId);
+    if (matches.length !== 1) throw new GatewayError("Stale, foreign or unsupported Grok approval; refresh pending requests or use the owning Grok UI");
+    const approval = matches[0];
+    if (decision === "accept" && approval.truncated) throw new GatewayError("Approval details are truncated; acceptance requires the owning Grok UI");
+    const local = approval.type === "local-tool-permission";
+    await gatewayCall(session, local ? "resolveLocalToolPermission" : "resolveAutoReviewApproval", {
+        agentId: target.id,
+        entryId,
+        requestId,
+        resolution: local ? decision === "accept" ? "allow-once" : "deny" : decision === "accept" ? "approved" : "denied"
+    });
+    return {
+        target,
+        entryId,
+        requestId,
+        decision,
+        delivery: "accepted"
+    };
+}
 
 __webpack_require__.d(__webpack_exports__, {
   LV: () => (sendPrompt),
+  MI: () => (listGrokApprovals),
+  OR: () => (respondGrokApproval),
   Vq: () => (connectGateway),
   bA: () => (getTranscriptTail)
 });
 
 
+},
+"./src/core/grok-approvals.js"(__unused_rspack___webpack_module__, __webpack_exports__, __webpack_require__) {
+/* import */ var zod__rspack_import_1 = __webpack_require__("./node_modules/zod/v4/classic/schemas.js");
+/* import */ var _url_policy_js__rspack_import_0 = __webpack_require__("./src/core/url-policy.js");
+
+
+const id = zod__rspack_import_1/* .string */.YjP().min(1).max(1024);
+const grokApprovalResponseSchema = zod__rspack_import_1/* .strictObject */.rej({
+    target: id,
+    entryId: id,
+    requestId: id,
+    decision: zod__rspack_import_1/* ["enum"] */.k5n([
+        "accept",
+        "decline"
+    ])
+});
+function grokApproval(entry) {
+    if (entry?.kind !== "send-message") return null;
+    const type = entry.message?.type;
+    const card = type === "auto-review-approval" ? entry.message.approval : type === "local-tool-permission" ? entry.message.ask : null;
+    if (card?.status !== "pending" || !id.safeParse(card.requestId).success || !id.safeParse(entry.id).success) return null;
+    const details = {};
+    let truncated = false;
+    for (const key of [
+        "reason",
+        "command",
+        "summary",
+        "action",
+        "description",
+        "target",
+        "machineId",
+        "surface",
+        "workingDirectory"
+    ]){
+        if (typeof card[key] !== "string") continue;
+        const text = (0,_url_policy_js__rspack_import_0/* .redactSecrets */.fp)(card[key]);
+        truncated ||= text.length > 2048;
+        details[key] = text.slice(0, 2048);
+    }
+    return {
+        entryId: entry.id,
+        requestId: card.requestId,
+        type,
+        ...details,
+        truncated
+    };
+}
+function grokApprovalNotice(entry, target) {
+    const approval = grokApproval(entry);
+    return approval ? `Grok approval pending. Requires an explicit user decision; never approve automatically.\n${JSON.stringify({
+        botTarget: target,
+        ...approval
+    })}\nUse gbot_grok_respond with target=${JSON.stringify(target)}, entryId, requestId and decision accept (once) or decline.${approval.truncated ? " Details are truncated; acceptance requires the owning Grok UI." : ""} A chat reply is not authorization.` : null;
+}
+
+__webpack_require__.d(__webpack_exports__, {
+  Ny: () => (grokApproval)
+}, {
+  T5: grokApprovalResponseSchema
+});
+
+
 },
 "./src/core/headers.js"(__unused_rspack___webpack_module__, __webpack_exports__, __webpack_require__) {
 function normalizeHeaderMap(obj) {
@@ -29529,7 +29739,10 @@ function relayProfile(env = process.env) {
         "GROK_BOT_ALLOW_LOCAL_GATEWAY",
         "GROK_BOT_ALLOW_ANY_GATEWAY",
         "GROK_BOT_TEST",
-        "NODE_ENV"
+        "NODE_ENV",
+        // Secret Service credentials depend on the caller's desktop session.
+        "DBUS_SESSION_BUS_ADDRESS",
+        "DISPLAY"
     ];
     return digest(JSON.stringify([
         (0,node_path__rspack_import_2.resolve)((0,_codex_bridge_js__rspack_import_3/* .codexSocketPath */.ql)(env)),
@@ -30108,7 +30321,7 @@ __webpack_require__.d(__webpack_exports__, {
 
 },
 "./package.json"(module) {
-module.exports = {"rE":"0.6.0"}
+module.exports = {"rE":"0.7.0"}
 
