grokbot-control 0.0.0-stage → 0.1.3

package/docs/protocol/auth-flow.md

@@ -0,0 +1,51 @@
+# Auth flow (independent Cursor browser login)
+
+Implementation: `src/auth/provider.ts`, `src/auth/store.ts`, `src/ops/auth.ts`. Contract table and CLI/MCP
+commands: [../protocol-map.md#auth-independent-cursor-browser-login](../protocol-map.md). This page records
+**where the evidence lives** so it can be re-found in a new build.
+
+| Step | Behaviour | Stable anchor (search the extracted bundle) | 0.79.2 location (A=main-app.cjs) | Level |
+|---|---|---|---|---|
+| Challenge | verifier = base64url(32 random bytes); challenge = base64url(sha256(verifier)); uuid | `randomBytes(32)` next to `"/loginDeepControl"` | fn `Rdn` (prettified A:38644) | S, O |
+| Login URL | `{website}/loginDeepControl?challenge&uuid&mode=login&redirectTarget=<t>[&supportsSelectedTeamLogin=true]`; website default `https://cursor.com` | `"/loginDeepControl"`, `"redirectTarget"` | `Rdn`; library default target `cli` (A:38845) | S, O, **L** (`cli`, 2026-11-07) |
+| Poll | `GET {api}/auth/poll?uuid=&verifier=`; 404 = pending; 1 s×1.2^i ≤ 10 s; ≤ 150 tries; 3 consecutive non-404 → stop | `` `${n}/auth/poll` `` | fns `Aze`, `xdn`, `Odn` | S, O, **L** |
+| Policy denial | 403 `{error:"sign_in_policy_violation"}` | `sign_in_policy_violation` | constant `Nh` | S, O |
+| Result | `{accessToken, refreshToken}`; xAI identity `{xaiAccessToken, …}` → unsupported here | `xaiAccessToken` | fns `Cdn`, `mze` | S, O, **L** (cursor kind) |
+| Refresh | `POST new URL("/oauth/token", backend)` JSON `{client_id, grant_type:"refresh_token", refresh_token}`; response `{access_token?, refresh_token?, shouldLogout?, error?}`; refresh 300 s before JWT `exp` | `"/oauth/token"` | method `runRefreshAccessToken`; schema `zWe` | S, O (not L) |
+| client_id | App picks a **public** id per backend host (dev vs prod) | look near `"/oauth/token"` → `authClientIdentityFor` → selector in main-core | main-core selector (C:35866-35869) | S |
+| API-key exchange | `POST /auth/exchange_user_api_key` (not implemented here) | `/auth/exchange_user_api_key` | fn `Pdn` | S |
+
+Boundaries:
+- **client_id is not embedded** in this repo; refresh requires `GBT_OAUTH_CLIENT_ID`. Which public id a third-party
+  tool should use is a policy decision for the user, not something to copy blindly from the bundle.
+- 0.79.2 main-app.cjs also contains a **second login implementation** (anchor `loginPollUrl`, `startLogin()` with a
+  `"delivered"` result, near offset ~1.14 MB). Not analysed; check it first on the next version bump.
+- Device policy header `x-cursor-mdm-signin-policy` and App client headers are not sent/forged.
+- App credential storage (`sand-secrets.json` under Electron userData) is documented only so it is NOT reused.
+
+
+## Token auto-refresh hardening (t47u)
+
+State machine (minimal, App-aligned):
+
+1. **Provenance**: stored credentials bind `kind`, `login_kind`, `credential_source`, backend, `refresh_endpoint`,
+   optional `client_id` / issuer / account subject / `session_id` / `revision` / expiry. `client_id` comes from
+   `GBT_OAUTH_CLIENT_ID` or a login-persisted binding — never hardcoded, never guessed from JWT. Legacy files
+   without binding require explicit config (and optional `GBT_AUTH_CONFIRM_MIGRATE=1`).
+2. **getAccessToken**: missing/illegal exp, within 5 min of exp, or `force` → refresh; else return. In-process
+   singleflight + cross-process credential lock; re-read under lock; reuse peer refresh.
+3. **Refresh POST**: fixed HTTPS `{backend}/oauth/token`, `redirect:error`, 20s deadline, schema requires
+   non-empty `access_token`; absent `refresh_token` keeps old. Atomic save only if session/account/revision
+   unchanged (CAS).
+4. **Failures**: network/timeout/5xx/429 keep creds + per-session cooldown; caller deadline does not abort the
+   IdP exchange (background writeback; `rpc_dispatched=unknown`). Fallback when old token still valid (also for
+   unconfigured/client_mismatch/malformed/redirect — not only `retryable`). `shouldLogout`/policy: rescue newer
+   pair under lock, else conditional clear — never fallback revoked token; `invalid_grant` after an ambiguous
+   timeout keeps creds. New access JWT `sub` must match expected account subject or the rotation is refused.
+5. **logout/login/save** share `withCredentialLock` with refresh; native advisory-lock ownership is OS-managed (Linux OFD / macOS flock / Windows LockFileEx; see ../auth-lock.md); never stale-break/unlink lock files.
+6. **CLI/MCP**: `auth refresh` vs `--force` / `force:true`; whoami offline; AuthOps returns non-secret metadata;
+   MCP `auth_refresh` excluded from READONLY.
+7. **RPC 401**: pass the rejected bearer into force refresh; if disk already rotated, adopt without another
+   network refresh. Write RPCs never auto-replayed; read-only unary whitelist may refresh+retry once.
+   Pre-RPC failures annotate `rpc_dispatched=false`.
+8. **staticTokenProvider**: never auto-refresh / no disk refresh; expired → re-provide/login.

package/docs/protocol/baseline-manifest.md

@@ -0,0 +1,72 @@
+# Baseline manifest
+
+## Schema baseline used by `vendor/proto-gen` (what the code is compiled against) — **0.79.3**
+
+`vendor/proto-gen` is **本仓库从App恢复生成** (regenerated in this repo from the App; not a byte copy of upstream).
+
+**正式协议源目录 = [`proto/`](../../proto/)** (current App 0.79.3 `.proto`). The frozen copy under `baselines/schema-0.79.3/` must stay byte-identical (`cmp`).
