grokbox 0.1.0-alpha.8 → 0.1.0

package/README.md

@@ -10,9 +10,9 @@ This project is not affiliated with or endorsed by Anysphere, Cursor, xAI, or
 Grok Bot. Grok Bot, Cursor, and related names identify compatible products and
 remain the property of their respective owners.
 
-> **Alpha:** current source is `0.1.0-alpha.8`. npm `next` currently points to
-> `0.1.0-alpha.7`; `0.0.1` remains `latest`. Prereleases publish only after
-> release checks and explicitly scoped external acceptance.
+> **Release:** current source is `0.1.0`. Stable versions publish to npm
+> `latest`; prereleases use `next`. Upstream-private compatibility adapters
+> remain experimental and subject to the documented acceptance limits.
 
 ## What it does
 
@@ -82,7 +82,7 @@ configured Profile is available, commands fail closed.
 ## Install
 
 ```bash
-npm install --global grokbox@next
+npm install --global grokbox@latest
 grokbox --version
 gbox --help
 ```
@@ -147,7 +147,7 @@ grokbox jobs list --table
 grokbox desktop status --table
 ```
 
-Routine reads expose bounded metadata only: prompt bodies, webhook credentials, native paths, and unknown provider fields stay private. Box-local Bots support create/update/enable/disable/delete; create always writes a disabled definition and later mutations require explicit confirmation plus the exact revision from a fresh `agents routines list/show`. Temporal Bots are Server-authoritative: list/show, webhook credential, enable/disable, and delete use the bounded Temporal Routine bridge; current upstream contracts do not expose Temporal definition create/update, so those commands refuse instead of writing the legacy Box store. `agents routines webhook credential <agent> <routine-id> --confirm` returns the URL while hiding the key; add `--reveal-key` only when secret output is explicitly required. Without the Host bridge, Temporal Routine reads fail closed rather than reporting a false empty list. Upstream Routine writes have no native compare-and-swap or idempotency contract, so an uncertain acknowledgement is never replayed automatically.
+Routine reads expose bounded metadata only: prompt bodies, webhook credentials, native paths, and unknown provider fields stay private. The same `agents routines list/show` and `agents routines webhook credential <agent> <routine-id> --confirm` commands use cloud SSOT when the selected Profile has `server.access_token_ref` (configure with `profile update <name> --server-access-token-ref file:/absolute/path/to/cloud-token`); otherwise they retain Gateway/Host behavior. Cloud keys are minted only after confirmation and reused from a scoped local cache; `--reveal-key` explicitly reveals the key, never a cloud prompt, and `--verify` never invokes the real Routine. Cloud reads are read-only; mutations retain the Host contract. Box-local create writes a disabled definition; later mutations require confirmation and a fresh revision. Temporal create/update remain unsupported. See the [Routine contract](docs/product-contract.md#711-native-routines) for setup, verification, and failure guidance.
 
 Mutating commands require explicit capability and, where destructive, explicit
 confirmation. `desktop prune run` defaults to dry-run; `--yes` invokes the

package/README.zh-CN.md

@@ -6,7 +6,7 @@
 
 本项目与 Anysphere、Cursor、xAI 或 Grok Bot 没有隶属或背书关系。Grok Bot、Cursor 及相关名称仅用于标识兼容产品，其权利归各自所有者。
 
-> **Alpha：** 当前源码版本是 `0.1.0-alpha.8`。npm 的 `next` dist-tag 目前指向 `0.1.0-alpha.7`；`0.0.1` 仍是 `latest`。只有通过发布检查及明确范围的外部验收后，才会发布新的预发布版本。
+> **发布：** 当前源码版本是 `0.1.0`。正式版发布到 npm `latest`，预发布版使用 `next`。上游私有接口的兼容适配器仍为实验性，遵守文档中的验收范围与限制。
 
 ## 它能做什么
 
@@ -70,7 +70,7 @@ bun run grokbox -- doctor
 ## 安装
 
 ```bash
-npm install --global grokbox@next
+npm install --global grokbox@latest
 grokbox --version
 gbox --help
 ```
@@ -128,7 +128,7 @@ grokbox jobs list --table
 grokbox desktop status --table
 ```
 
-Routine 读取只输出有界元数据，不暴露 prompt 正文、Webhook credential、原生路径或未知 provider 字段。Box-local Bot 支持 create/update/enable/disable/delete；create 始终只创建 disabled definition，后续 mutation 需要显式确认，并携带刚从 `agents routines list/show` 读到的精确 revision。Temporal Bot 的 Routine 以 Server 为权威：list/show、Webhook credential、enable/disable/delete 通过受限的 Temporal Routine bridge；当前官方合同没有暴露 Temporal definition create/update，因此 CLI 会明确拒绝，而不会误写旧 Box store。`agents routines webhook credential <agent> <routine-id> --confirm` 默认返回 URL 并隐藏 key；只有显式增加 `--reveal-key` 才把 key 输出到 stdout。Host bridge 不可用时，Temporal Routine 查询 fail-closed，不再冒充为空列表。上游 Routine 写接口没有 native compare-and-swap 或 idempotency 合同，因此回执不确定时不会自动重放。
+Routine 读取只输出有界元数据，不暴露 prompt 正文、Webhook credential、原生路径或未知 provider 字段。同一组 `agents routines list/show` 与 `agents routines webhook credential <agent> <routine-id> --confirm` 命令，在 selected Profile 配置 `server.access_token_ref` 时使用 cloud SSOT（通过 `profile update <name> --server-access-token-ref file:/absolute/path/to/cloud-token` 配置）；未配置时保留 Gateway/Host 行为。Cloud key 仅在确认后铸造，并从按范围隔离的本地缓存复用；`--reveal-key` 显式输出 key，但不输出 cloud prompt；`--verify` 从不调用真实 Routine。Cloud 读取为只读，mutation 保留现有 Host 合同。Box-local create 创建 disabled definition，后续 mutation 需要确认与 fresh revision；Temporal create/update 仍不支持。配置、验证与失败处理见 [Routine 合同](docs/product-contract.md#711-native-routines)。
 
 变更命令需要显式 capability；破坏性操作还需要显式确认。`desktop prune run` 默认 dry-run；传入 `--yes` 后会调用上游 stop-window 路径，并删除该 fork 的 Chrome profile。
 

