openzoo 0.50.97 → 0.50.99

package/lib/grokcli.js

@@ -16,13 +16,26 @@
 // "payment required".
 
 import { spawn, execSync } from 'node:child_process';
-import { existsSync, readFileSync, writeFileSync, copyFileSync, mkdirSync, readdirSync, chmodSync } from 'node:fs';
+import { createHash } from 'node:crypto';
+import {
+  closeSync,
+  existsSync,
+  openSync,
+  readFileSync,
+  writeFileSync,
+  copyFileSync,
+  mkdirSync,
+  readdirSync,
+  chmodSync,
+  unlinkSync,
+} from 'node:fs';
 import { homedir } from 'node:os';
-import { dirname, join } from 'node:path';
+import { delimiter, dirname, join } from 'node:path';
 import { fileURLToPath } from 'node:url';
 
 import { config } from './config.js';
 import { killListen } from './proxy.js';
+import { fakeCursorTokens } from './cursorapi.js';
 import {
   GROKBOT_CDP_PORT,
   grokBotChromiumArgs,
@@ -31,7 +44,6 @@ import {
 
 const GROK_HOME = process.env.GROK_HOME || join(homedir(), '.grok');
 const CONFIG_PATH = join(GROK_HOME, 'config.toml');
-const APP = process.env.GROK_APP || '/Applications/Grok Bot.app';
 
 /* LINUX/WIN DISCOVERY — the multiarch release ships Grok_Bot_<v>_<plat>-<arch>.AppImage
  * / .exe. GROKBOT_BIN env always wins. */
@@ -72,24 +84,44 @@ function windowsExe() {
   return join(home, 'AppData', 'Local', 'Programs', 'Grok Bot', 'Grok Bot.exe');
 }
 
+function darwinAppDirs() {
+  const apps = [];
+  if (process.env.GROK_APP) apps.push(process.env.GROK_APP);
+  apps.push('/Applications/Grok Bot.app');
+  apps.push(join(homedir(), 'Applications', 'Grok Bot.app'));
+  return apps;
+}
+
+function darwinBinary() {
+  for (const app of darwinAppDirs()) {
+    const bin = join(app, 'Contents', 'MacOS', 'Grok Bot');
+    if (existsSync(bin)) return bin;
+  }
+  return join(darwinAppDirs()[0], 'Contents', 'MacOS', 'Grok Bot');
+}
+
 /** Cross-platform Grok Bot binary. GROKBOT_BIN env always wins. */
 export function grokBotBinary() {
   if (process.env.GROKBOT_BIN) return process.env.GROKBOT_BIN;
-  if (process.platform === 'darwin') return `${APP}/Contents/MacOS/Grok Bot`;
+  if (process.platform === 'darwin') return darwinBinary();
   if (process.platform === 'linux') return linuxAppImage();
   if (process.platform === 'win32') return windowsExe();
-  return `${APP}/Contents/MacOS/Grok Bot`;
+  return darwinBinary();
 }
 
 /** Cross-platform quit: osascript on mac, SIGTERM pids elsewhere. */
 function quitGrokBot() {
   try {
     if (process.platform === 'darwin') {
-      quitGrokBot();
-    } else {
-      for (const pid of grokBotPids()) {
-        try { process.kill(Number(pid), 'SIGTERM'); } catch { /* gone */ }
-      }
+      try {
+        execSync('osascript -e \'tell application "Grok Bot" to quit\'', {
+          timeout: 8000,
+          stdio: 'ignore',
+        });
+      } catch { /* not running */ }
+    }
+    for (const pid of grokBotPids()) {
+      try { process.kill(Number(pid), 'SIGTERM'); } catch { /* gone */ }
     }
   } catch { /* ok */ }
 }
@@ -166,29 +198,56 @@ ${body}
 `;
 }
 
-const GROK_BOT_BIN = grokBotBinary();
+function grokBotImageNames(bin = grokBotBinary()) {
+  const names = new Set(['Grok Bot.exe', 'Grok_Bot.exe', 'grokbot.exe']);
+  const base = String(bin || '').split(/[/\\]/).pop();
+  if (base) names.add(base);
+  return [...names];
+}
+
+function parseTasklistPids(out) {
+  const pids = [];
+  for (const line of String(out || '').split(/\r?\n/)) {
+    const cols = line.split('","');
+    if (cols.length < 2) continue;
+    const pid = cols[1].replace(/"/g, '').trim();
+    if (/^\d+$/.test(pid)) pids.push(pid);
+  }
+  return pids;
+}
 