 },
 
@@ -30174,10 +30387,10 @@ __webpack_require__.r = (exports) => {
 var __webpack_exports__ = {};
 /* import */ var node_worker_threads__rspack_import_0 = __webpack_require__("node:worker_threads");
 /* import */ var react__rspack_import_1 = __webpack_require__("./node_modules/react/react.react-server.js");
-/* import */ var _agent_bundle_runtime_flight_server__rspack_import_16 = __webpack_require__("./node_modules/@agent-bundle/runtime/dist/flight/server.js");
-/* import */ var _agent_bundle_runtime__rspack_import_13 = __webpack_require__("./node_modules/@agent-bundle/runtime/dist/49.js");
-/* import */ var _agent_bundle_runtime__rspack_import_14 = __webpack_require__("./node_modules/@agent-bundle/runtime/dist/736.js");
-/* import */ var _agent_bundle_runtime__rspack_import_15 = __webpack_require__("./node_modules/@agent-bundle/runtime/dist/506.js");
+/* import */ var _agent_bundle_runtime_flight_server__rspack_import_18 = __webpack_require__("./node_modules/@agent-bundle/runtime/dist/flight/server.js");
+/* import */ var _agent_bundle_runtime__rspack_import_15 = __webpack_require__("./node_modules/@agent-bundle/runtime/dist/49.js");
+/* import */ var _agent_bundle_runtime__rspack_import_16 = __webpack_require__("./node_modules/@agent-bundle/runtime/dist/736.js");
+/* import */ var _agent_bundle_runtime__rspack_import_17 = __webpack_require__("./node_modules/@agent-bundle/runtime/dist/506.js");
 /* import */ var node_url__rspack_import_2 = __webpack_require__("node:url");
 /* import */ var _home_runner_work_grok_bot_cli_grok_bot_cli_src_mcp_grok_bot_tools_codex_send_tsx__rspack_import_3 = __webpack_require__("./src/mcp/grok-bot/tools/codex_send.tsx");
 /* import */ var _home_runner_work_grok_bot_cli_grok_bot_cli_src_mcp_grok_bot_tools_codex_threads_tsx__rspack_import_4 = __webpack_require__("./src/mcp/grok-bot/tools/codex_threads.tsx");
@@ -30187,8 +30400,10 @@ var __webpack_exports__ = {};
 /* import */ var _home_runner_work_grok_bot_cli_grok_bot_cli_src_mcp_grok_bot_tools_gbot_bridge_status_tsx__rspack_import_8 = __webpack_require__("./src/mcp/grok-bot/tools/gbot_bridge_status.tsx");
 /* import */ var _home_runner_work_grok_bot_cli_grok_bot_cli_src_mcp_grok_bot_tools_gbot_bridge_stop_tsx__rspack_import_9 = __webpack_require__("./src/mcp/grok-bot/tools/gbot_bridge_stop.tsx");
 /* import */ var _home_runner_work_grok_bot_cli_grok_bot_cli_src_mcp_grok_bot_tools_gbot_codex_respond_tsx__rspack_import_10 = __webpack_require__("./src/mcp/grok-bot/tools/gbot_codex_respond.tsx");
-/* import */ var _home_runner_work_grok_bot_cli_grok_bot_cli_src_mcp_grok_bot_tools_gbot_send_tsx__rspack_import_11 = __webpack_require__("./src/mcp/grok-bot/tools/gbot_send.tsx");
-/* import */ var _home_runner_work_grok_bot_cli_grok_bot_cli_src_mcp_grok_bot_tools_gbot_thread_tsx__rspack_import_12 = __webpack_require__("./src/mcp/grok-bot/tools/gbot_thread.tsx");
+/* import */ var _home_runner_work_grok_bot_cli_grok_bot_cli_src_mcp_grok_bot_tools_gbot_grok_approvals_tsx__rspack_import_11 = __webpack_require__("./src/mcp/grok-bot/tools/gbot_grok_approvals.tsx");
+/* import */ var _home_runner_work_grok_bot_cli_grok_bot_cli_src_mcp_grok_bot_tools_gbot_grok_respond_tsx__rspack_import_12 = __webpack_require__("./src/mcp/grok-bot/tools/gbot_grok_respond.tsx");
+/* import */ var _home_runner_work_grok_bot_cli_grok_bot_cli_src_mcp_grok_bot_tools_gbot_send_tsx__rspack_import_13 = __webpack_require__("./src/mcp/grok-bot/tools/gbot_send.tsx");
+/* import */ var _home_runner_work_grok_bot_cli_grok_bot_cli_src_mcp_grok_bot_tools_gbot_thread_tsx__rspack_import_14 = __webpack_require__("./src/mcp/grok-bot/tools/gbot_thread.tsx");
 
 
 