package/dist/index.js

@@ -3201,9 +3201,9 @@ Expecting one of '${allowedValues.join("', '")}'`);
           helpWidth: context.helpWidth,
           outputHasColors: context.hasColors
         });
-        const text = helper.formatHelp(this, helper);
-        if (context.hasColors) return text;
-        return this._outputConfiguration.stripColor(text);
+        const text2 = helper.formatHelp(this, helper);
+        if (context.hasColors) return text2;
+        return this._outputConfiguration.stripColor(text2);
       }
       /**
        * @typedef HelpContext
@@ -3363,7 +3363,7 @@ Expecting one of '${allowedValues.join("', '")}'`);
        * @param {(string | Function)} text - string to add, or a function returning a string
        * @return {Command} `this` command for chaining
        */
-      addHelpText(position, text) {
+      addHelpText(position, text2) {
         const allowedValues = ["beforeAll", "before", "after", "afterAll"];
         if (!allowedValues.includes(position)) {
           throw new Error(`Unexpected value for position to addHelpText.
@@ -3372,10 +3372,10 @@ Expecting one of '${allowedValues.join("', '")}'`);
         const helpEvent = `${position}Help`;
         this.on(helpEvent, (context) => {
           let helpStr;
-          if (typeof text === "function") {
-            helpStr = text({ error: context.error, command: context.command });
+          if (typeof text2 === "function") {
+            helpStr = text2({ error: context.error, command: context.command });
           } else {
-            helpStr = text;
+            helpStr = text2;
           }
           if (helpStr) {
             context.write(`${helpStr}
@@ -3474,7 +3474,7 @@ import { fileURLToPath } from "node:url";
 // package.json
 var package_default = {
   name: "grokbox",
-  version: "0.1.0-alpha.8",
+  version: "0.1.0",
   packageManager: "bun@1.3.14",
   description: "Unofficial CLI and control plane for Grok Bot cloud computers",
   license: "MIT",
@@ -3675,6 +3675,8 @@ var LEAF_COMMANDS = [
       { flags: "--keepalive-interval-ms <n>", description: "Sandbox keeper interval" },
       { flags: "--quota-source <source>", description: "Explicit quota source (cursor-web)" },
       { flags: "--quota-access-token-ref <ref>", description: "Quota-only env:/file:/keychain: token reference" },
+      { flags: "--server-access-token-ref <ref>", description: "Grok Bot Server account token reference" },
+      { flags: "--server-backend-url <url>", description: "Grok Bot Server backend URL" },
       { flags: "--secret-stdin-file <field=path>", description: "Read one secret from stdin into a protected file" }
     ]),
     stdin: "secret",
@@ -3704,6 +3706,8 @@ var LEAF_COMMANDS = [
       { flags: "--keepalive-interval-ms <n>", description: "Sandbox keeper interval" },
       { flags: "--quota-source <source>", description: "Explicit quota source (cursor-web)" },
       { flags: "--quota-access-token-ref <ref>", description: "Quota-only env:/file:/keychain: token reference" },
+      { flags: "--server-access-token-ref <ref>", description: "Grok Bot Server account token reference" },
+      { flags: "--server-backend-url <url>", description: "Grok Bot Server backend URL" },
       { flags: "--secret-stdin-file <field=path>", description: "Read one secret from stdin into a protected file" }
     ]),
     stdin: "secret",
@@ -3995,7 +3999,7 @@ var LEAF_COMMANDS = [
   {
     path: ["agents", "routines", "list"],
     usage: "grokbox agents routines list <agent> [--json|--table]",
-    summary: "List one agent's bounded native Routine window without prompts or credentials.",
+    summary: "List one agent's cloud-backed Routine metadata without prompts or credentials.",
     arguments: [
       { syntax: "<agent>", description: "Agent ID or unambiguous name/title", role: "agent", kinds: ["agent"] }
     ],
@@ -4071,7 +4075,7 @@ var LEAF_COMMANDS = [
   },
   {
     path: ["agents", "routines", "webhook", "credential"],
-    usage: "grokbox agents routines webhook credential <agent> <routine-id> --confirm [--reveal-key]",
+    usage: "grokbox agents routines webhook credential <agent> <routine-id> --confirm [--reveal-key] [--verify]",
     summary: "Read or mint one webhook Routine credential; key is hidden unless explicitly revealed.",
     arguments: [
       { syntax: "<agent>", description: "Agent ID or unambiguous name/title", role: "agent", kinds: ["agent"] },
@@ -4079,7 +4083,8 @@ var LEAF_COMMANDS = [
     ],
     options: options([
       { flags: "--confirm", description: "Confirm credential access/mint", required: true },
-      { flags: "--reveal-key", description: "Include the sensitive webhook key in stdout" }
+      { flags: "--reveal-key", description: "Include the webhook key and routine prompt in stdout" },
+      { flags: "--verify", description: "Check the webhook key without invoking this Routine" }
     ], { timeout: true }),
     stdin: "none",
     table: false,
@@ -5153,18 +5158,18 @@ function asNumber(value, fallback = 0) {
 function asString(value, fallback = "") {
   return typeof value === "string" ? value : fallback;
 }
-function stripOneTrailingNewline(text) {
-  if (text.endsWith("\r\n")) return text.slice(0, -2);
-  if (text.endsWith("\n")) return text.slice(0, -1);
-  return text;
+function stripOneTrailingNewline(text2) {
+  if (text2.endsWith("\r\n")) return text2.slice(0, -2);
+  if (text2.endsWith("\n")) return text2.slice(0, -1);
+  return text2;
 }
 var UUID_V4 = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
 function assertUuidV4(value, name) {
   if (!UUID_V4.test(value)) throw usage(`${name} must be a UUID v4.`);
   return value;
 }
-function utf8Bytes(text) {
-  return new TextEncoder().encode(text).byteLength;
+function utf8Bytes(text2) {
+  return new TextEncoder().encode(text2).byteLength;
 }
 