 /** pids whose command is the Grok Bot main binary (not grep itself). */
-export function grokBotPids(run = execSync) {
+export function grokBotPids(run = execSync, platform = process.platform) {
+  const quiet = { encoding: 'utf8', shell: true, windowsHide: true, stdio: ['pipe', 'pipe', 'pipe'] };
   try {
-    return run(`pgrep -f ${JSON.stringify(GROK_BOT_BIN)}`, { encoding: 'utf8', shell: true })
+    if (platform === 'win32') {
+      const pids = [];
+      for (const name of grokBotImageNames()) {
+        try {
+          const out = run(`tasklist /FI "IMAGENAME eq ${name}" /FO CSV /NH`, quiet);
+          pids.push(...parseTasklistPids(out));
+        } catch { /* image not running */ }
+      }
+      return [...new Set(pids)];
+    }
+    return run(`pgrep -f ${JSON.stringify(grokBotBinary())}`, quiet)
       .trim().split('\n').map((s) => s.trim()).filter(Boolean);
   } catch {
     return [];
   }
 }
 
-function pidHasNeedle(pid, needle, run = execSync) {
+function pidHasNeedle(pid, needle, run = execSync, platform = process.platform) {
   const n = Number(pid);
   if (!Number.isInteger(n) || n <= 0) return false;
-  if (process.platform === 'linux') {
+  if (platform === 'linux') {
     try {
       // /proc/<pid>/environ is NUL-separated; flatten and test.
       const env = readFileSync(`/proc/${n}/environ`, 'utf8');
       if (env.replace(/\0/g, '\n').includes(needle)) return true;
     } catch { /* gone */ }
   }
-  if (process.platform === 'win32') return false;
+  if (platform === 'win32') return false;
   for (const cmd of [`ps -Eww -p ${n} -o command=`, `ps eww -p ${n}`]) {
     try {
       if (run(cmd, { encoding: 'utf8', timeout: 2000 }).includes(needle)) return true;
@@ -197,13 +256,13 @@ function pidHasNeedle(pid, needle, run = execSync) {
   return false;
 }
 
-function somethingTalksToPort(port, run = execSync) {
+function somethingTalksToPort(port, run = execSync, platform = process.platform) {
   try {
-    if (process.platform === 'linux') {
+    if (platform === 'linux') {
       const out = run('ss -tnp', { encoding: 'utf8', timeout: 2000 });
       return out.includes(':' + Number(port)) && /grok|electron|bot/i.test(out);
     }
-    if (process.platform === 'win32') {
+    if (platform === 'win32') {
       const out = run('netstat -ano', { encoding: 'utf8', timeout: 5000 });
       return new RegExp(':' + Number(port) + '[^0-9].*ESTABLISHED', 'i').test(out);
     }
@@ -217,13 +276,13 @@ function somethingTalksToPort(port, run = execSync) {
 }
 
 /** Is the running Grok Bot already pointed at our aiserver? */
-export function inspectGrokBotHijack(url, port = 8443, run = execSync, cdpPort = GROKBOT_CDP_PORT) {
-  const pids = grokBotPids(run);
+export function inspectGrokBotHijack(url, port = 8443, run = execSync, cdpPort = GROKBOT_CDP_PORT, platform = process.platform) {
+  const pids = grokBotPids(run, platform);
   const needle = `CURSOR_API_BASE_URL=${url}`;
-  const envHit = pids.some((pid) => pidHasNeedle(pid, needle, run));
-  const tcpHit = somethingTalksToPort(port, run);
+  const envHit = pids.some((pid) => pidHasNeedle(pid, needle, run, platform));
+  const tcpHit = somethingTalksToPort(port, run, platform);
   const cdpNeedle = `--remote-debugging-port=${Number(cdpPort)}`;
-  const chipDebug = pids.some((pid) => pidHasNeedle(pid, cdpNeedle, run));
+  const chipDebug = pids.some((pid) => pidHasNeedle(pid, cdpNeedle, run, platform));
   return { running: pids.length > 0, pids, hijacked: envHit || tcpHit, chipDebug };
 }
 