+
+| Item | Value | Level |
+|---|---|---|
+| Release feed | `https://api2.cursor.sh/updates/api/download/stable/linux-x64/sand`, opened 2026-11-07 with `curl`, no login → `version` 0.79.3, `commitSha` `473941287261c3efa92c6b2a0bf7e1caad1a2ef2` | S |
+| Package URL | `https://downloads.cursor.com/grokbot/stable/473941287261c3efa92c6b2a0bf7e1caad1a2ef2/linux/x64/grok-bot_0.79.3_amd64.deb` (HTTP 200, Last-Modified 2026-11-07 07:20:22 Asia/Singapore) | S |
+| deb | 112699168 bytes, sha256 `eee0d637cd68becd2202f765d1302443d4096c52eb632c2177ef0ded29e7168d` (locally computed; no publisher signature verified). `dpkg-deb`: Package grok-bot, Version 0.79.3, amd64 | S |
+| `app.asar` sha256 | `5e13b57664c39a36a84d75dcfcd94f7321a38beab18fa417d1df322e5b2fabe9` | S |
+| `dist/electron-main/proto.cjs` | 1534590 bytes, sha256 `929f17d21f4646c745a9fc4c4a43b55ff686288b5637dc310587471a20f12f8a` | S |
+| `dist/electron-main/main-app.cjs` | 3503781 bytes, sha256 `d54cc236e295d9bb8ee850769b6fceb0079036e4dd117d7f487d35124a268209` | S |
+| `dist/electron-main/main-core.cjs` | 1160950 bytes, sha256 `910cc6bf1145a05efb01185d315e800e28d6242bfef01cae6e945e6aa908e34d` | S |
+| App `package.json` | version 0.79.3, `@bufbuild/protobuf` 1.10.1, `@connectrpc/connect` ^1.6.1 | S |
+| Extraction | upstream `extract_proto.py` @ grokbot-proto `49fd8ce` (sha256 `ab3ec2012ade9527387e772b36445bc97a506e42b6a4179e5e1bc5343ca52301`): 2923 messages, 387 enums, 7 services, 662 RPCs; unresolved 0, relocated 0, backward cross-file edges 0 | S |
+| snapshot.json | sha256 `ab22284058282cd8fd861dbdd08a0fbf7cf6de6c2978f4b69beeaed7d5aeed37` (archived gzipped: `baselines/schema-0.79.3/snapshot.json.gz`, sha256 `eaecc638…4212`) | S |
+| Descriptor set | `grpc_tools.protoc` (grpcio-tools 1.85.1 / libprotoc 35.1 / Python protobuf 7.36.2): 834442 bytes, sha256 `ab4e09d428dd87a6c2c4aea422f0e515375bf1138a5790bd4beb8c1b701c293f` (not committed) | O |
+| Codegen | `@bufbuild/protoc-gen-es` 1.10.1, `@connectrpc/protoc-gen-connect-es` 1.6.1, `target=js`, Node v24.22.1 | O |
+| Pipeline reproducibility | same toolchain on upstream 0.78.4 `.proto` → the previous 6 vendor files byte-identical and `desc.pb` identical | O |
+| Static consistency | `tools/protocol/verify_generated.mjs vendor/proto-gen <snapshot>`: 2923 messages, 387 enums, 464 GrokBotService RPCs match; 2923/2923 binary+JSON round-trips; 0 errors. Negative control (0.78.4 code vs 0.79.3 snapshot) fails as expected | O |
+| App-side wire cross-check | **not run**: upstream `compare.mjs`/`cross-wire.mjs` `require()` the App bundle, which this project does not execute | — |
+
+| Vendored file | sha256 (0.79.3) | vs 0.78.4 |
+|---|---|---|
+| agent.v1_pb.js | `62ea215374df3e66578923a969cfcf044ba5d324369f48fab6cb4a50c521316c` | changed |
+| aiserver.v1_pb.js | `a4aa38429919eeef419fe54b8f21b3b68c11c3de881558ee81e9a37206e2eefc` | changed |
+| aiserver.v1_2_pb.js | `ac248083e869d3690c736102320544514a2e951f77981aeda3f8206ef88891af` | same |
+| anyrun.v1_pb.js | `3d753b7a260ab3926ef22b14109db0161f7721f9062b0d876f10b4f2b6d64d83` | same |
+| internapi.v1_pb.js | `6bad66a292c08afd74be5c222e635a148000c81234ec214eae9161d1f4b1ca1b` | same |
+| svc_aiserver.v1.GrokBotService_connect.js | `88228cd0b039c8260290e4f53477454b2fa0353ec39ec5754620239144314f72` | changed |
+
+First-class sources: `proto/*.proto` (+ `proto/README.md`, `proto/NOTICE.md`).
+Archived freeze: `baselines/schema-0.79.3/*.proto` + `snapshot.json.gz`, `used-surface-0.79.3.json`,
+`used-surface-diff-0.78.4-to-0.79.3.md`, `full-schema-diff-0.78.4-to-0.79.3.txt`, `full-schema-diff-0.79.2-to-0.79.3.txt`.
+Installer, `app.asar` and bundle files are **not** committed.
+
+## Previous vendor baseline (0.78.4, kept for comparison)
+
+| Item | Value |
+|---|---|
+| Upstream | https://github.com/younglark/grokbot-proto @ `49fd8ce62136f72d268a04249f1748e0055d3d2d`, App 0.78.4 (macOS), 2736 msgs / 349 enums / 607 RPCs |
+| Vendor file sha256 | agent `e6f109fe…8baf3`, aiserver `5ca35dc5…f8f33`, aiserver_2 `ac248083…891af`, anyrun `3d753b7a…d64d83`, internapi `6bad66a2…ca1b`, GrokBotService `61daae0c…e679a4` |
+| Used-surface baseline | `baselines/used-surface-0.78.4.json` |
+
+## Earlier App build: 0.79.2 (auth analysis; schema comparison)
+
+| Item | Value | Level |
+|---|---|---|
+| Source | Official release feed `https://api2.cursor.sh/updates/api/download/stable/linux-x64/sand` (opened 2026-11-07, version 0.79.2, commitSha `676f0815a4013954f4c8e3f4ac413acfbac0376c`) | S (recorded in analysis notes) |
+| Package | `grok-bot_0.79.2_amd64.deb`, 112699424 bytes | re-hashed 2026-11-07 |
+| deb sha256 | `0039b3832ad8743a95bb6c2a4f050e1ffbd491fc72dbbf71fdb8208799502217` (locally computed; **not** a verified publisher signature) | re-hashed |
+| `opt/Grok Bot/resources/app.asar` sha256 | `cec56658c6879644f861ffef870561dca2e1dd9415985fcb2ccf43ff9977df89` | computed 2026-11-07 |
+| `dist/electron-main/proto.cjs` | 1534017 bytes, sha256 `57ccef6a451a88cecb3d533df0b16991db577316e1572b19c118aa438fb15bf5` | re-extracted with `tools/protocol/asar_extract.py`, matches earlier record |
+| `dist/electron-main/main-app.cjs` | 3506377 bytes, sha256 `b5f976ea3fba4e9564f4c9a828705a708774aa4f329a1133348e4a4eee5d8529` | same |
+| `dist/electron-main/main-core.cjs` | 1160957 bytes, sha256 `310fac66118d490db826c9a17a4936ef11492a55c73d0d097480e28174f11e2f` | same |
+| App `package.json` | `@bufbuild/protobuf` 1.10.1, `@connectrpc/connect` ^1.6.1 | extracted |
+| 0.79.2 schema (upstream `extract_proto.py`) | 2922 messages, 387 enums, 7 services, 661 RPCs; unresolved refs 0, relocated 0 | S, run 2026-11-07 |
+
+Prettified copies used for line-number citations (`A` = main-app, `C` = main-core) were produced with
+prettier; their line numbers drift between versions — use the string anchors in auth-flow.md instead.
+
+## Status
+
+- **The vendored code is the 0.79.3 schema** (regenerated 2026-11-07). Used surface 0.78.4 → 0.79.3: 0 breaking, additive only;
+  0.79.2 → 0.79.3: no change in the used surface (full schema: +1 message, +1 field, +1 RPC `SetOnePasswordPreviousIntegration`).
+- The 2026-11-07 live read-only check (login + ListGrokBotAgents / GetGrokBotUserRuntimeSettings / ListGrokBotAgentStatuses) was
+  done with the **old 0.78.4 vendor**. The 0.79.3 vendor is verified **offline only**.
+- macOS builds were not analysed for 0.79.x.