 // src/config/profile.ts
@@ -5192,10 +5197,12 @@ var PROFILE_KEYS = /* @__PURE__ */ new Set([
   "daemon_socket",
   "ssh_host",
   "sandbox",
-  "quota"
+  "quota",
+  "server"
 ]);
 var SANDBOX_KEYS = /* @__PURE__ */ new Set(["access_token_ref", "keepalive_interval_ms"]);
 var QUOTA_KEYS = /* @__PURE__ */ new Set(["source", "access_token_ref"]);
+var SERVER_KEYS = /* @__PURE__ */ new Set(["access_token_ref", "backend_url"]);
 var GLOBAL_KEYS = /* @__PURE__ */ new Set(["version", "current_profile"]);
 var PROFILE_NAME = /^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/;
 var SSH_HOST = /^[A-Za-z0-9][A-Za-z0-9._:@-]{0,254}$/;
@@ -5313,6 +5320,19 @@ function validateProfile(input) {
     if (accessTokenRef === void 0) throw invalid("quota.access_token_ref is required.");
     quota = { source, access_token_ref: accessTokenRef };
   }
+  let server;
+  if (input.server !== void 0) {
+    if (!isRecord(input.server)) throw invalid("server must be an object.");
+    assertKnownKeys(input.server, SERVER_KEYS, "server");
+    const accessTokenRef = validateSecretRef(
+      optionalString(input.server, "access_token_ref"),
+      "server.access_token_ref"
+    );
+    if (accessTokenRef === void 0) throw invalid("server.access_token_ref is required.");
+    const backendUrl = validateUrl(optionalString(input.server, "backend_url"), "server.backend_url");
+    server = { access_token_ref: accessTokenRef, backend_url: backendUrl };
+    if (server.backend_url === void 0) delete server.backend_url;
+  }
   const profile = {
     version: 1,
     transport,
@@ -5328,7 +5348,8 @@ function validateProfile(input) {
       return value === void 0 ? void 0 : assertSshHost(value);
     })(),
     sandbox,
-    quota
+    quota,
+    server
   };
   for (const key of Object.keys(profile)) {
     if (profile[key] === void 0) delete profile[key];
@@ -5344,9 +5365,9 @@ function validateGlobalConfig(input) {
   return current === void 0 ? { version: 1 } : { version: 1, current_profile: current };
 }
 async function readJson(path, missing) {
-  let text;
+  let text2;
   try {
-    text = await readFile2(path, "utf8");
+    text2 = await readFile2(path, "utf8");
   } catch (error) {
     if (error.code === "ENOENT" && missing === "null") return null;
     if (error.code === "ENOENT") {
@@ -5355,7 +5376,7 @@ async function readJson(path, missing) {
     throw invalid("Configuration file is unreadable.");
   }
   try {
-    return JSON.parse(text);
+    return JSON.parse(text2);
   } catch {
     throw invalid("Configuration file is not valid JSON.");
   }
@@ -5695,13 +5716,13 @@ function lostResponse(method) {
   }
   return new CliError("daemon_unreachable", "Daemon is unreachable.", { retryable: true });
 }
-function parseResponse(text, status) {
+function parseResponse(text2, status) {
   if (status === 401 || status === 403) {
     throw new CliError("daemon_unauthorized", "Daemon rejected the shared credential.");
   }
   let parsed;
   try {
-    parsed = JSON.parse(text);
+    parsed = JSON.parse(text2);
   } catch {
     throw new CliError("daemon_unreachable", "Daemon returned invalid JSON.");
   }
@@ -5795,7 +5816,7 @@ var LocalDaemonClient = class extends VersionedDaemonClient {
           headers: { "content-type": "application/json", "content-length": Buffer.byteLength(body) }
         },
         (res) => {
-          let text = "";
+          let text2 = "";
           let bytes = 0;
           res.setEncoding("utf8");
           res.on("data", (chunk) => {
@@ -5804,12 +5825,12 @@ var LocalDaemonClient = class extends VersionedDaemonClient {
               req.destroy(new Error("response too large"));
               return;
             }
-            text += chunk;
+            text2 += chunk;
           });
           res.on("end", () => {
             cleanup();
             try {
-              resolve5(parseResponse(text, res.statusCode ?? 0));
+              resolve5(parseResponse(text2, res.statusCode ?? 0));
             } catch (error) {
               if (error instanceof CliError && error.code !== "daemon_unreachable") reject(error);
               else reject(lostResponse(method));
@@ -6511,10 +6532,10 @@ var GatewayClient = class {
     if (input.stream) {
       clearTimeout(timer);
       if (!response.ok) {
-        const text2 = await response.text();
+        const text3 = await response.text();
         let parsed;
         try {
-          parsed = text2.length === 0 ? null : JSON.parse(text2);
+          parsed = text3.length === 0 ? null : JSON.parse(text3);
         } catch {
           parsed = null;
         }
@@ -6522,9 +6543,9 @@ var GatewayClient = class {
       }
       return { status: response.status, body: null, text: "", response };
     }
-    let text = "";
+    let text2 = "";
     try {
-      text = await response.text();
+      text2 = await response.text();
     } catch {
       clearTimeout(timer);
       if (write) {
@@ -6538,14 +6559,14 @@ var GatewayClient = class {
       clearTimeout(timer);
     }
     let body = null;
-    if (text.length > 0) {
+    if (text2.length > 0) {
       try {
-        body = JSON.parse(text);
+        body = JSON.parse(text2);
       } catch {
         body = null;
       }
     }
-    return { status: response.status, body, text, response };
+    return { status: response.status, body, text: text2, response };
   }
   interpret(result) {
     if (result.status >= 200 && result.status < 300) return result;
@@ -6666,10 +6687,10 @@ function ioFromOpts(opts) {
 function rejectTable(table, allowed) {
   if (table && !allowed) throw usage("This command does not support --table.");
 }
-async function readPrompt(text, deps) {
+async function readPrompt(text2, deps) {
   let prompt;
-  if (text !== void 0) {
-    prompt = text;
+  if (text2 !== void 0) {
+    prompt = text2;
   } else if (deps.stdinIsTTY) {
     throw usage("Provide --text or pipe stdin. Interactive prompts are not supported.");
   } else {
@@ -8427,15 +8448,15 @@ function validateDaemonConfig(input) {
   };
 }
 async function readDaemonConfig(configDir) {
-  let text;
+  let text2;
   try {
-    text = await readFile5(daemonConfigPath(configDir), "utf8");
+    text2 = await readFile5(daemonConfigPath(configDir), "utf8");
   } catch (error) {
     if (error.code === "ENOENT") return { version: 1 };
     throw new CliError("profile_invalid", "Daemon config is unreadable.");
   }
   try {
-    return validateDaemonConfig(JSON.parse(text));
+    return validateDaemonConfig(JSON.parse(text2));
   } catch (error) {
     if (error instanceof CliError) throw error;
     throw new CliError("profile_invalid", "Daemon config is not valid JSON.");
@@ -8733,7 +8754,7 @@ function displayFromEnviron(environ) {
 }
 function inspectDesktopProc(cmdline) {
   const args = cmdline.split("\0").filter((part) => part.length > 0);
-  const text = args.join(" ");
+  const text2 = args.join(" ");
   let startWindow = NaN;
   for (const [index, arg] of args.entries()) {
     if (arg === "start-window" || arg.endsWith("/start-window") || arg.endsWith("/start-window.sh")) {
@@ -8745,7 +8766,7 @@ function inspectDesktopProc(cmdline) {
   const slash = Math.max(argv0.lastIndexOf("/"), argv0.lastIndexOf("\\"));
   const base = argv0.slice(slash + 1);
   const grok = base === "grok" || args.some((arg) => arg === "grok" || arg.endsWith("/grok"));
-  const taskTool = /\bTask\(/.test(text);
+  const taskTool = /\bTask\(/.test(text2);
   return {
     grok,
     task: taskTool,
@@ -10820,15 +10841,15 @@ var GovernedFilesystem = class _GovernedFilesystem {
       }
       const sha256 = createHash5("sha256").update(content).digest("hex");
       try {
-        const text = new TextDecoder("utf-8", { fatal: true }).decode(content);
-        if (!text.includes("\0")) {
+        const text2 = new TextDecoder("utf-8", { fatal: true }).decode(content);
+        if (!text2.includes("\0")) {
           return {
             path: target.remotePath,
             root: target.root.name,
             size: content.length,
             sha256,
             encoding: "utf8",
-            content: text
+            content: text2
           };
         }
       } catch {
@@ -11452,17 +11473,17 @@ async function readBody(req) {
   return body;
 }
 function writeResponse(res, status, body) {
-  const text = JSON.stringify(body);
+  const text2 = JSON.stringify(body);
   res.writeHead(status, {
     "content-type": "application/json",
-    "content-length": Buffer.byteLength(text)
+    "content-length": Buffer.byteLength(text2)
   });
-  res.end(text);
+  res.end(text2);
 }
-function parseRequest(text) {
+function parseRequest(text2) {
   let parsed;
   try {
-    parsed = JSON.parse(text);
+    parsed = JSON.parse(text2);
   } catch {
     throw new CliError("gateway_bad_request", "Daemon request is not valid JSON.");
   }
@@ -12848,10 +12869,10 @@ async function queryCursorWebQuota(deps, token, timeoutMs) {
         { failureCode: "unexpected_status", httpStatus: response.status }
       );
     }
-    const text = await readBoundedText(response);
+    const text2 = await readBoundedText(response);
     let payload;
     try {
-      payload = JSON.parse(text);
+      payload = JSON.parse(text2);
     } catch {
       throw protocolFailure("response_not_json");
     }
@@ -13342,8 +13363,8 @@ function redactJson(value, redacted) {
 }
 async function readJsonFile(path) {
   try {
-    const text = await readFile8(path, "utf8");
-    return JSON.parse(text);
+    const text2 = await readFile8(path, "utf8");
+    return JSON.parse(text2);
   } catch (error) {
     if (error.code === "ENOENT") return void 0;
     if (error instanceof SyntaxError) return void 0;
@@ -13429,19 +13450,19 @@ async function copyMemoryShard(sourceRoot, destRoot, shardDir, exportPrefix, lay
     });
   }
 }
-function tokenMatches(text, name) {
+function tokenMatches(text2, name) {
   if (name.length < 3) return false;
   const escaped = name.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-  return new RegExp(`(^|[^A-Za-z0-9_-])${escaped}([^A-Za-z0-9_-]|$)`).test(text);
+  return new RegExp(`(^|[^A-Za-z0-9_-])${escaped}([^A-Za-z0-9_-]|$)`).test(text2);
 }
-function collectWorkflowNames(text, known) {
+function collectWorkflowNames(text2, known) {
   const found = /* @__PURE__ */ new Set();
-  for (const match of text.matchAll(WORKFLOW_REF)) {
+  for (const match of text2.matchAll(WORKFLOW_REF)) {
     const name = match[1];
     if (name) found.add(name);
   }
   for (const name of known) {
-    if (tokenMatches(text, name)) found.add(name);
+    if (tokenMatches(text2, name)) found.add(name);
   }
   return [...found].sort();
 }
@@ -14143,18 +14164,18 @@ async function runFsWrite(deps, remotePath, raw) {
   const io = ioFromOpts(raw);
   const expectedSha256 = expectedHash(raw.expectedSha256);
   const client2 = await filesystemClient(deps, io.timeoutMs, FS_WRITE_CAPABILITY);
-  let text;
-  if (raw.text !== void 0) text = raw.text;
+  let text2;
+  if (raw.text !== void 0) text2 = raw.text;
   else if (deps.stdinIsTTY) throw usage("Provide --text or pipe stdin.");
-  else text = await deps.readStdin();
-  const content = Buffer.from(text, "utf8");
+  else text2 = await deps.readStdin();
+  const content = Buffer.from(text2, "utf8");
   if (content.length > FS_WRITE_MAX_BYTES) throw usage("Text write exceeds the 1 MiB limit.");
   const sha256 = createHash7("sha256").update(content).digest("hex");
   const operationId2 = deps.randomUUID();
   writeSuccess(deps.stdout, await mutationCall(client2, "fsWrite", {
     operationId: operationId2,
     path: remotePath,
-    contentUtf8: text,
+    contentUtf8: text2,
     ...expectedSha256 ? { expectedSha256 } : {}
   }, remotePath, { size: content.length, sha256 }));
 }
@@ -14789,6 +14810,15 @@ function patchFromOptions(raw) {
       });
     }
   }
+  if (raw.serverAccessTokenRef !== void 0 || raw.serverBackendUrl !== void 0) {
+    patch.server = {};
+    if (raw.serverAccessTokenRef !== void 0) {
+      patch.server.access_token_ref = raw.serverAccessTokenRef;
+    }
+    if (raw.serverBackendUrl !== void 0) {
+      patch.server.backend_url = raw.serverBackendUrl;
+    }
+  }
   const quotaSecret = raw.secretStdinFile?.startsWith("quota-access-token=") ?? false;
   if (raw.quotaSource !== void 0 || raw.quotaAccessTokenRef !== void 0 || quotaSecret) {
     if (raw.quotaSource !== "cursor-web") {
@@ -14863,7 +14893,8 @@ async function runProfileUpdate(deps, name, raw) {
   if (Object.keys(patch).length === 0) throw usage("profile update requires at least one connection option.");
   const sandbox = patch.sandbox ? { ...current?.sandbox ?? {}, ...patch.sandbox } : current?.sandbox;
   const quota = patch.quota ? { ...current?.quota ?? {}, ...patch.quota } : current?.quota;
-  const next = validateProfile({ version: 1, ...current ?? {}, ...patch, sandbox, quota });
+  const server = patch.server ? { ...current?.server ?? {}, ...patch.server } : current?.server;
+  const next = validateProfile({ version: 1, ...current ?? {}, ...patch, sandbox, quota, server });
   await persistSecretInput(deps, secretInput);
   await writeProfileFile(deps.configDir, name, next);
   writeSuccess(deps.stdout, { name, updated: true });
@@ -14882,6 +14913,7 @@ async function runProfileCapabilities(deps, name, raw) {
   const sandboxConfigured = Boolean(profile.sandbox?.access_token_ref);
   const sandboxCapability = sandboxConfigured ? "provider-authorization-dependent" : false;
   const quotaCapability = profile.quota?.access_token_ref ? "provider-authorization-dependent" : false;
+  const serverCapability = profile.server?.access_token_ref ? "provider-authorization-dependent" : false;
   writeSuccess(deps.stdout, {
     profile: profile.name,
     transport: profile.transport,
@@ -14908,11 +14940,494 @@ async function runProfileCapabilities(deps, name, raw) {
       "sandbox.inspect": sandboxCapability,
       "sandbox.wake": sandboxCapability,
       "sandbox.keepalive": sandboxCapability,
-      "quota.read": quotaCapability
+      "quota.read": quotaCapability,
+      "grok.routine.read": serverCapability || local || directGateway || daemon,
+      "grok.routine.webhook": serverCapability || local || directGateway || daemon
     }
   });
 }
 