@@ -265,6 +324,308 @@ export function grokBotQuitPlan({
   };
 }
 
+export function botPidPath(home = homedir()) {
+  return join(home, '.openzoo', 'bot.pid');
+}
+
+export function isBotDaemonChild(env = process.env) {
+  return env.OPENZOO_BOT_DAEMON_CHILD === '1';
+}
+
+export function wantsBotDaemon(argv = [], env = process.env) {
+  if (isBotDaemonChild(env)) return false;
+  if (argv.includes('--once') || argv.includes('--web')) return false;
+  return argv.includes('--daemon') || argv.includes('-d') || env.OPENZOO_BOT_DAEMON === '1';
+}
+
+/**
+ * Env for the VENDOR Grok Bot Electron binary. Must NOT inherit
+ * ELECTRON_RUN_AS_NODE — that is how OpenZoo Bot runs `openzoo.js`, and
+ * passing it through makes Grok Bot start as Node with no window (measured
+ * on the Linux AppImage: pay banner prints, then nothing). Nested AppImage
+ * vars (APPIMAGE/APPDIR/LD_LIBRARY_PATH) make the child reuse our squashfs
+ * and die silently.
+ */
+export function grokBotLaunchEnv(url, baseEnv = process.env) {
+  const env = { ...baseEnv };
+  for (const k of [
+    'ELECTRON_RUN_AS_NODE',
+    'ELECTRON_NO_ASAR',
+    'APPIMAGE',
+    'APPDIR',
+    'ARGV0',
+    'OWD',
+    'APPIMAGE_EXTRACT_AND_RUN',
+    'LD_LIBRARY_PATH',
+    'LD_PRELOAD',
+  ]) delete env[k];
+  env.NODE_TLS_REJECT_UNAUTHORIZED = '0';
+  env.CURSOR_API_BASE_URL = url;
+  env.SAND_BACKEND_URL = url;
+  env.SAND_HOST_GATEWAY_URL = url;
+  env.SAND_HOST_GATEWAY_TOKEN = 'openzoo';
+  env.SAND_HOST_GATEWAY_NETWORK_TOKEN = 'openzoo';
+  // Login page is websiteUrl/loginDeepControl (cursor.com by default). Point
+  // it at the hijack so "Log in with Cursor" never opens a real Cursor tab.
+  env.SAND_CURSOR_WEBSITE_URL = url;
+  env.CURSOR_WEBSITE_URL = url;
+  // SAND_HOST_GATEWAY_URL turns on .env-descriptor-account-bindings.json:
+  // the first Cursor account that used this machine claims it, and a fake
+  // openzoo JWT then gets refused-credentials-retained (i18n DKMHuY).
+  // asar createDesktopAccountAuthorizer honors this rebind flag.
+  env.SAND_DEV_ALLOW_ACCOUNT_REBIND = '1';
+  // asar waitForBrowserLogin always shell.openExternal(loginUrl) THEN polls.
+  // Fake poll already returns tokens — swallow the tab so 127.0.0.1:8443/loginDeep
+  // never pops. Linux Electron uses xdg-open from PATH (mac NSWorkspace ignores
+  // this; the loginDeep HTML still window.close()s).
+  const realPath = env.PATH || '/usr/bin:/bin:/usr/local/bin';
+  env.OPENZOO_REAL_PATH = realPath;
+  try {
+    const shim = ensureGrokBotOpenShim({
+      home: env.HOME || homedir(),
+      platform: process.platform,
+    });
+    env.PATH = `${shim.dir}${delimiter}${realPath}`;
+    env.BROWSER = shim.browser;
+  } catch { /* read-only home */ }
+  return env;
+}
+
+export function grokBotOpenShimDir(home = homedir()) {
+  return join(home, '.openzoo', 'bin');
+}
+
+/** POSIX shim: exit 0 on loginDeepControl, else exec the real command. */
+export const GROKBOT_OPEN_SHIM_SH = `#!/bin/sh
+url=""
+for a in "$@"; do
+  case "$a" in
+    http://*|https://*|cursor://*) url="$a" ;;
+  esac
+done
+case "$url" in
+  *loginDeepControl*|*/loginDeep*) exit 0 ;;
+esac
+cmd=\`basename "$0"\`
+rest_path=\${OPENZOO_REAL_PATH:-/usr/bin:/bin:/usr/local/bin}
+old_ifs=$IFS
+IFS=:
+for d in $rest_path; do
+  if [ -n "$d" ] && [ -x "$d/$cmd" ]; then
+    [ "$d/$cmd" = "$0" ] && continue
+    IFS=$old_ifs
+    exec "$d/$cmd" "$@"
+  fi
+done
+IFS=$old_ifs
+exit 0
+`;
+
+/**
+ * PATH shims so Grok Bot's shell.openExternal does not pop a browser tab
+ * for the fake login URL. Writes xdg-open + gio (Linux Electron) and open
+ * (in case macOS shells out; NSWorkspace still bypasses PATH).
+ */
+export function ensureGrokBotOpenShim({
+  home = homedir(),
+  platform = process.platform,
+} = {}) {
+  const dir = grokBotOpenShimDir(home);
+  mkdirSync(dir, { recursive: true });
+  const names = platform === 'win32' ? [] : platform === 'darwin' ? ['open'] : ['xdg-open', 'gio'];
+  for (const name of names) {
+    const p = join(dir, name);
+    writeFileSync(p, GROKBOT_OPEN_SHIM_SH, { encoding: 'utf8', mode: 0o755 });
+    try { chmodSync(p, 0o755); } catch { /* windows */ }
+  }
+  return {
+    dir,
+    browser: join(dir, names[0] || 'xdg-open'),
+    names,
+  };
+}
+
+/** asar kkn: sha256(namespace || 0x00 || value) hex. */
+export function sandBindingKey(namespace, value) {