package/docs/protocol/baselines/full-schema-diff-0.78.4-to-0.79.2.txt

@@ -0,0 +1,239 @@
+====================================================================
+messages  2736 -> 2922   (+186 -0 ~71)
+enums     349 -> 387
+services  7 -> 7
+====================================================================
+
+--- new messages ---
+  + agent.v1.ExecuteArgs
+  + agent.v1.ExecuteError
+  + agent.v1.ExecuteRejected
+  + agent.v1.ExecuteResult
+  + agent.v1.ExecuteSuccess
+  + agent.v1.ExecuteToolCall
+  + agent.v1.ManageAccessArgs
+  + agent.v1.ManageAccessError
+  + agent.v1.ManageAccessGrant
+  + agent.v1.ManageAccessResult
+  + agent.v1.ManageAccessSuccess
+  + agent.v1.ManageAccessTarget
+  + agent.v1.ManageAccessToolCall
+  + agent.v1.McpAppDocument
+  + aiserver.v1.ActOnGrokBotMeetingPromptRequest
+  + aiserver.v1.ActOnGrokBotMeetingPromptResponse
+  + aiserver.v1.AdminApplyGrokBotAccountMigrationRequest
+  + aiserver.v1.AdminApplyGrokBotAccountMigrationResponse
+  + aiserver.v1.AdminCancelGrokBotAccountMigrationsRequest
+  + aiserver.v1.AdminCancelGrokBotAccountMigrationsResponse
+  + aiserver.v1.AdminCleanGrokBotAccountMigrationRequest
+  + aiserver.v1.AdminCleanGrokBotAccountMigrationResponse
+  + aiserver.v1.AdminFailGrokBotAccountMigrationExportStartRequest
+  + aiserver.v1.AdminFailGrokBotAccountMigrationExportStartResponse
+  + aiserver.v1.AdminGetGrokBotAccountMigrationHeldSummaryRequest
+  + aiserver.v1.AdminGetGrokBotAccountMigrationHeldSummaryResponse
+  + aiserver.v1.AdminGetGrokBotAccountMigrationRequest
+  + aiserver.v1.AdminGetGrokBotAccountMigrationResponse
+  + aiserver.v1.AdminGetGrokBotAgentResourcesRequest
+  + aiserver.v1.AdminGetGrokBotAgentResourcesResponse
+  + aiserver.v1.AdminGetSandBoxActiveVmRequest
+  + aiserver.v1.AdminGetSandBoxActiveVmResponse
+  + aiserver.v1.AdminListGrokBotAccountMigrationLedgerRequest
+  + aiserver.v1.AdminListGrokBotAccountMigrationLedgerResponse
+  + aiserver.v1.AdminListGrokBotAccountMigrationsRequest
+  + aiserver.v1.AdminListGrokBotAccountMigrationsResponse
+  + aiserver.v1.AdminOverrideGrokBotAccountMigrationItemRequest
+  + aiserver.v1.AdminOverrideGrokBotAccountMigrationItemResponse
+  + aiserver.v1.AdminProposeGrokBotAccountMigrationPairsRequest
+  + aiserver.v1.AdminProposeGrokBotAccountMigrationPairsResponse
+  ... and 146 more
+
+--- removed messages ---
+
+--- changed messages ---
+  ~ agent.v1.McpSuccess
+      +6:mcp_app_document:agent.v1.McpAppDocument
+  ~ agent.v1.NewCloudVmTarget
+      +4:environment_id:string?
+      +5:repo_url:string?
+  ~ agent.v1.ShellArgs
+      +25:smart_mode_classifier_allowed:bool
+  ~ agent.v1.ToolCall
+      +95:manage_access_tool_call:agent.v1.ManageAccessToolCall
+      +1000:execute_tool_call:agent.v1.ExecuteToolCall
+  ~ agent.v1.WriteCanvasSuccess
+      +5:audience_notice:string?
+  ~ aiserver.v1.AdminBreakGlassDeleteSandBoxPodRequest
+      +6:tenant_id:string
+  ~ aiserver.v1.AdminBreakGlassDeleteSandBoxPodResponse
+      +6:recreated_tenant_id:string
+  ~ aiserver.v1.AppsSettings
+      +4:allow_api_key_access:bool?
+  ~ aiserver.v1.AvailableModelsResponse.AvailableModel
+      +49:gateway_published_model_id:string?
+  ~ aiserver.v1.CheckHttpMcpStatusRequest
+      +19:texted_sign_in:bool?
+      +20:grok_bot_session_id:string?
+      +21:connector_suite_capable:bool?
+      +22:connector_suite:aiserver.v1.ConnectorSuiteSelection?
+  ~ aiserver.v1.CheckHttpMcpStatusResponse.ServerStatus
+      +12:cloud_verdict:aiserver.v1.McpCloudVerdict
+      +13:connector_suite_offer:aiserver.v1.ConnectorSuiteOffer?
+      +14:connector_suite_exposure:aiserver.v1.ConnectorSuiteExposure
+  ~ aiserver.v1.CloudCanvasMetadata
+      +18:project_share:aiserver.v1.CanvasProjectShare?
+  ~ aiserver.v1.CommandDescriptor
+      +5:source_repo_url:string?
+  ~ aiserver.v1.CompleteMcpOAuthResponse
+      +5:connector_suite_result:aiserver.v1.ConnectorSuiteMemberResult*
+  ~ aiserver.v1.CompleteOnePasswordOAuthRequest
+      +4:error_description:string
+  ~ aiserver.v1.CreateGrokBotAgentFromTemplateRequest
+      +9:onboarding_connect_screen_shown:bool?
+  ~ aiserver.v1.CreateGrokBotAgentRequest
+      +18:visibility:aiserver.v1.GrokBotAgentVisibility?
+      +19:team_id:int32?
+      +20:bot_builder_requested:bool?
+  ~ aiserver.v1.DeleteMcpOAuthAccountRequest
+      +4:grok_bot_plugin_scope:aiserver.v1.GrokBotPluginScope?
+      +5:grok_bot_agent_id:string?
+      +6:grok_bot_session_id:string?
+  ~ aiserver.v1.ExecuteSandMcpToolRequest
+      +12:refuse_shared_payment_token_arguments:bool
+  ~ aiserver.v1.GetAvailableMcpServersRequest
+      +4:service_account_id:string?
+      +5:grok_bot_session_id:string?
+  ~ aiserver.v1.GetAvailableMcpServersResponse.McpServerInfo
+      +32:disabled_by_cloud_agent_mcp_allowlist:bool?
+  ~ aiserver.v1.GetDailySpendByCategoryRequest
+      +14:ranking_metric:aiserver.v1.DailySpendRankingMetric?
+  ~ aiserver.v1.GetGrokBotAgentAccessRequest
+      +3:query:string?
+      +4:people_cursor:string
+      +5:shows_bot_team_first:bool
+  ~ aiserver.v1.GetGrokBotAgentAccessResponse
+      +8:listed_people:aiserver.v1.GrokBotAccessPersonDirectoryEntry*
+      +9:listed_groups:aiserver.v1.GrokBotAccessGroupDirectoryEntry*
+      +10:candidate_people:aiserver.v1.GrokBotAccessPersonDirectoryEntry*
+      +11:next_people_cursor:string
+      +12:candidate_groups:aiserver.v1.GrokBotAccessGroupDirectoryEntry*
+      +13:candidate_teams:aiserver.v1.GrokBotAccessTeamDirectoryEntry*
+      ... 1 more field diffs
+  ~ aiserver.v1.GetGrokBotAgentPluginsResponse
+      -7:custom_mcp_per_user:bool?
+      +8:offered_service_account_plugin_ids:int64*
+  ~ aiserver.v1.GetGrokBotEgressPolicyResponse
+      +4:private_destination_rules:aiserver.v1.GrokBotPrivateDestinationRule*
+  ~ aiserver.v1.GetGrokBotMessagingLinkStatusResponse
+      +3:disabled_by_team_admin:bool
+  ~ aiserver.v1.GetGrokBotOnboardingDripInternalResponse
+      +3:router:aiserver.v1.GrokBotOnboardingDripRouter
+  ~ aiserver.v1.GetGrokBotTeamsInstallStateRequest
+      +3:check_now:bool?
+  ~ aiserver.v1.GetGrokBotTeamsInstallStateResponse
+      +26:check_outcome:string?
+      +27:checked_at_ms:int64?
+      +28:check_again_after_ms:uint32?
+      +29:teams_admin_center_url:string?
+      +30:teams_home_url:string?