+// src/server-routines.ts
+import { createHash as createHash8 } from "node:crypto";
+import { constants as constants4 } from "node:fs";
+import { mkdir as mkdir9, open as open6, lstat as lstat5, rename as rename6, unlink as unlink3 } from "node:fs/promises";
+import { join as join11 } from "node:path";
+var SERVER_ROUTINE_PATHS = {
+  listAgents: "/aiserver.v1.GrokBotService/ListGrokBotAgents",
+  listAutomations: "/aiserver.v1.GrokBotService/ListGrokBotAgentAutomations",
+  mintWebhookKey: "/aiserver.v1.DashboardService/CreateAutomationWebhookApiKey"
+};
+var DEFAULT_SERVER_BACKEND_URL = "https://api2.cursor.sh";
+var MAX_RESPONSE_BYTES2 = 8 * 1024 * 1024;
+var MAX_RECORD_BYTES = 512 * 1024;
+var MAX_KEY_BYTES = 4096;
+var MAX_AGENTS = 5e3;
+var MAX_ROUTINES = 100;
+var NIL_AUTOMATION_ID = "00000000-0000-5000-8000-000000000000";
+function protocolFailure2(failureCode) {
+  return new CliError(
+    "capability_unavailable",
+    "The Server Routine surface did not satisfy the supported bounded protocol.",
+    { failureCode }
+  );
+}
+function authorizationFailure2(failureCode) {
+  return new CliError(
+    "credential_invalid",
+    "The configured Server credential was not authorized for Routine access.",
+    { failureCode }
+  );
+}
+function varint(value) {
+  const bytes = [];
+  let rest = value;
+  while (rest > 127) {
+    bytes.push(rest & 127 | 128);
+    rest = Math.floor(rest / 128);
+  }
+  bytes.push(rest);
+  return Buffer.from(bytes);
+}
+function lengthDelimited(field, payload) {
+  return Buffer.concat([varint(field << 3 | 2), varint(payload.length), payload]);
+}
+function readVarint(buffer, offset) {
+  let value = 0n;
+  for (let index = 0; index < 10; index += 1) {
+    const byte = buffer[offset + index];
+    if (byte === void 0) throw protocolFailure2("truncated_varint");
+    if (index === 9 && byte > 1) throw protocolFailure2("varint_overflow");
+    value |= BigInt(byte & 127) << BigInt(index * 7);
+    if ((byte & 128) === 0) return { value, next: offset + index + 1 };
+  }
+  throw protocolFailure2("varint_overflow");
+}
+function decodeFields(buffer) {
+  const fields = [];
+  let offset = 0;
+  while (offset < buffer.length) {
+    const key = readVarint(buffer, offset);
+    offset = key.next;
+    if (key.value < 8n || key.value > 0xffffffffn) throw protocolFailure2("invalid_tag");
+    const number = Number(key.value >> 3n);
+    const wire = Number(key.value & 7n);
+    if (wire === 0) {
+      const value = readVarint(buffer, offset);
+      offset = value.next;
+      fields.push({ number, wire, value: value.value });
+    } else if (wire === 2) {
+      const size = readVarint(buffer, offset);
+      offset = size.next;
+      if (size.value > BigInt(buffer.length - offset)) throw protocolFailure2("truncated_field");
+      const length = Number(size.value);
+      fields.push({ number, wire, value: buffer.subarray(offset, offset + length) });
+      offset += length;
+    } else if (wire === 5) {
+      if (offset + 4 > buffer.length) throw protocolFailure2("truncated_field");
+      fields.push({ number, wire, value: buffer.subarray(offset, offset + 4) });
+      offset += 4;
+    } else if (wire === 1) {
+      if (offset + 8 > buffer.length) throw protocolFailure2("truncated_field");
+      fields.push({ number, wire, value: buffer.subarray(offset, offset + 8) });
+      offset += 8;
+    } else {
+      if (wire === 3) {
+        offset = skipGroup(buffer, offset, number, 0);
+        fields.push({ number, wire, value: 0n });
+        continue;
+      }
+      throw protocolFailure2("unsupported_wire_type");
+    }
+  }
+  return fields;
+}
+function skipGroup(buffer, start, expected, depth) {
+  if (depth > 32) throw protocolFailure2("group_depth_exceeded");
+  let offset = start;
+  while (offset < buffer.length) {
+    const tag = readVarint(buffer, offset);
+    if (tag.value < 8n || tag.value > 0xffffffffn) throw protocolFailure2("invalid_tag");
+    const number = Number(tag.value >> 3n);
+    const wire = Number(tag.value & 7n);
+    offset = tag.next;
+    if (wire === 4) {
+      if (number !== expected) throw protocolFailure2("group_mismatch");
+      return offset;
+    }
+    if (wire === 3) offset = skipGroup(buffer, offset, number, depth + 1);
+    else if (wire === 0) offset = readVarint(buffer, offset).next;
+    else if (wire === 1 || wire === 5) offset += wire === 1 ? 8 : 4;
+    else if (wire === 2) {
+      const size = readVarint(buffer, offset);
+      if (size.value > BigInt(buffer.length - size.next)) throw protocolFailure2("truncated_field");
+      offset = size.next + Number(size.value);
+    } else throw protocolFailure2("unsupported_wire_type");
+    if (offset > buffer.length) throw protocolFailure2("truncated_field");
+  }
+  throw protocolFailure2("truncated_group");
+}
+function firstBytes(fields, number) {
+  const hits = fields.filter((field) => field.number === number);
+  if (hits.length > 1 || hits.length === 1 && hits[0].wire !== 2) {
+    throw protocolFailure2("invalid_required_field");
+  }
+  const value = hits[0]?.value;
+  return value instanceof Buffer ? value : void 0;
+}
+function text(buffer) {
+  try {
+    return buffer === void 0 ? "" : new TextDecoder("utf-8", { fatal: true }).decode(buffer);
+  } catch {
+    throw protocolFailure2("invalid_utf8");
+  }
+}
+function webhookUrlFor(backendUrl, serverId) {
+  return new URL(`/automations/webhook/${encodeURIComponent(serverId)}`, normalizedBackend(backendUrl)).toString();
+}
+function normalizedBackend(backendUrl) {
+  let parsed;
+  try {
+    parsed = new URL(backendUrl);
+  } catch {
+    throw new CliError("profile_invalid", "Server backend URL is invalid.");
+  }
+  const loopback = parsed.hostname === "localhost" || parsed.hostname === "[::1]" || /^127(?:\.[0-9]{1,3}){3}$/.test(parsed.hostname);
+  if (parsed.protocol !== "https:" && !(parsed.protocol === "http:" && loopback) || parsed.username || parsed.password || backendUrl.includes("?") || backendUrl.includes("#") || parsed.pathname !== "/") {
+    throw new CliError("profile_invalid", "Server backend must be an HTTPS origin (HTTP only on loopback), without credentials, query, or fragment.");
+  }
+  return parsed.toString();
+}
+async function readBounded2(response, limit) {
+  const declared = response.headers.get("content-length");
+  if (declared !== null) {
+    const bytes = Number(declared);
+    if (!Number.isSafeInteger(bytes) || bytes < 0 || bytes > limit) {
+      throw protocolFailure2("response_oversized");
+    }
+  }
+  if (!response.body) return Buffer.alloc(0);
+  const reader = response.body.getReader();
+  const chunks = [];
+  let total = 0;
+  try {
+    for (; ; ) {
+      const { done, value } = await reader.read();
+      if (done) break;
+      total += value.byteLength;
+      if (total > limit) {
+        await reader.cancel().catch(() => void 0);
+        throw protocolFailure2("response_oversized");
+      }
+      chunks.push(Buffer.from(value));
+    }
+  } finally {
+    reader.releaseLock();
+  }
+  return Buffer.concat(chunks);
+}
+async function call(deps, backendUrl, token, path, body, timeoutMs) {
+  const controller2 = new AbortController();
+  const abort2 = () => controller2.abort();
+  if (deps.signal?.aborted) controller2.abort();
+  else deps.signal?.addEventListener("abort", abort2, { once: true });
+  const timer = setTimeout(() => controller2.abort(), timeoutMs);
+  const cleanup = () => {
+    clearTimeout(timer);
+    deps.signal?.removeEventListener("abort", abort2);
+  };
+  let response;
+  try {
+    if (controller2.signal.aborted) throw new Error("aborted");
+    response = await deps.fetch(new URL(path, normalizedBackend(backendUrl)).toString(), {
+      method: "POST",
+      headers: {
+        accept: "application/proto",
+        "content-type": "application/proto",
+        authorization: `Bearer ${token}`
+      },
+      body: new Uint8Array(body),
+      cache: "no-store",
+      redirect: "manual",
+      signal: controller2.signal
+    });
+  } catch {
+    cleanup();
+    throw new CliError(
+      "gateway_unreachable",
+      controller2.signal.aborted ? "The Server Routine request timed out." : "The Server Routine endpoint is unreachable.",
+      { failureCode: controller2.signal.aborted ? "request_timeout" : "network_failure", retryable: true }
+    );
+  }
+  try {
+    if (controller2.signal.aborted) {
+      await response.body?.cancel().catch(() => void 0);
+      throw protocolFailure2("request_cancelled");
+    }
+    if (response.redirected || response.status >= 300 && response.status < 400) {
+      await response.body?.cancel().catch(() => void 0);
+      throw protocolFailure2("redirect_refused");
+    }
+    if (response.status === 401 || response.status === 403) {
+      const detail = await readBounded2(response, MAX_RESPONSE_BYTES2).then((buffer) => buffer.toString("utf8")).catch(() => "");
+      throw authorizationFailure2(authorizationFailureCode(detail));
+    }
+    if (response.status === 404) {
+      await response.body?.cancel().catch(() => void 0);
+      throw new CliError("target_not_found", "The Server does not know that Routine.", {
+        failureCode: "routine_not_found",
+        httpStatus: 404
+      });
+    }
+    if (response.status === 408 || response.status === 429 || response.status >= 500) {
+      await response.body?.cancel().catch(() => void 0);
+      throw new CliError("gateway_unreachable", "The Server Routine endpoint refused the request.", {
+        failureCode: "provider_refused",
+        httpStatus: response.status,
+        retryable: true
+      });
+    }
+    if (response.status !== 200) {
+      await response.body?.cancel().catch(() => void 0);
+      throw new CliError(
+        "capability_unavailable",
+        "The Server Routine method is unavailable for this credential.",