+  return createHash('sha256').update(String(namespace)).update('\0').update(String(value)).digest('hex');
+}
+
+/** asar descriptorKey — `new URL(url).toString()` adds the trailing slash. */
+export function sandDescriptorKey(url) {
+  return sandBindingKey('sand-env-descriptor', new URL(url).toString());
+}
+
+/** asar accountKey. JWT sub / cursorAccountSlot is `openzoo-user`. */
+export function sandAccountKey(slot = 'openzoo-user') {
+  return sandBindingKey('sand-account-slot', slot);
+}
+
+/**
+ * Electron userData candidates for vendor Grok Bot (productName "Grok Bot",
+ * package name "sand"). Bindings live at
+ * `<userData>/.env-descriptor-account-bindings.json`.
+ */
+export function grokBotUserDataDirs(home = homedir(), env = process.env, platform = process.platform) {
+  const names = ['Grok Bot', 'grok-bot', 'GrokBot', 'sand'];
+  let root;
+  if (platform === 'darwin') root = join(home, 'Library', 'Application Support');
+  else if (platform === 'win32') root = env.APPDATA || join(home, 'AppData', 'Roaming');
+  else root = env.XDG_CONFIG_HOME || join(home, '.config');
+  return names.map((n) => join(root, n));
+}
+
+/**
+ * Pre-seed the env-descriptor binding for our hijack URL.
+ *
+ * asar authorize (packaged AppImage) is:
+ *   existing === thisAccount → ok
+ *   existing != null && !REBIND → refuse
+ *   existing == null && !firstStartupClaim && hasExistingDurableData() → refuse
+ *   else write binding
+ *
+ * Packaged builds force hasExistingDurableData() true (dev-box control plane
+ * is off). Mid-session "Log in with Cursor" is not firstStartupClaim. A new
+ * hijack URL therefore has existing==null and REBIND never runs — 1.3.10.
+ * Writing this file first makes existing==thisAccount (or existing!=null so
+ * REBIND can rewrite if the slot is not openzoo-user).
+ */
+export function claimGrokBotMachine(url, {
+  home = homedir(),
+  env = process.env,
+  platform = process.platform,
+  accountSlot = 'openzoo-user',
+} = {}) {
+  const descriptorKey = sandDescriptorKey(url);
+  const accountKey = sandAccountKey(accountSlot);
+  const written = [];
+  for (const dir of grokBotUserDataDirs(home, env, platform)) {
+    mkdirSync(dir, { recursive: true });
+    const p = join(dir, '.env-descriptor-account-bindings.json');
+    let bindings = {};
+    try {
+      const prev = JSON.parse(readFileSync(p, 'utf8'));
+      if (prev && typeof prev.bindings === 'object' && prev.bindings) bindings = { ...prev.bindings };
+    } catch { /* missing or junk */ }
+    bindings[descriptorKey] = accountKey;
+    writeFileSync(p, JSON.stringify({ version: 1, bindings }), { encoding: 'utf8', mode: 0o600 });
+    written.push(p);
+  }
+  return { descriptorKey, accountKey, written };
+}
+
+function plaintextSecret(value) {
+  return `plaintext:v1:${Buffer.from(String(value), 'utf8').toString('base64')}`;
+}
+
+/**
+ * Write fake JWTs into Grok Bot's sand-secrets.json so asar getStatus is
+ * already logged-in and waitForBrowserLogin never runs.
+ * Windows shell.openExternal uses ShellExecute (not PATH), so the xdg-open
+ * shim cannot swallow loginDeepControl — this is the Windows fix.
+ */
+export function seedGrokBotFakeLogin({
+  home = homedir(),
+  env = process.env,
+  platform = process.platform,
+} = {}) {
+  const tok = fakeCursorTokens();
+  const patch = {
+    'cursor-access-token': plaintextSecret(tok.accessToken),
+    'cursor-refresh-token': plaintextSecret(tok.refreshToken),
+  };
+  const written = [];
+  for (const dir of grokBotUserDataDirs(home, env, platform)) {
+    mkdirSync(dir, { recursive: true });
+    const p = join(dir, 'sand-secrets.json');
+    let prev = {};
+    try {
+      const j = JSON.parse(readFileSync(p, 'utf8'));
+      if (j && typeof j === 'object') prev = j;
+    } catch { /* missing */ }
+    writeFileSync(p, JSON.stringify({ ...prev, ...patch }, null, 2), { encoding: 'utf8', mode: 0o600 });
+    written.push(p);
+  }
+  return { written, authId: tok.authId };
+}
+
+/**
+ * Turn OFF the local-tool approval prompt so exec/list_dir actually run.
+ *
+ * `localUseRefusal` in dist/local-exec-daemon/main.cjs only honours the
+ * frame's `authorizedByStanding` when the daemon is `serverAuthoritative`;
+ * ours is not, so it falls through to the user's own setting and answers
+ * "That action was not approved on the user's computer, so nothing ran."