+  ~ aiserver.v1.GetGrokBotUserRuntimeSettingsRequest
+      +1:after_main_agent_change:bool
+  ~ aiserver.v1.GetMeResponse
+      +22:signup_source:string?
+      +23:admin_session_management_enabled:bool
+  ~ aiserver.v1.GetSandAccessStatusResponse
+      +20:grok_connectors_only:bool
+  ~ aiserver.v1.GetSandUsageStatusResponse
+      +27:upgrade_option:aiserver.v1.SandUpgradeOption?
+  ~ aiserver.v1.GetSlackInstallUrlRequest
+      +7:reconnect_slack_team_id:string?
+  ~ aiserver.v1.GetSlackUserSettingsResponse
+      +15:origin_link_unfurls_enabled:bool?
+  ~ aiserver.v1.GetTeamAdminSettingsRequest
+      +2:supports_host_mcp_bridge_exemption:bool?
+  ~ aiserver.v1.GetTeamAdminSettingsResponse
+      +99:cloud_agent_mcp_allowlist_applied:bool?
+      +100:grok_bot_texting_controls:aiserver.v1.GrokBotTextingControls?
+      +101:grok_bot_wall_snapshot_controls:aiserver.v1.GrokBotWallSnapshotControls?
+      +102:sand_box_sudo_not_applied_box_count:uint32?
+  ~ aiserver.v1.GetTeamTailnetResponse
+      +18:allow_unlabeled:bool?
+  ~ aiserver.v1.GrokBotAccessCrossTierDirectory
+      +4:organization_team_count:uint32
+  ... and 31 more
+
+--- enum changes ---
+  ~ aiserver.v1.BackgroundComposerSource
+      38: None -> BACKGROUND_COMPOSER_SOURCE_EMAIL
+  ~ aiserver.v1.BackgroundComposerUpdateKind
+      16: None -> BACKGROUND_COMPOSER_UPDATE_KIND_PROJECT_APPS_CHANGED
+  ~ aiserver.v1.GrokBotUserSettingsField
+      11: None -> GROK_BOT_USER_SETTINGS_FIELD_CART
+  ~ aiserver.v1.SlackConnectSource
+      23: None -> SLACK_CONNECT_SOURCE_GLASS_UNATTRIBUTED
+      24: None -> SLACK_CONNECT_SOURCE_IDE_UNATTRIBUTED
+      25: None -> SLACK_CONNECT_SOURCE_WEB_UNATTRIBUTED
+      26: None -> SLACK_CONNECT_SOURCE_GROK_BOT_UNATTRIBUTED
+  ~ aiserver.v1.SpendGroupByCategory
+      6: None -> SPEND_GROUP_BY_CATEGORY_USER
+  (5 enums changed, +38 new, -0 removed)
+
+--- service / RPC changes ---
+  methods 607 -> 661
+
+  aiserver.v1.DashboardService
+    + GetGrokBotUsageBreakdown(aiserver.v1.GetGrokBotUsageBreakdownRequest) -> aiserver.v1.GetGrokBotUsageBreakdownResponse [Unary]
+    + GetSandEnterpriseSpendLimit(aiserver.v1.GetSandEnterpriseSpendLimitRequest) -> aiserver.v1.GetSandEnterpriseSpendLimitResponse [Unary]
+    + ListSlackLinkedWorkspaces(aiserver.v1.ListSlackLinkedWorkspacesRequest) -> aiserver.v1.ListSlackLinkedWorkspacesResponse [Unary]
+    + RunCanvasConnectorAction(aiserver.v1.RunCanvasConnectorActionRequest) -> aiserver.v1.RunCanvasConnectorActionResponse [Unary]
+    + SetSandAutomationSlackWorkspace(aiserver.v1.SetSandAutomationSlackWorkspaceRequest) -> aiserver.v1.SetSandAutomationSlackWorkspaceResponse [Unary]
+
+  aiserver.v1.GrokBotService
+    + ActOnGrokBotMeetingPrompt(aiserver.v1.ActOnGrokBotMeetingPromptRequest) -> aiserver.v1.ActOnGrokBotMeetingPromptResponse [Unary]
+    + AdminApplyGrokBotAccountMigration(aiserver.v1.AdminApplyGrokBotAccountMigrationRequest) -> aiserver.v1.AdminApplyGrokBotAccountMigrationResponse [Unary]
+    + AdminCancelGrokBotAccountMigrations(aiserver.v1.AdminCancelGrokBotAccountMigrationsRequest) -> aiserver.v1.AdminCancelGrokBotAccountMigrationsResponse [Unary]
+    + AdminCleanGrokBotAccountMigration(aiserver.v1.AdminCleanGrokBotAccountMigrationRequest) -> aiserver.v1.AdminCleanGrokBotAccountMigrationResponse [Unary]
+    + AdminFailGrokBotAccountMigrationExportStart(aiserver.v1.AdminFailGrokBotAccountMigrationExportStartRequest) -> aiserver.v1.AdminFailGrokBotAccountMigrationExportStartResponse [Unary]
+    + AdminGetGrokBotAccountMigration(aiserver.v1.AdminGetGrokBotAccountMigrationRequest) -> aiserver.v1.AdminGetGrokBotAccountMigrationResponse [Unary]
+    + AdminGetGrokBotAccountMigrationHeldSummary(aiserver.v1.AdminGetGrokBotAccountMigrationHeldSummaryRequest) -> aiserver.v1.AdminGetGrokBotAccountMigrationHeldSummaryResponse [Unary]
+    + AdminGetGrokBotAgentResources(aiserver.v1.AdminGetGrokBotAgentResourcesRequest) -> aiserver.v1.AdminGetGrokBotAgentResourcesResponse [Unary]
+    + AdminGetSandBoxActiveVm(aiserver.v1.AdminGetSandBoxActiveVmRequest) -> aiserver.v1.AdminGetSandBoxActiveVmResponse [Unary]
+    + AdminListGrokBotAccountMigrationLedger(aiserver.v1.AdminListGrokBotAccountMigrationLedgerRequest) -> aiserver.v1.AdminListGrokBotAccountMigrationLedgerResponse [Unary]
+    + AdminListGrokBotAccountMigrations(aiserver.v1.AdminListGrokBotAccountMigrationsRequest) -> aiserver.v1.AdminListGrokBotAccountMigrationsResponse [Unary]
+    + AdminOverrideGrokBotAccountMigrationItem(aiserver.v1.AdminOverrideGrokBotAccountMigrationItemRequest) -> aiserver.v1.AdminOverrideGrokBotAccountMigrationItemResponse [Unary]
+    + AdminProposeGrokBotAccountMigrationPairs(aiserver.v1.AdminProposeGrokBotAccountMigrationPairsRequest) -> aiserver.v1.AdminProposeGrokBotAccountMigrationPairsResponse [Unary]
+    + AdminResolveGrokBotAccountMigrationPairs(aiserver.v1.AdminResolveGrokBotAccountMigrationPairsRequest) -> aiserver.v1.AdminResolveGrokBotAccountMigrationPairsResponse [Unary]
+    + AdminRetryGrokBotAccountMigrations(aiserver.v1.AdminRetryGrokBotAccountMigrationsRequest) -> aiserver.v1.AdminRetryGrokBotAccountMigrationsResponse [Unary]
+    + AdminStartGrokBotDream(aiserver.v1.AdminStartGrokBotDreamRequest) -> aiserver.v1.AdminStartGrokBotDreamResponse [Unary]
+    + AdminSubmitGrokBotAccountMigrations(aiserver.v1.AdminSubmitGrokBotAccountMigrationsRequest) -> aiserver.v1.AdminSubmitGrokBotAccountMigrationsResponse [Unary]
+    + AnswerGrokBotLabelerQuestion(aiserver.v1.AnswerGrokBotLabelerQuestionRequest) -> aiserver.v1.AnswerGrokBotLabelerQuestionResponse [Unary]
+    + AnswerGrokBotMessagingCard(aiserver.v1.AnswerGrokBotMessagingCardRequest) -> aiserver.v1.AnswerGrokBotMessagingCardResponse [Unary]
+    + CreateGrokBotOnboardingDripRouteInternal(aiserver.v1.CreateGrokBotOnboardingDripRouteInternalRequest) -> aiserver.v1.GrokBotOnboardingDripRouter [Unary]
+    + DeleteGrokBotUserProfilePhoto(aiserver.v1.DeleteGrokBotUserProfilePhotoRequest) -> aiserver.v1.DeleteGrokBotUserProfilePhotoResponse [Unary]
+    + GenerateGrokBotTryOnImage(aiserver.v1.GenerateGrokBotTryOnImageRequest) -> aiserver.v1.GenerateGrokBotTryOnImageResponse [Unary]
+    + GetGrokBotInviteByEmailAccess(aiserver.v1.GetGrokBotInviteByEmailAccessRequest) -> aiserver.v1.GetGrokBotInviteByEmailAccessResponse [Unary]
