run402 4.79.0 → 4.79.2

package/gitvault-surface.json

@@ -1,5 +1,5 @@
 {
-  "surface_version": "4.79.0",
+  "surface_version": "4.79.2",
   "verbs": [
     "repos create",
     "repos list",

package/lib/buzz-notifications.mjs

@@ -27,9 +27,9 @@ Usage:
       --on-call <hex>        the Buzz agent (64-hex pubkey) a crash or platform incident pages with a p mention — the tag that wakes a managed Buzz agent
       --on-call-name <name>  the @name the page addresses it by (what Buzz renders as a mention chip); omitted, the gateway reads it from the agent's Buzz profile
   run402 buzz notifications on-call <buzzper_id> --agent <hex-pubkey> [--name <display>] | --clear
-      set or clear the route's on-call agent (a PATCH at the route's current revision). Prints the project-bot
-      pubkeys the agent must allow: a managed Buzz agent answers only its owner by default and drops a bot's
-      page before seeing it — add them to the agent's respond-to allowlist (or set respond-to to anyone).
+      set or clear the route's on-call agent (a PATCH at the route's current revision). Prints the ONE pubkey
+      the agent must allow: pages are signed by the installation identity, and a managed Buzz agent answers only
+      its owner by default — add it to the agent's respond-to allowlist (or set respond-to to anyone).
   run402 buzz notifications status [--org <uuid> | <buzzper_id>]
   run402 buzz notifications test <buzzper_id> [--wait] [--poll-seconds <n>] [--timeout-seconds <n>]
   run402 buzz notifications deliveries <buzzper_id> [--limit <n>] [--cursor <c>] [--delivery <buzzped_id>]
@@ -169,16 +169,14 @@ async function onCall(args) {
       console.error("On-call agent cleared: crashes and incidents on this route page nobody.");
       return;
     }
-    const label = updated.on_call_display_name ? `@${updated.on_call_display_name}` : "(no display name found on its Buzz profile — the page carries the p tag only; pass --name to add the @mention text)";
-    console.error(`On-call agent set: a crash or platform incident on this route now opens with "${label} please investigate:" and carries a p tag for ${updated.on_call_buzz_pubkey}.`);
-    const bots = Array.isArray(current.bots) ? current.bots.filter((bot) => bot && typeof bot.pubkey === "string") : [];
-    console.error("A managed Buzz agent answers only its owner by default and drops a project bot's page before seeing it.");
-    if (bots.length) {
-      console.error("Add these project-bot pubkeys to the agent's respond-to allowlist (Buzz Desktop agent settings, or --respond-to allowlist --respond-to-allowlist ...), then restart it:");
-      for (const bot of bots) console.error(`  ${bot.pubkey}  (${bot.display_name ?? bot.project_id})`);
+    if (updated.on_call_display_name) {
+      console.error(`On-call agent set: a crash or platform incident on this route now opens with "@${updated.on_call_display_name} please investigate:" and carries a p tag for ${updated.on_call_buzz_pubkey}.`);
     } else {
-      console.error("Its project bots are minted on first delivery; rerun `run402 buzz notifications status <buzzper_id>` afterwards for the bots[].pubkey values to allowlist.");
+      console.error(`On-call agent set: a crash or platform incident on this route carries a p tag for ${updated.on_call_buzz_pubkey}. No display name was found on its Buzz profile, so the page has no @mention text; rerun with --name <display> to add it.`);
     }
+    console.error("A managed Buzz agent answers only its owner by default and drops a page before seeing it.");
+    console.error("Pages are signed by the installation identity, so allowlist this ONE pubkey on the agent (Buzz Desktop agent settings, or --respond-to allowlist --respond-to-allowlist ...), then restart it:");
+    console.error(`  ${current.notification_pubkey}  (run402 installation identity — one entry covers every routed project)`);
   } catch (err) {
     reportSdkError(err);
   }

package/lib/harness-context.mjs

@@ -1,6 +1,6 @@
 /**
  * Best-effort session + task identity sourced from the AI harness running
- * this CLI invocation (Claude Code or Codex) — no network call, every source
+ * this CLI invocation (Claude Code, Codex, or Grok) — no network call, every source
  * optional, the chain always terminates. Backs coordination-room presence
  * resumption in rooms-context.mjs (run402-private's
  * presence-naming-ergonomics, tasks 2.2 / 3.1-3.2).
@@ -39,7 +39,8 @@ function isTruthyEnvValue(raw) {
 /**
  * Resolve THIS session's opaque identity as an ordered chain with no network
  * call: explicit override -> Claude Code's own session id -> Codex's own
- * thread id -> a locally generated key persisted for this checkout. No
+ * thread id -> Grok's own session id -> a locally generated key persisted
+ * for this checkout. No
  * source is load-bearing — a harness that sets neither env var, or a
  * filesystem that refuses the write, still yields a usable key for this run.
  */
@@ -61,6 +62,9 @@ export function resolveSessionKey({
   const codexId = env.CODEX_THREAD_ID?.trim();
   if (codexId) return { key: codexId, source: "codex_thread_id" };
 