+ * The setting is `localToolPermission` in `<userData>/settings.json`,
+ * default "ask", and `localToolPermissionCeiling` CAPS it
+ * (resolveSandLocalToolPermission takes the lower of {never:0,ask:1,always:2})
+ * — so raising the choice without also clearing a "never"/"ask" ceiling
+ * changes nothing.
+ */
+export function seedGrokBotLocalToolPermission({
+  home = homedir(),
+  env = process.env,
+  platform = process.platform,
+  permission = 'always',
+} = {}) {
+  const written = [];
+  for (const dir of grokBotUserDataDirs(home, env, platform)) {
+    mkdirSync(dir, { recursive: true });
+    const p = join(dir, 'settings.json');
+    let prev = {};
+    try {
+      const j = JSON.parse(readFileSync(p, 'utf8'));
+      if (j && typeof j === 'object') prev = j;
+    } catch { /* missing or junk — the app writes it on first settings change */ }
+    const next = { ...prev, localToolPermission: permission };
+    // A ceiling of "ask"/"never" would silently clamp us straight back.
+    if (permission === 'always') delete next.localToolPermissionCeiling;
+    // The app writes this file with JSON.stringify(e, null, 2).
+    writeFileSync(p, JSON.stringify(next, null, 2), { encoding: 'utf8', mode: 0o600 });
+    written.push(p);
+  }
+  return { written, permission };
+}
+
+export function daemonizeBot(argv, {
+  execPath = process.execPath,
+  script = process.argv[1],
+  env = process.env,
+  logFile = join(homedir(), '.openzoo', 'bot.log'),
+} = {}) {
+  const rest = argv.filter((a) => a !== '--daemon' && a !== '-d');
+  const entry = script || fileURLToPath(new URL('../bin/openzoo.js', import.meta.url));
+  mkdirSync(dirname(logFile), { recursive: true });
+  const fd = openSync(logFile, 'a');
+  const childEnv = { ...env, OPENZOO_BOT_DAEMON_CHILD: '1' };
+  if (process.versions.electron) childEnv.ELECTRON_RUN_AS_NODE = '1';
+  const child = spawn(execPath, [entry, 'bot', ...rest], {
+    detached: true,
+    stdio: ['ignore', fd, fd],
+    env: childEnv,
+    windowsHide: true,
+  });
+  child.unref();
+  try { closeSync(fd); } catch { /* fd is inherited */ }
+  const pidPath = botPidPath();
+  mkdirSync(dirname(pidPath), { recursive: true });
+  writeFileSync(pidPath, String(child.pid));
+  return { pid: child.pid, logFile, pidPath };
+}
+
+export function stopBotDaemon({ log = (m) => console.error(m) } = {}) {
+  const pidPath = botPidPath();
+  let pid = 0;
+  try { pid = Number(readFileSync(pidPath, 'utf8').trim()); } catch { /* none */ }
+  if (!Number.isInteger(pid) || pid <= 0) {
+    log('openzoo: no bot daemon pidfile');
+    return false;
+  }
+  try { process.kill(pid, 'SIGTERM'); } catch { /* already gone */ }
+  try { unlinkSync(pidPath); } catch { /* ok */ }
+  log(`openzoo: stopped daemon pid ${pid}`);
+  return true;
+}
+
 /**
  * `openzoo bot` — Grok Bot.app on the zoo, no sudo, no /etc/hosts.
  *
@@ -283,13 +644,36 @@ export async function runBot(argv = []) {
     const { runGrokBotWeb } = await import('./grokbotweb.js');
     return runGrokBotWeb(argv);
   }
+  if (argv.includes('--stop')) {
+    stopBotDaemon();
+    return;
+  }
+  if (wantsBotDaemon(argv)) {
+    const d = daemonizeBot(argv);
+    console.error(`openzoo: daemon pid ${d.pid} — log ${d.logFile}`);
+    return;
+  }
   const port = 8443;
   const url = `https://127.0.0.1:${port}`;
-  const bin = GROK_BOT_BIN;
+  let bin = grokBotBinary();
+  if (!existsSync(bin) && !argv.includes('--no-fetch') && process.env.GROKBOT_NO_FETCH !== '1') {
+    console.error('openzoo: Grok Bot not installed — fetching the multiarch build');
+    try {
+      const { ensureGrokBot } = await import('./grokbotFetch.js');
+      bin = await ensureGrokBot({
+        existing: bin,
+        log: (m) => console.error(m),
+      });
+      if (bin) process.env.GROKBOT_BIN = bin;
+    } catch (e) {
+      console.error(`openzoo: fetch failed (${e.message})`);
+    }
+  }
   if (!existsSync(bin)) {
     console.error(`openzoo: Grok Bot binary not found — looked for ${bin}`);
     console.error('  set GROKBOT_BIN=/path/to/Grok_Bot_0.36.0_linux-x64.AppImage');
     console.error('  or drop the AppImage in ~/Applications, ~/.local/bin, /opt, ~/Downloads');
+    console.error('  or run again on a network so openzoo can fetch grokbot-v* from GitHub');
     process.exit(1);
   }
 