+    + GetGrokBotMessagingCard(aiserver.v1.GetGrokBotMessagingCardRequest) -> aiserver.v1.GetGrokBotMessagingCardResponse [Unary]
+    + GetGrokBotPlaceDetails(aiserver.v1.GetGrokBotPlaceDetailsRequest) -> aiserver.v1.GetGrokBotPlaceDetailsResponse [Unary]
+    + GetGrokBotUserProfile(aiserver.v1.GetGrokBotUserProfileRequest) -> aiserver.v1.GetGrokBotUserProfileResponse [Unary]
+    + ListGrokBotCartItems(aiserver.v1.ListGrokBotCartItemsRequest) -> aiserver.v1.ListGrokBotCartItemsResponse [Unary]
+    + ListGrokBotTryOnImages(aiserver.v1.ListGrokBotTryOnImagesRequest) -> aiserver.v1.ListGrokBotTryOnImagesResponse [Unary]
+    + LookupGrokBotShoppingProduct(aiserver.v1.LookupGrokBotShoppingProductRequest) -> aiserver.v1.LookupGrokBotShoppingProductResponse [Unary]
+    + MakeGrokBotAgentFilePrivate(aiserver.v1.MakeGrokBotAgentFilePrivateRequest) -> aiserver.v1.MakeGrokBotAgentFilePrivateResponse [Unary]
+    + MakeGrokBotAgentSkillPrivate(aiserver.v1.MakeGrokBotAgentSkillPrivateRequest) -> aiserver.v1.MakeGrokBotAgentSkillPrivateResponse [Unary]
+    + PollGrokBotCalendarEvents(aiserver.v1.PollGrokBotCalendarEventsRequest) -> aiserver.v1.PollGrokBotCalendarEventsResponse [Unary]
+    + RemoveGrokBotCartItems(aiserver.v1.RemoveGrokBotCartItemsRequest) -> aiserver.v1.RemoveGrokBotCartItemsResponse [Unary]
+    + RemoveGrokBotOnboardingDripRouteInternal(aiserver.v1.RemoveGrokBotOnboardingDripRouteInternalRequest) -> aiserver.v1.GrokBotOnboardingDripRouter [Unary]
+    + ReorderGrokBotOnboardingDripRoutesInternal(aiserver.v1.ReorderGrokBotOnboardingDripRoutesInternalRequest) -> aiserver.v1.GrokBotOnboardingDripRouter [Unary]
+    + ReportGrokBotMessagingCapabilities(aiserver.v1.ReportGrokBotMessagingCapabilitiesRequest) -> aiserver.v1.ReportGrokBotMessagingCapabilitiesResponse [Unary]
+    + ReportSandBoxStoreFlush(aiserver.v1.ReportSandBoxStoreFlushRequest) -> aiserver.v1.ReportSandBoxStoreFlushResponse [Unary]
+    + ResolveGrokBotFlightBookingLink(aiserver.v1.ResolveGrokBotFlightBookingLinkRequest) -> aiserver.v1.ResolveGrokBotFlightBookingLinkResponse [Unary]
+    + SearchGrokBotSimilarProducts(aiserver.v1.SearchGrokBotSimilarProductsRequest) -> aiserver.v1.SearchGrokBotSimilarProductsResponse [Unary]
+    + SearchGrokBotTranscripts(aiserver.v1.SearchGrokBotTranscriptsRequest) -> aiserver.v1.SearchGrokBotTranscriptsResponse [Unary]
+    + SendGrokBotOnboardingDripStepNowInternal(aiserver.v1.SendGrokBotOnboardingDripStepNowInternalRequest) -> aiserver.v1.SendGrokBotOnboardingDripStepNowInternalResponse [Unary]
+    + SetGrokBotAgentRoutineForTeam(aiserver.v1.SetGrokBotAgentRoutineForTeamRequest) -> aiserver.v1.SetGrokBotAgentRoutineForTeamResponse [Unary]
+    + SetGrokBotCartItem(aiserver.v1.SetGrokBotCartItemRequest) -> aiserver.v1.SetGrokBotCartItemResponse [Unary]
+    + SetGrokBotOnboardingDripRouterStatusInternal(aiserver.v1.SetGrokBotOnboardingDripRouterStatusInternalRequest) -> aiserver.v1.GrokBotOnboardingDripRouter [Unary]
+    + SetGrokBotUserProfilePhoto(aiserver.v1.SetGrokBotUserProfilePhotoRequest) -> aiserver.v1.SetGrokBotUserProfilePhotoResponse [Unary]
+    + SummarizeGrokBotTeamReviewItems(aiserver.v1.SummarizeGrokBotTeamReviewItemsRequest) -> aiserver.v1.SummarizeGrokBotTeamReviewItemsResponse [Unary]
+    + UpdateGrokBotMeetingSettings(aiserver.v1.UpdateGrokBotMeetingSettingsRequest) -> aiserver.v1.UpdateGrokBotMeetingSettingsResponse [Unary]
+    + UpdateGrokBotOnboardingDripRouteInternal(aiserver.v1.UpdateGrokBotOnboardingDripRouteInternalRequest) -> aiserver.v1.GrokBotOnboardingDripRouter [Unary]
+    + WatchGrokBotCalendarEvents(aiserver.v1.WatchGrokBotCalendarEventsRequest) -> aiserver.v1.WatchGrokBotCalendarEventsEvent [ServerStreaming]

package/docs/protocol/baselines/full-schema-diff-0.78.4-to-0.79.3.txt

@@ -0,0 +1,240 @@
+====================================================================
+messages  2736 -> 2923   (+187 -0 ~72)
+enums     349 -> 387
+services  7 -> 7
+====================================================================
+
+--- new messages ---
+  + agent.v1.ExecuteArgs
+  + agent.v1.ExecuteError
+  + agent.v1.ExecuteRejected
+  + agent.v1.ExecuteResult
+  + agent.v1.ExecuteSuccess
+  + agent.v1.ExecuteToolCall
+  + agent.v1.ManageAccessArgs
+  + agent.v1.ManageAccessError
+  + agent.v1.ManageAccessGrant
+  + agent.v1.ManageAccessResult
+  + agent.v1.ManageAccessSuccess
+  + agent.v1.ManageAccessTarget
+  + agent.v1.ManageAccessToolCall
+  + agent.v1.McpAppDocument
+  + aiserver.v1.ActOnGrokBotMeetingPromptRequest
+  + aiserver.v1.ActOnGrokBotMeetingPromptResponse
+  + aiserver.v1.AdminApplyGrokBotAccountMigrationRequest
+  + aiserver.v1.AdminApplyGrokBotAccountMigrationResponse
+  + aiserver.v1.AdminCancelGrokBotAccountMigrationsRequest
+  + aiserver.v1.AdminCancelGrokBotAccountMigrationsResponse
+  + aiserver.v1.AdminCleanGrokBotAccountMigrationRequest
+  + aiserver.v1.AdminCleanGrokBotAccountMigrationResponse
+  + aiserver.v1.AdminFailGrokBotAccountMigrationExportStartRequest
+  + aiserver.v1.AdminFailGrokBotAccountMigrationExportStartResponse
+  + aiserver.v1.AdminGetGrokBotAccountMigrationHeldSummaryRequest
+  + aiserver.v1.AdminGetGrokBotAccountMigrationHeldSummaryResponse
+  + aiserver.v1.AdminGetGrokBotAccountMigrationRequest
+  + aiserver.v1.AdminGetGrokBotAccountMigrationResponse
+  + aiserver.v1.AdminGetGrokBotAgentResourcesRequest
+  + aiserver.v1.AdminGetGrokBotAgentResourcesResponse
+  + aiserver.v1.AdminGetSandBoxActiveVmRequest
+  + aiserver.v1.AdminGetSandBoxActiveVmResponse
+  + aiserver.v1.AdminListGrokBotAccountMigrationLedgerRequest
+  + aiserver.v1.AdminListGrokBotAccountMigrationLedgerResponse
+  + aiserver.v1.AdminListGrokBotAccountMigrationsRequest
+  + aiserver.v1.AdminListGrokBotAccountMigrationsResponse
+  + aiserver.v1.AdminOverrideGrokBotAccountMigrationItemRequest
+  + aiserver.v1.AdminOverrideGrokBotAccountMigrationItemResponse
+  + aiserver.v1.AdminProposeGrokBotAccountMigrationPairsRequest
+  + aiserver.v1.AdminProposeGrokBotAccountMigrationPairsResponse
+  ... and 147 more
+
+--- removed messages ---
+
+--- changed messages ---
+  ~ agent.v1.McpSuccess
+      +6:mcp_app_document:agent.v1.McpAppDocument
+  ~ agent.v1.NewCloudVmTarget
+      +4:environment_id:string?