+        { failureCode: "unexpected_status", httpStatus: response.status }
+      );
+    }
+    if (response.headers.get("content-type")?.split(";")[0]?.trim().toLowerCase() !== "application/proto") {
+      await response.body?.cancel().catch(() => void 0);
+      throw protocolFailure2("response_content_type_invalid");
+    }
+    return await readBounded2(response, MAX_RESPONSE_BYTES2);
+  } catch (error) {
+    if (error instanceof CliError) throw error;
+    throw new CliError(
+      "gateway_unreachable",
+      controller2.signal.aborted ? "The Server Routine request timed out." : "The Server Routine response could not be read.",
+      { failureCode: controller2.signal.aborted ? "request_timeout" : "response_unreadable", retryable: true }
+    );
+  } finally {
+    cleanup();
+  }
+}
+function authorizationFailureCode(detail) {
+  if (/Only the automation owner/i.test(detail)) return "not_routine_owner";
+  if (/missing required scope/i.test(detail)) return "scope_mismatch";
+  if (/Invalid API key/i.test(detail)) return "invalid_api_key";
+  if (/ERROR_NOT_LOGGED_IN|not logged in/i.test(detail)) return "not_signed_in";
+  return "credential_refused";
+}
+async function listServerAgents(deps, options2) {
+  const body = await call(deps, options2.backendUrl, options2.token, SERVER_ROUTINE_PATHS.listAgents, Buffer.alloc(0), options2.timeoutMs);
+  const agents = [];
+  const seen = /* @__PURE__ */ new Set();
+  const fields = decodeFields(body);
+  const truncated = fields.filter((field) => field.number === 3);
+  if (truncated.length > 1 || truncated[0] && truncated[0].wire !== 0) throw protocolFailure2("agent_truncation_invalid");
+  if (truncated[0] && truncated[0].value !== 0n) throw protocolFailure2("agent_roster_truncated");
+  for (const field of fields) {
+    if (field.number !== 1) continue;
+    if (!(field.value instanceof Buffer) || field.wire !== 2) throw protocolFailure2("agent_envelope_invalid");
+    const inner = decodeFields(field.value);
+    const id = text(firstBytes(inner, 12));
+    if (!/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(id) || seen.has(id)) {
+      throw protocolFailure2("agent_id_invalid");
+    }
+    seen.add(id);
+    const kinds = inner.filter((field2) => field2.number === 19);
+    if (kinds.length > 1 || kinds[0] && kinds[0].wire !== 0) throw protocolFailure2("agent_kind_invalid");
+    const kind = kinds[0]?.value ?? 0n;
+    if (kind !== 0n && kind !== 1n && kind !== 2n) throw protocolFailure2("agent_kind_unknown");
+    const harness = text(firstBytes(inner, 13));
+    const name = text(firstBytes(inner, 3));
+    if (name.length > 512 || /[\x00-\x1f\x7f]/.test(name)) throw protocolFailure2("agent_name_invalid");
+    agents.push({
+      id,
+      name,
+      harness: harness === "temporal" || harness === "box" ? harness : null,
+      isGroup: kind === 2n
+    });
+    if (agents.length > MAX_AGENTS) throw protocolFailure2("too_many_agents");
+  }
+  return agents;
+}
+async function listServerRoutines(deps, options2) {
+  const body = await call(
+    deps,
+    options2.backendUrl,
+    options2.token,
+    SERVER_ROUTINE_PATHS.listAutomations,
+    lengthDelimited(1, Buffer.from(options2.agentId, "utf8")),
+    options2.timeoutMs
+  );
+  const records = [];
+  const serverIds = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const field of decodeFields(body)) {
+    if (field.number !== 1) continue;
+    if (!(field.value instanceof Buffer) || field.wire !== 2) throw protocolFailure2("routine_envelope_invalid");
+    const inner = decodeFields(field.value);
+    const serverId = text(firstBytes(inner, 1));
+    const recordBytes = firstBytes(inner, 2);
+    if (!/^[A-Za-z0-9][A-Za-z0-9_-]{0,255}$/.test(serverId) || seen.has(serverId)) {
+      throw protocolFailure2("server_id_invalid");
+    }
+    if (recordBytes === void 0) throw protocolFailure2("record_missing");
+    if (recordBytes.length > MAX_RECORD_BYTES) throw protocolFailure2("record_oversized");
+    const json = text(recordBytes);
+    let record3;
+    try {
+      record3 = JSON.parse(json);
+    } catch {
+      throw protocolFailure2("record_not_json");
+    }
+    if (!isRecord(record3)) throw protocolFailure2("record_not_object");
+    seen.add(serverId);
+    records.push(record3);
+    serverIds.push(serverId);
+    if (records.length > MAX_ROUTINES) throw protocolFailure2("too_many_routines");
+  }
+  try {
+    return projectNativeRoutines(options2.agentId, records).catalog.routines.map((routine, index) => ({
+      ...routine,
+      mutable: false,
+      serverId: serverIds[index],
+      webhookUrl: routine.trigger.type === "webhook" ? webhookUrlFor(options2.backendUrl, serverIds[index]) : null
+    }));
+  } catch (error) {
+    if (error instanceof CliError) throw error;
+    throw protocolFailure2("routine_record_invalid");
+  }
+}
+function assertWebhookKey(value) {
+  if (value.length < 1 || Buffer.byteLength(value, "utf8") > MAX_KEY_BYTES || /[\x00-\x20\x7f]/.test(value)) {
+    throw protocolFailure2("key_invalid");
+  }
+  return value;
+}
+async function mintWebhookKey(deps, options2) {
+  const body = await call(
+    deps,
+    options2.backendUrl,
+    options2.token,
+    SERVER_ROUTINE_PATHS.mintWebhookKey,
+    lengthDelimited(1, Buffer.from(options2.serverId, "utf8")),
+    options2.timeoutMs
+  );
+  const key = text(firstBytes(decodeFields(body), 1));
+  if (key.length === 0) throw protocolFailure2("key_missing");
+  return assertWebhookKey(key);
+}
+async function probeWebhookKey(deps, options2) {
+  if (options2.serverId === NIL_AUTOMATION_ID) throw protocolFailure2("unsafe_probe_target");
+  const controller2 = new AbortController();
+  const abort2 = () => controller2.abort();
+  if (deps.signal?.aborted) controller2.abort();
+  else deps.signal?.addEventListener("abort", abort2, { once: true });
+  const timer = setTimeout(abort2, options2.timeoutMs);
+  try {
+    if (controller2.signal.aborted) throw protocolFailure2("request_cancelled");
+    const response = await deps.fetch(webhookUrlFor(options2.backendUrl, NIL_AUTOMATION_ID), {
+      method: "POST",
+      headers: { authorization: `Bearer ${options2.key}`, "content-type": "application/json" },
+      body: "{}",
+      cache: "no-store",
+      redirect: "manual",
+      signal: controller2.signal
+    });
+    const detail = JSON.parse(text(await readBounded2(response, 64 * 1024)));
+    if (controller2.signal.aborted) throw protocolFailure2("request_cancelled");
+    if (!response.redirected && response.status === 401 && isRecord(detail) && detail.code === "error") {
+      if (detail.message === `User API key missing required scope: automation:${NIL_AUTOMATION_ID}`) return true;
+      if (detail.message === "Invalid API key") return false;
+    }
+    throw protocolFailure2("verification_unknown");
+  } catch (error) {
+    if (error instanceof CliError) throw error;
+    throw protocolFailure2(controller2.signal.aborted ? "request_cancelled" : "verification_unknown");
+  } finally {
+    clearTimeout(timer);
+    deps.signal?.removeEventListener("abort", abort2);
+  }
+}
+async function cachedWebhookKey(deps, options2) {
+  if (options2.routine.createdAtMs === null) throw protocolFailure2("routine_incarnation_missing");
+  const scope = createHash8("sha256").update(JSON.stringify([
+    normalizedBackend(options2.backendUrl),
+    createHash8("sha256").update(options2.token).digest("hex"),
+    options2.agentId,
+    options2.routine.serverId,
+    options2.routine.createdAtMs
+  ])).digest("hex");
+  const directory = join11(options2.configDir, "server-webhook-keys");
+  const path = join11(directory, `${scope}.json`);
+  const lockPath = join11(directory, `${scope}.lock`);
+  let lock;
+  let temporary;
+  let preserveLock = false;
+  try {
+    await mkdir9(directory, { recursive: true, mode: 448 });
+    const dir = await lstat5(directory);
+    if (!dir.isDirectory() || (dir.mode & 63) !== 0 || process.getuid && dir.uid !== process.getuid()) throw protocolFailure2("key_store_permissions");
+    lock = await open6(lockPath, constants4.O_CREAT | constants4.O_EXCL | constants4.O_WRONLY | constants4.O_NOFOLLOW, 384);
+    let cached;
+    try {
+      cached = await open6(path, constants4.O_RDONLY | constants4.O_NOFOLLOW);
+    } catch (error) {
+      if (!isRecord(error) || error.code !== "ENOENT") throw error;
+    }
+    if (cached) {
+      try {
+        const stat6 = await cached.stat();
+        if (!stat6.isFile() || (stat6.mode & 63) !== 0 || stat6.nlink !== 1 || stat6.size > 8192 || process.getuid && stat6.uid !== process.getuid()) throw protocolFailure2("key_store_permissions");
+        const bytes = Buffer.alloc(8193);
+        const { bytesRead } = await cached.read(bytes, 0, bytes.length, 0);
+        if (bytesRead > 8192) throw protocolFailure2("key_store_corrupt");
+        const record3 = JSON.parse(text(bytes.subarray(0, bytesRead)));
+        if (!isRecord(record3) || record3.version !== 1 || record3.scope !== scope || typeof record3.key !== "string" || Object.keys(record3).length !== 3) throw protocolFailure2("key_store_corrupt");
+        return assertWebhookKey(record3.key);
+      } finally {
+        await cached.close();
+      }
+    }
+    if (deps.signal?.aborted) throw protocolFailure2("request_cancelled");
+    temporary = join11(directory, `${scope}.${process.pid}.${crypto.randomUUID()}.tmp`);
+    const output = await (deps.openWebhookKeyStore ?? open6)(temporary, constants4.O_CREAT | constants4.O_EXCL | constants4.O_WRONLY | constants4.O_NOFOLLOW, 384);
+    try {
+      if (deps.signal?.aborted) throw protocolFailure2("request_cancelled");
+      preserveLock = true;
+      const key = await mintWebhookKey(deps, { ...options2, serverId: options2.routine.serverId });
+      await output.writeFile(JSON.stringify({ version: 1, scope, key }), "utf8");