@@ -336,7 +720,7 @@ export async function runBot(argv = []) {
   const stale = killListen(port);
   if (stale.length) console.error(`openzoo: killed stale hijack on :${port} pids=${stale.join(',')}`);
   try {
-    startCursorBackend({ port, models, log });
+    await startCursorBackend({ port, models, log });
   } catch (e) {
     console.error('openzoo: 8443 bind failed after kill (', e.message, ')');
     throw e;
@@ -377,30 +761,56 @@ export async function runBot(argv = []) {
     await new Promise((r) => setTimeout(r, 1500));
   }
 
+  try {
+    const claim = claimGrokBotMachine(url);
+    console.error(`openzoo: machine-claim openzoo-user → ${claim.written.length} Grok Bot userData dir(s)`);
+  } catch (e) {
+    console.error(`openzoo: machine-claim failed (${e.message}) — login may still hit DKMHuY`);
+  }
+  try {
+    const seed = seedGrokBotFakeLogin();
+    console.error(`openzoo: fake login seeded → ${seed.written.length} sand-secrets.json`);
+  } catch (e) {
+    console.error(`openzoo: fake login seed failed (${e.message})`);
+  }
+  try {
+    const perm = seedGrokBotLocalToolPermission();
+    console.error(`openzoo: local-tool permission=always → ${perm.written.length} settings.json`);
+  } catch (e) {
+    console.error(`openzoo: local-tool permission seed failed (${e.message}) — exec will say "not approved"`);
+  }
+
   const launchGrokBot = () => {
     console.error('openzoo: launching Grok Bot');
     console.error(`         CURSOR_API_BASE_URL=${url}`);
-        if (process.platform === 'linux' && /\.appimage$/i.test(bin)) {
+    if (process.platform === 'linux' && /\.appimage$/i.test(bin)) {
       try { chmodSync(bin, 0o755); } catch { /* read-only */ }
     }
-    spawn(bin, grokBotChromiumArgs(), {
+    const env = grokBotLaunchEnv(url);
+    if (process.platform === 'linux' && /\.appimage$/i.test(bin)) {
+      env.APPIMAGE_EXTRACT_AND_RUN = '1';
+    }
+    console.error(`         SAND_DEV_ALLOW_ACCOUNT_REBIND=${env.SAND_DEV_ALLOW_ACCOUNT_REBIND}`);
+    if (env.BROWSER && process.platform !== 'win32') {
+      console.error('         loginDeep tab swallowed (xdg-open/open shim)');
+    }
+    const child = spawn(bin, grokBotChromiumArgs(), {
       stdio: 'ignore',
       detached: true,
-      env: {
-        ...process.env,
-        NODE_TLS_REJECT_UNAUTHORIZED: '0',
-        CURSOR_API_BASE_URL: url,
-        SAND_BACKEND_URL: url,
-        // Helper daemon (local-exec-daemon/main.cjs) uses Node fetch, not Chromium.
-        // Without these it dials the cached cursorvm 1337 URL / dies on our
-        // self-signed cert and GET /local-exec/requests never arrives.
-        SAND_HOST_GATEWAY_URL: url,
-        SAND_HOST_GATEWAY_TOKEN: 'openzoo',
-        SAND_HOST_GATEWAY_NETWORK_TOKEN: 'openzoo',
-      },
-    }).unref();
+      env,
+    });
+    child.on('error', (e) => console.error(`openzoo: Grok Bot spawn failed: ${e.message}`));
+    child.unref();
   };
-  if (plan.spawn) launchGrokBot();
+  let needSpawn = plan.spawn;
+  if (process.platform === 'win32' && state.running && !plan.quit) {
+    // ShellExecute already opened Edge; restart so sand-secrets are read and
+    // loginDeepControl is not opened again.
+    try { quitGrokBot(); } catch { /* ok */ }
+    await new Promise((r) => setTimeout(r, 1500));
+    needSpawn = true;
+  }
+  if (needSpawn) launchGrokBot();
   else console.error('openzoo: Grok Bot already hijacked — not spawning another copy');
 