+      +5:repo_url:string?
+  ~ agent.v1.ShellArgs
+      +25:smart_mode_classifier_allowed:bool
+  ~ agent.v1.ToolCall
+      +95:manage_access_tool_call:agent.v1.ManageAccessToolCall
+      +1000:execute_tool_call:agent.v1.ExecuteToolCall
+  ~ agent.v1.WriteCanvasSuccess
+      +5:audience_notice:string?
+  ~ aiserver.v1.AdminBreakGlassDeleteSandBoxPodRequest
+      +6:tenant_id:string
+  ~ aiserver.v1.AdminBreakGlassDeleteSandBoxPodResponse
+      +6:recreated_tenant_id:string
+  ~ aiserver.v1.AppsSettings
+      +4:allow_api_key_access:bool?
+  ~ aiserver.v1.AvailableModelsResponse.AvailableModel
+      +49:gateway_published_model_id:string?
+  ~ aiserver.v1.CheckHttpMcpStatusRequest
+      +19:texted_sign_in:bool?
+      +20:grok_bot_session_id:string?
+      +21:connector_suite_capable:bool?
+      +22:connector_suite:aiserver.v1.ConnectorSuiteSelection?
+  ~ aiserver.v1.CheckHttpMcpStatusResponse.ServerStatus
+      +12:cloud_verdict:aiserver.v1.McpCloudVerdict
+      +13:connector_suite_offer:aiserver.v1.ConnectorSuiteOffer?
+      +14:connector_suite_exposure:aiserver.v1.ConnectorSuiteExposure
+  ~ aiserver.v1.CloudCanvasMetadata
+      +18:project_share:aiserver.v1.CanvasProjectShare?
+  ~ aiserver.v1.CommandDescriptor
+      +5:source_repo_url:string?
+  ~ aiserver.v1.CompleteMcpOAuthResponse
+      +5:connector_suite_result:aiserver.v1.ConnectorSuiteMemberResult*
+  ~ aiserver.v1.CompleteOnePasswordOAuthRequest
+      +4:error_description:string
+  ~ aiserver.v1.CreateGrokBotAgentFromTemplateRequest
+      +9:onboarding_connect_screen_shown:bool?
+  ~ aiserver.v1.CreateGrokBotAgentRequest
+      +18:visibility:aiserver.v1.GrokBotAgentVisibility?
+      +19:team_id:int32?
+      +20:bot_builder_requested:bool?
+  ~ aiserver.v1.DeleteMcpOAuthAccountRequest
+      +4:grok_bot_plugin_scope:aiserver.v1.GrokBotPluginScope?
+      +5:grok_bot_agent_id:string?
+      +6:grok_bot_session_id:string?
+  ~ aiserver.v1.ExecuteSandMcpToolRequest
+      +12:refuse_shared_payment_token_arguments:bool
+  ~ aiserver.v1.GetAvailableMcpServersRequest
+      +4:service_account_id:string?
+      +5:grok_bot_session_id:string?
+  ~ aiserver.v1.GetAvailableMcpServersResponse.McpServerInfo
+      +32:disabled_by_cloud_agent_mcp_allowlist:bool?
+  ~ aiserver.v1.GetDailySpendByCategoryRequest
+      +14:ranking_metric:aiserver.v1.DailySpendRankingMetric?
+  ~ aiserver.v1.GetGrokBotAgentAccessRequest
+      +3:query:string?
+      +4:people_cursor:string
+      +5:shows_bot_team_first:bool
+  ~ aiserver.v1.GetGrokBotAgentAccessResponse
+      +8:listed_people:aiserver.v1.GrokBotAccessPersonDirectoryEntry*
+      +9:listed_groups:aiserver.v1.GrokBotAccessGroupDirectoryEntry*
+      +10:candidate_people:aiserver.v1.GrokBotAccessPersonDirectoryEntry*
+      +11:next_people_cursor:string
+      +12:candidate_groups:aiserver.v1.GrokBotAccessGroupDirectoryEntry*
+      +13:candidate_teams:aiserver.v1.GrokBotAccessTeamDirectoryEntry*
+      ... 1 more field diffs
+  ~ aiserver.v1.GetGrokBotAgentPluginsResponse
+      -7:custom_mcp_per_user:bool?
+      +8:offered_service_account_plugin_ids:int64*
+  ~ aiserver.v1.GetGrokBotEgressPolicyResponse
+      +4:private_destination_rules:aiserver.v1.GrokBotPrivateDestinationRule*
+  ~ aiserver.v1.GetGrokBotMessagingLinkStatusResponse
+      +3:disabled_by_team_admin:bool
+  ~ aiserver.v1.GetGrokBotOnboardingDripInternalResponse
+      +3:router:aiserver.v1.GrokBotOnboardingDripRouter
+  ~ aiserver.v1.GetGrokBotTeamsInstallStateRequest
+      +3:check_now:bool?
+  ~ aiserver.v1.GetGrokBotTeamsInstallStateResponse
+      +26:check_outcome:string?
+      +27:checked_at_ms:int64?
+      +28:check_again_after_ms:uint32?
+      +29:teams_admin_center_url:string?
+      +30:teams_home_url:string?
+  ~ aiserver.v1.GetGrokBotUserRuntimeSettingsRequest
+      +1:after_main_agent_change:bool
+  ~ aiserver.v1.GetMeResponse
+      +22:signup_source:string?
+      +23:admin_session_management_enabled:bool
+  ~ aiserver.v1.GetSandAccessStatusResponse
+      +20:grok_connectors_only:bool
+  ~ aiserver.v1.GetSandUsageStatusResponse
+      +27:upgrade_option:aiserver.v1.SandUpgradeOption?