+      await output.sync();
+      await output.close();
+      await rename6(temporary, path);
+      temporary = void 0;
+      preserveLock = false;
+      return key;
+    } finally {
+      await output.close().catch(() => void 0);
+    }
+  } catch (error) {
+    if (error instanceof CliError && (error.code === "credential_invalid" || error.code === "target_not_found" || error.httpStatus !== void 0 && error.httpStatus >= 400 && error.httpStatus < 500 && error.httpStatus !== 408)) {
+      preserveLock = false;
+    }
+    if (preserveLock) {
+      throw new CliError("operation_outcome_unknown", "Webhook key mint outcome is unknown; no automatic retry is safe. Inspect the protected store lock before another attempt.", {
+        failureCode: "mint_outcome_unknown",
+        retryable: false
+      });
+    }
+    if (error instanceof CliError) throw error;
+    throw protocolFailure2("key_store_unavailable");
+  } finally {
+    if (temporary) await unlink3(temporary).catch(() => void 0);
+    if (lock) {
+      await lock.close();
+      if (!preserveLock) await unlink3(lockPath).catch(() => void 0);
+    }
+  }
+}
+
 // src/commands/routines.ts
 function routineCliError(error) {
   if (error instanceof CliError) return error;
@@ -14984,7 +15499,8 @@ async function resolveRoutineAuthority(client2, agent, timeoutMs) {
     if (error instanceof CliError && ["gateway_not_found", "gateway_bad_request", "capability_unavailable"].includes(error.code)) {
       throw new CliError(
         "capability_unavailable",
-        "This Temporal Bot requires the Grokbox Temporal Routine bridge before Routine state can be read safely."
+        "This Temporal Bot requires the Grokbox Temporal Routine bridge, or an explicit server.access_token_ref in the selected Profile, before Routine state can be read safely.",
+        { failureCode: "routine_bridge_missing" }
       );
     }
     throw error;
@@ -15009,25 +15525,46 @@ async function readSnapshot(client2, agent, timeoutMs) {
     throw new CliError("gateway_conflict", "Gateway generation changed while reading Routines.");
   }
   try {
+    const projected = projectNativeRoutines(agent.id, response.result);
     return {
-      ...projectNativeRoutines(agent.id, response.result),
+      ...projected,
       discovery,
-      authority: authority.authority
+      authority: authority.authority,
+      prompts: nativePrompts(response.result, projected.catalog)
     };
   } catch (error) {
     throw routineCliError(error);
   }
 }
-function findRoutine(snapshot, id) {
-  let rid;
-  try {
-    rid = routineId(id);
-  } catch (error) {
-    throw routineCliError(error);
+function nativePrompts(value, catalog) {
+  if (!Array.isArray(value)) throw new RoutineError("unsupported_shape");
+  const prompts = /* @__PURE__ */ new Map();
+  for (const raw of value) {
+    if (!isRecord(raw) || typeof raw.id !== "string" || typeof raw.prompt !== "string" || raw.prompt.length < 1 || raw.prompt.includes("\0") || Buffer.byteLength(raw.prompt) > 128 * 1024) {
+      throw new RoutineError("unsupported_shape");
+    }
+    prompts.set(raw.id, raw.prompt);
   }
-  const row = snapshot.catalog.routines.find((routine) => routine.id === rid);
-  if (!row) throw routineCliError(new RoutineError("not_found_in_window"));
-  return row;
+  for (const routine of catalog.routines) {
+    if (!prompts.has(routine.id)) throw new RoutineError("unsupported_shape");
+  }
+  return prompts;
+}
+function findRoutine(snapshot, target, allowName = false) {
+  const exact = snapshot.catalog.routines.find((routine) => routine.id === target);
+  if (exact) return exact;
+  if (!allowName) {
+    try {
+      routineId(target);
+    } catch (error) {
+      throw routineCliError(error);
+    }
+    throw routineCliError(new RoutineError("not_found_in_window"));
+  }
+  const named = snapshot.catalog.routines.filter((routine) => routine.name.toLocaleLowerCase() === target.toLocaleLowerCase());
+  if (named.length > 1) throw new CliError("target_ambiguous", "Routine name matched more than one Routine.");
+  if (!named[0]) throw routineCliError(new RoutineError("not_found_in_window"));
+  return named[0];
 }
 function mutableRoutine(snapshot, id) {
   const row = findRoutine(snapshot, id);
@@ -15088,7 +15625,7 @@ async function listOrShow(deps, client2, action, agentTarget, routineTarget, raw
     writeSuccess(deps.stdout, { ...snapshot.catalog, authority: snapshot.authority }, snapshot.discovery);
     return;
   }
-  const routine = findRoutine(snapshot, routineTarget ?? "");
+  const routine = findRoutine(snapshot, routineTarget ?? "", true);
   writeSuccess(
     deps.stdout,
     { schemaVersion: 1, agentId: agent.id, authority: snapshot.authority, routine, coverage: snapshot.catalog.coverage },
@@ -15281,10 +15818,13 @@ async function setRoutineEnabled(deps, client2, agentTarget, routineTarget, acti
 }
 async function showWebhookCredential(deps, client2, agentTarget, routineTarget, raw) {
   requireConfirmed(raw);
+  if (raw.verify === true) {
+    throw new CliError("capability_unavailable", "Webhook key verification requires an explicit cloud credential in the selected Profile; Host-provided credentials are not sent to additional endpoints.");
+  }
   const io = ioFromOpts(raw);
   const agent = await resolveAgent(client2, agentTarget, io.timeoutMs);
   const snapshot = await readSnapshot(client2, agent, io.timeoutMs);
-  const routine = findRoutine(snapshot, routineTarget);
+  const routine = findRoutine(snapshot, routineTarget, true);
   if (routine.trigger.type !== "webhook") {
     throw new CliError("capability_unavailable", "Routine is not webhook-triggered.");
   }
@@ -15305,6 +15845,10 @@ async function showWebhookCredential(deps, client2, agentTarget, routineTarget,
   if (url.protocol !== "https:" || url.username || url.password || url.hash) {
     throw new CliError("gateway_internal", "Gateway returned an unsafe webhook URL.");
   }
+  const prompt = snapshot.prompts.get(routine.id);
+  if (prompt === void 0) {
+    throw new CliError("gateway_internal", "Gateway returned a Routine without a prompt.");
+  }
   const revealKey = raw.revealKey === true;
   writeSuccess(deps.stdout, {
     schemaVersion: 1,
@@ -15314,7 +15858,8 @@ async function showWebhookCredential(deps, client2, agentTarget, routineTarget,
     url: url.toString(),
     keyPresent: true,
     keyIncluded: revealKey,
-    ...revealKey ? { key: response.result.key } : {}
+    promptIncluded: revealKey,
+    ...revealKey ? { key: response.result.key, prompt } : {}
   }, discovery);
 }
 async function deleteRoutine(deps, client2, agentTarget, routineTarget, raw) {
@@ -15359,7 +15904,58 @@ async function deleteRoutine(deps, client2, agentTarget, routineTarget, raw) {
     })
   }, after.discovery);
 }
+async function cloudRoutines(deps, action, agentTarget, routineTarget, raw) {
+  if (action === "webhook-credential") requireConfirmed(raw);
+  const io = ioFromOpts(raw);
+  const context = {
+    backendUrl: normalizedBackend(deps.serverBackendUrl ?? DEFAULT_SERVER_BACKEND_URL),
+    token: await resolveSecretRef(deps, deps.serverAccessTokenRef),
+    timeoutMs: io.timeoutMs
+  };
+  const agents = await listServerAgents(deps, context);
+  const agent = findRosterRow(agents, agentTarget, ["agent"]);
+  const agentId = asString(agent.id);
+  const routines = await listServerRoutines(deps, { ...context, agentId });
+  const coverage = { kind: "native_returned_window", limit: 100, atLimit: routines.length === 100, complete: false };
+  const catalog = { schemaVersion: 1, agentId, routines, coverage };
+  if (action === "list") {
+    if (io.table) deps.stdout.write(listTable(catalog));
+    else writeSuccess(deps.stdout, { ...catalog, authority: "server-temporal" });
+    return;
+  }
+  let selected = routines.filter((routine2) => routine2.id === routineTarget || routine2.serverId === routineTarget);
+  if (selected.length === 0) {
+    selected = routines.filter((routine2) => routine2.name.toLocaleLowerCase() === (routineTarget ?? "").toLocaleLowerCase());
+  }
+  if (selected.length > 1) throw new CliError("target_ambiguous", "Routine target matched more than one Routine.");
+  const routine = selected[0];
+  if (!routine) throw new CliError("target_not_found", "No Routine matched that ID or name in the configured cloud account; no other identity was searched.");
+  if (action === "show") {
+    writeSuccess(deps.stdout, { schemaVersion: 1, agentId, authority: "server-temporal", routine, coverage });
+    return;
+  }
+  if (routine.trigger.type !== "webhook") throw new CliError("capability_unavailable", "Routine is not webhook-triggered.");
+  const key = await cachedWebhookKey(deps, { ...context, configDir: deps.configDir, agentId, routine });
+  const keyLive = raw.verify === true ? await probeWebhookKey(deps, { ...context, key, serverId: routine.serverId }) : void 0;
+  writeSuccess(deps.stdout, {
+    schemaVersion: 1,
+    agentId,
+    routineId: routine.id,
+    serverId: routine.serverId,
+    authority: "server-temporal",
+    url: routine.webhookUrl,
+    keyPresent: true,
+    keyIncluded: raw.revealKey === true,
+    promptIncluded: false,
+    ...keyLive === void 0 ? {} : { keyLive },
+    ...raw.revealKey === true ? { key } : {}
+  });
+}
 async function runRoutines(deps, action, agentTarget, routineTarget, raw) {
+  if (deps.serverAccessTokenRef !== void 0 && (action === "list" || action === "show" || action === "webhook-credential")) {
+    await cloudRoutines(deps, action, agentTarget, routineTarget, raw);
+    return;
+  }
   const client2 = new GatewayClient(deps);
   if (action === "list" || action === "show") {
     await listOrShow(deps, client2, action, agentTarget, routineTarget, raw);
@@ -15429,11 +16025,11 @@ async function runSend(deps, target, raw) {
 }
 