+  const grokId = env.GROK_SESSION_ID?.trim();
+  if (grokId) return { key: grokId, source: "grok_session_id" };
+
   const keyPath = join(cwd, SESSION_KEY_CACHE_RELATIVE_PATH);
   try {
     if (existsSyncImpl(keyPath)) {
@@ -91,7 +95,7 @@ export function resolveSessionKey({
  * env overrides first (`RUN402_PROGRAM`/`RUN402_MODEL`), then `program`
  * inferred from the SAME harness signals {@link resolveSessionKey} already
  * trusts (`CLAUDE_CODE_SESSION_ID` or `CLAUDECODE` -> `"claude-code"`;
- * `CODEX_THREAD_ID` -> `"codex"`). `model` has no harness-exposed signal to
+ * `CODEX_THREAD_ID` -> `"codex"`; `GROK_SESSION_ID` or `GROK_AGENT` -> `"grok"`). `model` has no harness-exposed signal to
  * infer from today (open question in kygit-invite design.md) — it is
  * ALWAYS env-override-or-null, never guessed from `program`. Null stays
  * null in both fields: a placeholder label would be a Faithful breach.
@@ -105,6 +109,8 @@ export function resolveHarnessLabels({ env = process.env } = {}) {
       program = "claude-code";
     } else if (env.CODEX_THREAD_ID?.trim()) {
       program = "codex";
+    } else if (env.GROK_SESSION_ID?.trim() || env.GROK_AGENT?.trim()) {
+      program = "grok";
     }
   }
   const model = modelOverride || null;

package/lib/up.mjs

@@ -75,7 +75,7 @@ into a failure, and is reported under result.repo (default apply) or result
 
 Identity: up makes sure this principal has a display name before the deploy
 that will be credited to it — an existing name is kept, otherwise the
-detected client name (claude-code, codex, cursor, or agent) is set (approved
+detected client name (claude-code, codex, cursor, grok, or agent) is set (approved)
 by -y, or asked once) — and joins the project room under it. Change it any
 time with 'run402 org whoami --set-name <name>'. Reported under
 result.identity.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "run402",
-  "version": "4.79.0",
+  "version": "4.79.2",
   "description": "CLI for Run402 — full-stack backend infrastructure for AI agents: Postgres, auth, storage, serverless functions and atomic deploys. Paid with x402/MPP. Includes $0.03 image generation.",
   "type": "module",
   "bin": {

package/sdk/dist/actions.d.ts

@@ -71,7 +71,7 @@ export interface Run402UpActionInput {
     noRehearse?: boolean;
     /** Explicit display name to set on the principal when it has none yet.
      *  Omitted: `RUN402_AGENT_NAME` when set, else a specifically detected
-     *  client (`claude-code`, `codex`, `cursor`) reported as `identity.source:
+     *  client (`claude-code`, `codex`, `cursor`, `grok`) reported as `identity.source:
      *  "detected"`; when nothing is known no name is written and the result
      *  says `identity.source: "undetected"`. */
     identityName?: string;
@@ -81,7 +81,7 @@ export interface Run402UpIdentity {
     display_name: string | null;
     /** `existing`: already set; `explicit`: set now from `identityName` or
      *  `RUN402_AGENT_NAME`; `detected`: set now from a specifically detected
-     *  client (`claude-code`, `codex`, `cursor`); `undetected`: nothing known
+     *  client (`claude-code`, `codex`, `cursor`, `grok`); `undetected`: nothing known
      *  and nothing persisted — a guess is never written as a name (the room
      *  presence is `agent` for coordination only); `unavailable`: could not be
      *  read or set (never fails the deploy). */

package/sdk/dist/node/client-detect.d.ts

@@ -5,7 +5,7 @@
  * persisted as a name. `RUN402_AGENT_NAME` (read by `up` before detection)
  * is the way any runtime names itself with no per-command flag.
  */
-export type DetectedClientName = "claude-code" | "codex" | "cursor";
+export type DetectedClientName = "claude-code" | "codex" | "cursor" | "grok";
 export declare function detectClientName(env?: NodeJS.ProcessEnv): DetectedClientName | null;
 /** The name an agent runtime declares for itself, if any (`RUN402_AGENT_NAME`, trimmed). */
 export declare function declaredAgentName(env?: NodeJS.ProcessEnv): string | null;