+  ~ aiserver.v1.GetSlackInstallUrlRequest
+      +7:reconnect_slack_team_id:string?
+  ~ aiserver.v1.GetSlackUserSettingsResponse
+      +15:origin_link_unfurls_enabled:bool?
+  ~ aiserver.v1.GetTeamAdminSettingsRequest
+      +2:supports_host_mcp_bridge_exemption:bool?
+  ~ aiserver.v1.GetTeamAdminSettingsResponse
+      +99:cloud_agent_mcp_allowlist_applied:bool?
+      +100:grok_bot_texting_controls:aiserver.v1.GrokBotTextingControls?
+      +101:grok_bot_wall_snapshot_controls:aiserver.v1.GrokBotWallSnapshotControls?
+      +102:sand_box_sudo_not_applied_box_count:uint32?
+  ~ aiserver.v1.GetTeamTailnetResponse
+      +18:allow_unlabeled:bool?
+  ~ aiserver.v1.GrokBotAccessCrossTierDirectory
+      +4:organization_team_count:uint32
+  ... and 32 more
+
+--- enum changes ---
+  ~ aiserver.v1.BackgroundComposerSource
+      38: None -> BACKGROUND_COMPOSER_SOURCE_EMAIL
+  ~ aiserver.v1.BackgroundComposerUpdateKind
+      16: None -> BACKGROUND_COMPOSER_UPDATE_KIND_PROJECT_APPS_CHANGED
+  ~ aiserver.v1.GrokBotUserSettingsField
+      11: None -> GROK_BOT_USER_SETTINGS_FIELD_CART
+  ~ aiserver.v1.SlackConnectSource
+      23: None -> SLACK_CONNECT_SOURCE_GLASS_UNATTRIBUTED
+      24: None -> SLACK_CONNECT_SOURCE_IDE_UNATTRIBUTED
+      25: None -> SLACK_CONNECT_SOURCE_WEB_UNATTRIBUTED
+      26: None -> SLACK_CONNECT_SOURCE_GROK_BOT_UNATTRIBUTED
+  ~ aiserver.v1.SpendGroupByCategory
+      6: None -> SPEND_GROUP_BY_CATEGORY_USER
+  (5 enums changed, +38 new, -0 removed)
+
+--- service / RPC changes ---
+  methods 607 -> 662
+
+  aiserver.v1.DashboardService
+    + GetGrokBotUsageBreakdown(aiserver.v1.GetGrokBotUsageBreakdownRequest) -> aiserver.v1.GetGrokBotUsageBreakdownResponse [Unary]
+    + GetSandEnterpriseSpendLimit(aiserver.v1.GetSandEnterpriseSpendLimitRequest) -> aiserver.v1.GetSandEnterpriseSpendLimitResponse [Unary]
+    + ListSlackLinkedWorkspaces(aiserver.v1.ListSlackLinkedWorkspacesRequest) -> aiserver.v1.ListSlackLinkedWorkspacesResponse [Unary]
+    + RunCanvasConnectorAction(aiserver.v1.RunCanvasConnectorActionRequest) -> aiserver.v1.RunCanvasConnectorActionResponse [Unary]
+    + SetSandAutomationSlackWorkspace(aiserver.v1.SetSandAutomationSlackWorkspaceRequest) -> aiserver.v1.SetSandAutomationSlackWorkspaceResponse [Unary]
+
+  aiserver.v1.GrokBotService
+    + ActOnGrokBotMeetingPrompt(aiserver.v1.ActOnGrokBotMeetingPromptRequest) -> aiserver.v1.ActOnGrokBotMeetingPromptResponse [Unary]
+    + AdminApplyGrokBotAccountMigration(aiserver.v1.AdminApplyGrokBotAccountMigrationRequest) -> aiserver.v1.AdminApplyGrokBotAccountMigrationResponse [Unary]
+    + AdminCancelGrokBotAccountMigrations(aiserver.v1.AdminCancelGrokBotAccountMigrationsRequest) -> aiserver.v1.AdminCancelGrokBotAccountMigrationsResponse [Unary]
+    + AdminCleanGrokBotAccountMigration(aiserver.v1.AdminCleanGrokBotAccountMigrationRequest) -> aiserver.v1.AdminCleanGrokBotAccountMigrationResponse [Unary]
+    + AdminFailGrokBotAccountMigrationExportStart(aiserver.v1.AdminFailGrokBotAccountMigrationExportStartRequest) -> aiserver.v1.AdminFailGrokBotAccountMigrationExportStartResponse [Unary]
+    + AdminGetGrokBotAccountMigration(aiserver.v1.AdminGetGrokBotAccountMigrationRequest) -> aiserver.v1.AdminGetGrokBotAccountMigrationResponse [Unary]
+    + AdminGetGrokBotAccountMigrationHeldSummary(aiserver.v1.AdminGetGrokBotAccountMigrationHeldSummaryRequest) -> aiserver.v1.AdminGetGrokBotAccountMigrationHeldSummaryResponse [Unary]
+    + AdminGetGrokBotAgentResources(aiserver.v1.AdminGetGrokBotAgentResourcesRequest) -> aiserver.v1.AdminGetGrokBotAgentResourcesResponse [Unary]
+    + AdminGetSandBoxActiveVm(aiserver.v1.AdminGetSandBoxActiveVmRequest) -> aiserver.v1.AdminGetSandBoxActiveVmResponse [Unary]
+    + AdminListGrokBotAccountMigrationLedger(aiserver.v1.AdminListGrokBotAccountMigrationLedgerRequest) -> aiserver.v1.AdminListGrokBotAccountMigrationLedgerResponse [Unary]
+    + AdminListGrokBotAccountMigrations(aiserver.v1.AdminListGrokBotAccountMigrationsRequest) -> aiserver.v1.AdminListGrokBotAccountMigrationsResponse [Unary]
+    + AdminOverrideGrokBotAccountMigrationItem(aiserver.v1.AdminOverrideGrokBotAccountMigrationItemRequest) -> aiserver.v1.AdminOverrideGrokBotAccountMigrationItemResponse [Unary]
+    + AdminProposeGrokBotAccountMigrationPairs(aiserver.v1.AdminProposeGrokBotAccountMigrationPairsRequest) -> aiserver.v1.AdminProposeGrokBotAccountMigrationPairsResponse [Unary]
+    + AdminResolveGrokBotAccountMigrationPairs(aiserver.v1.AdminResolveGrokBotAccountMigrationPairsRequest) -> aiserver.v1.AdminResolveGrokBotAccountMigrationPairsResponse [Unary]
+    + AdminRetryGrokBotAccountMigrations(aiserver.v1.AdminRetryGrokBotAccountMigrationsRequest) -> aiserver.v1.AdminRetryGrokBotAccountMigrationsResponse [Unary]
+    + AdminStartGrokBotDream(aiserver.v1.AdminStartGrokBotDreamRequest) -> aiserver.v1.AdminStartGrokBotDreamResponse [Unary]
+    + AdminSubmitGrokBotAccountMigrations(aiserver.v1.AdminSubmitGrokBotAccountMigrationsRequest) -> aiserver.v1.AdminSubmitGrokBotAccountMigrationsResponse [Unary]
+    + AnswerGrokBotLabelerQuestion(aiserver.v1.AnswerGrokBotLabelerQuestionRequest) -> aiserver.v1.AnswerGrokBotLabelerQuestionResponse [Unary]
+    + AnswerGrokBotMessagingCard(aiserver.v1.AnswerGrokBotMessagingCardRequest) -> aiserver.v1.AnswerGrokBotMessagingCardResponse [Unary]
+    + CreateGrokBotOnboardingDripRouteInternal(aiserver.v1.CreateGrokBotOnboardingDripRouteInternalRequest) -> aiserver.v1.GrokBotOnboardingDripRouter [Unary]
+    + DeleteGrokBotUserProfilePhoto(aiserver.v1.DeleteGrokBotUserProfilePhotoRequest) -> aiserver.v1.DeleteGrokBotUserProfilePhotoResponse [Unary]