 // src/skills.ts
-import { join as join11 } from "node:path";
+import { join as join12 } from "node:path";
 var CORE_SKILL_NAME = "core";
 var CORE_SKILL_SUMMARY = "Core grokbox usage guide.";
 async function loadCoreMarkdown(deps, full) {
-  const overview = await deps.readFile(join11(deps.skillsDir, "core.md"));
+  const overview = await deps.readFile(join12(deps.skillsDir, "core.md"));
   if (!full) return overview.trimEnd() + "\n";
   return `${overview.trimEnd()}
 
@@ -15496,9 +16092,9 @@ var FAMILY_DESCRIPTIONS = {
   is: "Read state projections"
 };
 function publicCommanderMessage(error) {
-  const text = error.message.replace(/^error: /i, "").trim();
-  if (/bearer|authorization|token/i.test(text)) return "Invalid usage.";
-  return text.length > 0 ? text : "Invalid usage.";
+  const text2 = error.message.replace(/^error: /i, "").trim();
+  if (/bearer|authorization|token/i.test(text2)) return "Invalid usage.";
+  return text2.length > 0 ? text2 : "Invalid usage.";
 }
 function unexpectedMessage(error) {
   if (error instanceof Error) {
@@ -15637,6 +16233,8 @@ function addLeaf(deps, program2, parents, leaf, action) {
         sandboxKeepaliveIntervalMs: profile.sandbox?.keepalive_interval_ms,
         quotaSource: profile.quota?.source,
         quotaAccessTokenRef: profile.quota?.access_token_ref,
+        serverAccessTokenRef: profile.server?.access_token_ref,
+        serverBackendUrl: profile.server?.backend_url,
         gatewayServerUrl: profile.gateway_url,
         gatewayTokenRef: profile.gateway_token_ref,
         gatewayHeadersRef: profile.gateway_headers_ref,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "grokbox",
-  "version": "0.1.0-alpha.8",
+  "version": "0.1.0",
   "packageManager": "bun@1.3.14",
   "description": "Unofficial CLI and control plane for Grok Bot cloud computers",
   "license": "MIT",