   injectSpendChipInBackground({
@@ -513,7 +923,7 @@ export async function setupGrokBot(argv = []) {
       console.error('         sudo will ask for your password (hosts file + :443).');
       if (!isBlocked()) blockBackend();
 
-      startCursorBackend({ port, log: (m) => console.error(`  backend: ${m}`) });
+      await startCursorBackend({ port, log: (m) => console.error(`  backend: ${m}`) });
 
       const restore = () => {
         try { unblockBackend(); console.error('openzoo: /etc/hosts restored.'); } catch { /* best effort */ }
@@ -552,7 +962,7 @@ export async function setupGrokBot(argv = []) {
       // LOUD BY DEFAULT. The previous run failed silently — "listening" and then
       // nothing — and silence looked identical to success. Every arriving method
       // is printed so "did it connect at all" is answerable at a glance.
-      startCursorBackend({ port, log: (m) => console.error(`  backend: ${m}`) });
+      await startCursorBackend({ port, log: (m) => console.error(`  backend: ${m}`) });
       console.error('openzoo: BYOK probe — impersonating api2/api3/api4/repo42.cursor.sh on :' + port);
       console.error('         scoped to this launch only (no /etc/hosts, no sudo)');
       console.error('         WATCH: if StreamChat starts arriving at the proxy, inference moved.');