@@ -30211,22 +30426,26 @@ const route6 = Object.assign({}, Reflect.get(_home_runner_work_grok_bot_cli_grok
 
 const route7 = Object.assign({}, Reflect.get(_home_runner_work_grok_bot_cli_grok_bot_cli_src_mcp_grok_bot_tools_gbot_codex_respond_tsx__rspack_import_10, 'default'), _home_runner_work_grok_bot_cli_grok_bot_cli_src_mcp_grok_bot_tools_gbot_codex_respond_tsx__rspack_import_10);
 
-const route8 = Object.assign({}, Reflect.get(_home_runner_work_grok_bot_cli_grok_bot_cli_src_mcp_grok_bot_tools_gbot_send_tsx__rspack_import_11, 'default'), _home_runner_work_grok_bot_cli_grok_bot_cli_src_mcp_grok_bot_tools_gbot_send_tsx__rspack_import_11);
+const route8 = Object.assign({}, Reflect.get(_home_runner_work_grok_bot_cli_grok_bot_cli_src_mcp_grok_bot_tools_gbot_grok_approvals_tsx__rspack_import_11, 'default'), _home_runner_work_grok_bot_cli_grok_bot_cli_src_mcp_grok_bot_tools_gbot_grok_approvals_tsx__rspack_import_11);
+
+const route9 = Object.assign({}, Reflect.get(_home_runner_work_grok_bot_cli_grok_bot_cli_src_mcp_grok_bot_tools_gbot_grok_respond_tsx__rspack_import_12, 'default'), _home_runner_work_grok_bot_cli_grok_bot_cli_src_mcp_grok_bot_tools_gbot_grok_respond_tsx__rspack_import_12);
+
+const route10 = Object.assign({}, Reflect.get(_home_runner_work_grok_bot_cli_grok_bot_cli_src_mcp_grok_bot_tools_gbot_send_tsx__rspack_import_13, 'default'), _home_runner_work_grok_bot_cli_grok_bot_cli_src_mcp_grok_bot_tools_gbot_send_tsx__rspack_import_13);
 