package/skills/core.md

@@ -41,6 +41,10 @@ grokbox box wake
 grokbox box keepalive status
 grokbox agents list --table
 grokbox agents routines list <agent> --table
+grokbox profile update <name> --server-access-token-ref file:/absolute/path/to/cloud-token
+grokbox profile use <name>
+grokbox agents routines show <agent> <routine-id>
+grokbox agents routines webhook credential <agent> <routine-id> --confirm --verify
 grokbox groups list --table
 grokbox send <target> --text "hello"
 grokbox history tail <target> --limit 50
@@ -72,7 +76,8 @@ Targets accept an exact ID first, then an unambiguous case-insensitive name/titl
    `groups list/show/create/update/delete` only own product groups. Membership is only
    `groups members list/add/remove/set`; every member must resolve to a non-group agent and a group
    must retain 1-6 unique members.
-3. **Manage native Routines**: `agents routines list/show` returns bounded metadata only and never emits prompt bodies, credentials, or native paths. Box-local Bots support create/update/enable/disable/delete; create writes a disabled definition and later mutations require `--expect-revision` from a fresh read plus `--confirm`. Temporal Bots are Server-authoritative: list/show, webhook credential, enable/disable, and delete require the bounded Temporal Routine Host bridge; create/update refuse because the current official Temporal contract exposes neither mutation. `agents routines webhook credential <agent> <routine-id> --confirm` hides the key by default; `--reveal-key` is the explicit secret-output boundary. Without the bridge, Temporal reads fail closed instead of reporting the legacy local store. Native writes have no upstream CAS or idempotency guarantee; uncertain writes return `operation_outcome_unknown` and must be reconciled by another read, never automatic replay.
+3. **Manage Routines through one interface**: `agents routines list/show` and `agents routines webhook credential <agent> <routine-id>` use the selected box Profile's cloud SSOT whenever `server.access_token_ref` is configured. Configure with `profile add/update --server-access-token-ref` and optional `--server-backend-url`, using a protected secret reference. Cloud reads preserve envelopes and bounded metadata with `serverId`, webhook URL, and `mutable:false`, never keys or prompts. The Server-returned automation ID is authoritative. There is no separate command root, source flag, desktop discovery, or roster union. First credential access needs `--confirm` to mint; repeated access reuses a local cache scoped to backend, credential digest, agent, Server ID, and creation time. Minting is never automatically retried. `--reveal-key` explicitly reveals the key, never a cloud prompt. `--verify` probes only a fixed, distinct nonexistent ID, requires strict 401 `missing required scope` evidence, supports abort, and never POSTs to the real Routine. Cloud failures are reported directly: check the selected Profile reference/backend and authorization/protocol error, not another route.
+   Without cloud configuration, Gateway/Host behavior remains, including fail-closed missing Temporal bridge checks. Mutations retain the Host contract: Box-local create is disabled, later mutations require fresh `--expect-revision` and `--confirm`, and unsupported Temporal create/update refuse. Cloud adds no CRUD. Unknown write outcomes require reconciliation, not automatic replay. Host credential disclosure retains its existing contract. Cloud authority grants no Gateway, daemon, Sandbox, or quota permissions.
 4. **Search/read transcript**: `history search <query>`, `history tail <target>`, and
    `history thread <target> --root <entry-id>` own transcript access. Object `show` commands do
    not add transcript side projections.