package/sdk/dist/node/client-detect.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"client-detect.d.ts","sourceRoot":"","sources":["../../src/node/client-detect.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,MAAM,MAAM,kBAAkB,GAAG,aAAa,GAAG,OAAO,GAAG,QAAQ,CAAC;AAEpE,wBAAgB,gBAAgB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,kBAAkB,GAAG,IAAI,CAKhG;AAED,4FAA4F;AAC5F,wBAAgB,iBAAiB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,GAAG,IAAI,CAIrF"}
+{"version":3,"file":"client-detect.d.ts","sourceRoot":"","sources":["../../src/node/client-detect.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,MAAM,MAAM,kBAAkB,GAAG,aAAa,GAAG,OAAO,GAAG,QAAQ,GAAG,MAAM,CAAC;AAE7E,wBAAgB,gBAAgB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,kBAAkB,GAAG,IAAI,CAOhG;AAED,4FAA4F;AAC5F,wBAAgB,iBAAiB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,GAAG,IAAI,CAIrF"}

package/sdk/dist/node/client-detect.js

@@ -5,6 +5,9 @@ export function detectClientName(env = process.env) {
         return "codex";
     if (env.CURSOR_TRACE_ID || env.CURSOR_SESSION_ID || env.CURSOR_AGENT)
         return "cursor";
+    // Grok Build / Grok CLI: GROK_AGENT=1 and a per-session GROK_SESSION_ID.
+    if (env.GROK_AGENT || env.GROK_SESSION_ID)
+        return "grok";
     return null;
 }
 /** The name an agent runtime declares for itself, if any (`RUN402_AGENT_NAME`, trimmed). */

package/sdk/dist/node/client-detect.js.map

@@ -1 +1 @@
-{"version":3,"file":"client-detect.js","sourceRoot":"","sources":["../../src/node/client-detect.ts"],"names":[],"mappings":"AASA,MAAM,UAAU,gBAAgB,CAAC,MAAyB,OAAO,CAAC,GAAG;IACnE,IAAI,GAAG,CAAC,UAAU,IAAI,GAAG,CAAC,WAAW,IAAI,GAAG,CAAC,sBAAsB,IAAI,GAAG,CAAC,sBAAsB;QAAE,OAAO,aAAa,CAAC;IACxH,IAAI,GAAG,CAAC,aAAa,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,YAAY,IAAI,GAAG,CAAC,UAAU;QAAE,OAAO,OAAO,CAAC;IAC5F,IAAI,GAAG,CAAC,eAAe,IAAI,GAAG,CAAC,iBAAiB,IAAI,GAAG,CAAC,YAAY;QAAE,OAAO,QAAQ,CAAC;IACtF,OAAO,IAAI,CAAC;AACd,CAAC;AAED,4FAA4F;AAC5F,MAAM,UAAU,iBAAiB,CAAC,MAAyB,OAAO,CAAC,GAAG;IACpE,MAAM,GAAG,GAAG,GAAG,CAAC,iBAAiB,CAAC;IAClC,MAAM,IAAI,GAAG,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACvD,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AACvC,CAAC"}
+{"version":3,"file":"client-detect.js","sourceRoot":"","sources":["../../src/node/client-detect.ts"],"names":[],"mappings":"AASA,MAAM,UAAU,gBAAgB,CAAC,MAAyB,OAAO,CAAC,GAAG;IACnE,IAAI,GAAG,CAAC,UAAU,IAAI,GAAG,CAAC,WAAW,IAAI,GAAG,CAAC,sBAAsB,IAAI,GAAG,CAAC,sBAAsB;QAAE,OAAO,aAAa,CAAC;IACxH,IAAI,GAAG,CAAC,aAAa,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,YAAY,IAAI,GAAG,CAAC,UAAU;QAAE,OAAO,OAAO,CAAC;IAC5F,IAAI,GAAG,CAAC,eAAe,IAAI,GAAG,CAAC,iBAAiB,IAAI,GAAG,CAAC,YAAY;QAAE,OAAO,QAAQ,CAAC;IACtF,yEAAyE;IACzE,IAAI,GAAG,CAAC,UAAU,IAAI,GAAG,CAAC,eAAe;QAAE,OAAO,MAAM,CAAC;IACzD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,4FAA4F;AAC5F,MAAM,UAAU,iBAAiB,CAAC,MAAyB,OAAO,CAAC,GAAG;IACpE,MAAM,GAAG,GAAG,GAAG,CAAC,iBAAiB,CAAC;IAClC,MAAM,IAAI,GAAG,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACvD,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AACvC,CAAC"}