-const route9 = Object.assign({}, Reflect.get(_home_runner_work_grok_bot_cli_grok_bot_cli_src_mcp_grok_bot_tools_gbot_thread_tsx__rspack_import_12, 'default'), _home_runner_work_grok_bot_cli_grok_bot_cli_src_mcp_grok_bot_tools_gbot_thread_tsx__rspack_import_12);
+const route11 = Object.assign({}, Reflect.get(_home_runner_work_grok_bot_cli_grok_bot_cli_src_mcp_grok_bot_tools_gbot_thread_tsx__rspack_import_14, 'default'), _home_runner_work_grok_bot_cli_grok_bot_cli_src_mcp_grok_bot_tools_gbot_thread_tsx__rspack_import_14);
 // Generated routes contain only intrinsic Agent protocol elements, so no client references exist.
 globalThis.__rspack_rsc_manifest__ ??= Object.freeze({
     clientManifest: Object.freeze({})
 });
 if (node_worker_threads__rspack_import_0.parentPort === null) throw new Error('Generated Flight worker requires a parent port.');
 process.stdout.write = process.stderr.write.bind(process.stderr);
-const ARTIFACT_EPOCH = "gbot@0.6.0";
+const ARTIFACT_EPOCH = "gbot@0.7.0";
 const processLifetime = {
     hits: 0,
     instanceId: crypto.randomUUID(),
     pid: process.pid
 };
-const pluginRoot = (0,_agent_bundle_runtime__rspack_import_13/* .resolvePluginRoot */.E7)({
+const pluginRoot = (0,_agent_bundle_runtime__rspack_import_15/* .resolvePluginRoot */.E7)({
     fallback: (0,node_url__rspack_import_2.fileURLToPath)(new URL('..', import.meta.url)),
     stateAnchor: 'user-data'
 });
@@ -30581,6 +30800,74 @@ const routes = Object.freeze({
         name: "gbot_codex_respond",
         serverId: "mcp:grok-bot"
     }),
+    "tool:grok-bot/gbot_grok_approvals": Object.freeze({
+        config: {
+            "annotations": {
+                "readOnlyHint": true
+            },
+            "description": "List pending auto-review and local-tool approval cards in the latest 200 entries for a Grok bot. Older or unsupported requests require the owning Grok UI.",
+            "inputJsonSchema": {
+                "additionalProperties": false,
+                "properties": {
+                    "target": {
+                        "type": "string"
+                    }
+                },
+                "required": [
+                    "target"
+                ],
+                "type": "object"
+            },
+            "title": "Pending Grok approvals"
+        },
+        id: "tool:grok-bot/gbot_grok_approvals",
+        kind: "tool",
+        module: route8,
+        name: "gbot_grok_approvals",
+        serverId: "mcp:grok-bot"
+    }),
+    "tool:grok-bot/gbot_grok_respond": Object.freeze({
+        config: {
+            "annotations": {
+                "readOnlyHint": false
+            },
+            "description": "Only after an explicit user decision: accept one current Grok approval once or decline it. Exact target, entryId and approval requestId required. Never auto-approve or grant persistent permissions. Success acknowledges response delivery, not execution.",
+            "inputJsonSchema": {
+                "additionalProperties": false,
+                "properties": {
+                    "decision": {
+                        "enum": [
+                            "accept",
+                            "decline"
+                        ],
+                        "type": "string"
+                    },
+                    "entryId": {
+                        "type": "string"
+                    },
+                    "requestId": {
+                        "type": "string"
+                    },
+                    "target": {
+                        "type": "string"
+                    }
+                },
+                "required": [
+                    "target",
+                    "entryId",
+                    "requestId",
+                    "decision"
+                ],
+                "type": "object"
+            },
+            "title": "Respond to Grok approval"
+        },
+        id: "tool:grok-bot/gbot_grok_respond",
+        kind: "tool",
+        module: route9,
+        name: "gbot_grok_respond",
+        serverId: "mcp:grok-bot"
+    }),
     "tool:grok-bot/gbot_send": Object.freeze({
         config: {
             "annotations": {
@@ -30633,7 +30920,7 @@ const routes = Object.freeze({
         },
         id: "tool:grok-bot/gbot_send",
         kind: "tool",
-        module: route8,
+        module: route10,
         name: "gbot_send",
         serverId: "mcp:grok-bot"
     }),
@@ -30674,7 +30961,7 @@ const routes = Object.freeze({
         },
         id: "tool:grok-bot/gbot_thread",
         kind: "tool",
-        module: route9,
+        module: route11,
         name: "gbot_thread",
         serverId: "mcp:grok-bot"
     })
@@ -30722,7 +31009,7 @@ const render = async (message)=>{
     };
     try {
         const plugin = message.plugin ?? pluginRoot.identity;
-        await (0,_agent_bundle_runtime__rspack_import_14/* .runAgentRequest */.iC)({
+        await (0,_agent_bundle_runtime__rspack_import_16/* .runAgentRequest */.iC)({
             ...message.actor === undefined ? {} : {
                 actor: message.actor
             },
@@ -30736,7 +31023,7 @@ const render = async (message)=>{
                 operationId: route.id,
                 surface: route.name
             },
-            lineage: message.lineage ?? (0,_agent_bundle_runtime__rspack_import_14/* .unavailable */.hU)('not-provided'),
+            lineage: message.lineage ?? (0,_agent_bundle_runtime__rspack_import_16/* .unavailable */.hU)('not-provided'),
             plugin,
             progress: {
                 report: async (update)=>{
@@ -30752,7 +31039,7 @@ const render = async (message)=>{
                 session: message.session
             },
             signal: controller.signal,
-            terminal: message.terminal ?? (0,_agent_bundle_runtime__rspack_import_14/* .unavailable */.hU)('not-provided'),
+            terminal: message.terminal ?? (0,_agent_bundle_runtime__rspack_import_16/* .unavailable */.hU)('not-provided'),
             ...message.workspace === undefined ? {} : {
                 workspace: message.workspace
             }
@@ -30787,10 +31074,10 @@ const render = async (message)=>{
                 type: 'observed-render-start'
             });
             const renderStartedAt = performance.now();
-            const element = validationError === undefined ? composeLayouts(observedRoute, props, controller.signal) : /*#__PURE__*/ (0,react__rspack_import_1.createElement)(_agent_bundle_runtime__rspack_import_15/* .Agent.Result */.g6.Result, null, /*#__PURE__*/ (0,react__rspack_import_1.createElement)(_agent_bundle_runtime__rspack_import_15/* .Agent.Error */.g6.Error, {
+            const element = validationError === undefined ? composeLayouts(observedRoute, props, controller.signal) : /*#__PURE__*/ (0,react__rspack_import_1.createElement)(_agent_bundle_runtime__rspack_import_17/* .Agent.Result */.g.Result, null, /*#__PURE__*/ (0,react__rspack_import_1.createElement)(_agent_bundle_runtime__rspack_import_17/* .Agent.Error */.g.Error, {
                 code: 'invalid-input'
             }, `Input validation error: ${validationError instanceof Error ? validationError.message : String(validationError)}`));
-            const flight = (0,_agent_bundle_runtime_flight_server__rspack_import_16/* .renderAgentFlight */.y)(element, {
+            const flight = (0,_agent_bundle_runtime_flight_server__rspack_import_18/* .renderAgentFlight */.y)(element, {
                 signal: controller.signal
             });
             const reader = flight.getReader();