+    + GenerateGrokBotTryOnImage(aiserver.v1.GenerateGrokBotTryOnImageRequest) -> aiserver.v1.GenerateGrokBotTryOnImageResponse [Unary]
+    + GetGrokBotInviteByEmailAccess(aiserver.v1.GetGrokBotInviteByEmailAccessRequest) -> aiserver.v1.GetGrokBotInviteByEmailAccessResponse [Unary]
+    + GetGrokBotMessagingCard(aiserver.v1.GetGrokBotMessagingCardRequest) -> aiserver.v1.GetGrokBotMessagingCardResponse [Unary]
+    + GetGrokBotPlaceDetails(aiserver.v1.GetGrokBotPlaceDetailsRequest) -> aiserver.v1.GetGrokBotPlaceDetailsResponse [Unary]
+    + GetGrokBotUserProfile(aiserver.v1.GetGrokBotUserProfileRequest) -> aiserver.v1.GetGrokBotUserProfileResponse [Unary]
+    + ListGrokBotCartItems(aiserver.v1.ListGrokBotCartItemsRequest) -> aiserver.v1.ListGrokBotCartItemsResponse [Unary]
+    + ListGrokBotTryOnImages(aiserver.v1.ListGrokBotTryOnImagesRequest) -> aiserver.v1.ListGrokBotTryOnImagesResponse [Unary]
+    + LookupGrokBotShoppingProduct(aiserver.v1.LookupGrokBotShoppingProductRequest) -> aiserver.v1.LookupGrokBotShoppingProductResponse [Unary]
+    + MakeGrokBotAgentFilePrivate(aiserver.v1.MakeGrokBotAgentFilePrivateRequest) -> aiserver.v1.MakeGrokBotAgentFilePrivateResponse [Unary]
+    + MakeGrokBotAgentSkillPrivate(aiserver.v1.MakeGrokBotAgentSkillPrivateRequest) -> aiserver.v1.MakeGrokBotAgentSkillPrivateResponse [Unary]
+    + PollGrokBotCalendarEvents(aiserver.v1.PollGrokBotCalendarEventsRequest) -> aiserver.v1.PollGrokBotCalendarEventsResponse [Unary]
+    + RemoveGrokBotCartItems(aiserver.v1.RemoveGrokBotCartItemsRequest) -> aiserver.v1.RemoveGrokBotCartItemsResponse [Unary]
+    + RemoveGrokBotOnboardingDripRouteInternal(aiserver.v1.RemoveGrokBotOnboardingDripRouteInternalRequest) -> aiserver.v1.GrokBotOnboardingDripRouter [Unary]
+    + ReorderGrokBotOnboardingDripRoutesInternal(aiserver.v1.ReorderGrokBotOnboardingDripRoutesInternalRequest) -> aiserver.v1.GrokBotOnboardingDripRouter [Unary]
+    + ReportGrokBotMessagingCapabilities(aiserver.v1.ReportGrokBotMessagingCapabilitiesRequest) -> aiserver.v1.ReportGrokBotMessagingCapabilitiesResponse [Unary]
+    + ReportSandBoxStoreFlush(aiserver.v1.ReportSandBoxStoreFlushRequest) -> aiserver.v1.ReportSandBoxStoreFlushResponse [Unary]
+    + ResolveGrokBotFlightBookingLink(aiserver.v1.ResolveGrokBotFlightBookingLinkRequest) -> aiserver.v1.ResolveGrokBotFlightBookingLinkResponse [Unary]
+    + SearchGrokBotSimilarProducts(aiserver.v1.SearchGrokBotSimilarProductsRequest) -> aiserver.v1.SearchGrokBotSimilarProductsResponse [Unary]
+    + SearchGrokBotTranscripts(aiserver.v1.SearchGrokBotTranscriptsRequest) -> aiserver.v1.SearchGrokBotTranscriptsResponse [Unary]
+    + SendGrokBotOnboardingDripStepNowInternal(aiserver.v1.SendGrokBotOnboardingDripStepNowInternalRequest) -> aiserver.v1.SendGrokBotOnboardingDripStepNowInternalResponse [Unary]
+    + SetGrokBotAgentRoutineForTeam(aiserver.v1.SetGrokBotAgentRoutineForTeamRequest) -> aiserver.v1.SetGrokBotAgentRoutineForTeamResponse [Unary]
+    + SetGrokBotCartItem(aiserver.v1.SetGrokBotCartItemRequest) -> aiserver.v1.SetGrokBotCartItemResponse [Unary]
+    + SetGrokBotOnboardingDripRouterStatusInternal(aiserver.v1.SetGrokBotOnboardingDripRouterStatusInternalRequest) -> aiserver.v1.GrokBotOnboardingDripRouter [Unary]
+    + SetGrokBotUserProfilePhoto(aiserver.v1.SetGrokBotUserProfilePhotoRequest) -> aiserver.v1.SetGrokBotUserProfilePhotoResponse [Unary]
+    + SetOnePasswordPreviousIntegration(aiserver.v1.SetOnePasswordPreviousIntegrationRequest) -> aiserver.v1.OnePasswordState [Unary]
+    + SummarizeGrokBotTeamReviewItems(aiserver.v1.SummarizeGrokBotTeamReviewItemsRequest) -> aiserver.v1.SummarizeGrokBotTeamReviewItemsResponse [Unary]
+    + UpdateGrokBotMeetingSettings(aiserver.v1.UpdateGrokBotMeetingSettingsRequest) -> aiserver.v1.UpdateGrokBotMeetingSettingsResponse [Unary]
+    + UpdateGrokBotOnboardingDripRouteInternal(aiserver.v1.UpdateGrokBotOnboardingDripRouteInternalRequest) -> aiserver.v1.GrokBotOnboardingDripRouter [Unary]
+    + WatchGrokBotCalendarEvents(aiserver.v1.WatchGrokBotCalendarEventsRequest) -> aiserver.v1.WatchGrokBotCalendarEventsEvent [ServerStreaming]

package/docs/protocol/baselines/full-schema-diff-0.79.2-to-0.79.3.txt

@@ -0,0 +1,23 @@
+====================================================================
+messages  2922 -> 2923   (+1 -0 ~1)
+enums     387 -> 387
+services  7 -> 7
+====================================================================
+
+--- new messages ---
+  + aiserver.v1.SetOnePasswordPreviousIntegrationRequest
+
+--- removed messages ---
+
+--- changed messages ---
+  ~ aiserver.v1.OnePasswordState
+      +4:uses_previous_integration:bool
+
+--- enum changes ---
+  (0 enums changed, +0 new, -0 removed)
+
+--- service / RPC changes ---
+  methods 661 -> 662
+
+  aiserver.v1.GrokBotService
+    + SetOnePasswordPreviousIntegration(aiserver.v1.SetOnePasswordPreviousIntegrationRequest) -> aiserver.v1.OnePasswordState [Unary]

package/docs/protocol/baselines/schema-0.79.3/README.md

@@ -0,0 +1,7 @@
+# Restored schema — Grok Bot 0.79.3 (Linux amd64, commit 4739412)
+
+`.proto` files: output of upstream `extract_proto.py` on the App's `proto.cjs` (static text parse), with trailing blank
+lines at EOF trimmed for `git diff --check`. `snapshot.json.gz`: unmodified extractor snapshot (gzip -9n).
+Hashes and provenance: [../../baseline-manifest.md](../../baseline-manifest.md). Not an official schema.
+
+The **formal** (always-current) copy of these `.proto` files lives at [`proto/`](../../../../proto/). This directory is the versioned freeze for 0.79.3.