graphban-cli 0.3.0__tar.gz → 0.4.0__tar.gz

{graphban_cli-0.3.0 → graphban_cli-0.4.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: graphban-cli
-Version: 0.3.0
+Version: 0.4.0
 Summary: gban — a Graphban client for the human at a terminal
 Project-URL: Homepage, https://github.com/asc-me/graphban
 Project-URL: Repository, https://github.com/asc-me/graphban
@@ -127,28 +127,37 @@ is named in the refusal when it exists — logging in once inside one project mu
 mint a credential for it while you are standing in another repository, and a key in the wrong
 project is not a mistake anybody notices quickly.
 
-`setup` mints a project-scoped credential, writes the `graphban` and `gbfleet` MCP entries,
-installs the supervisor if it is missing, drops the delegation skill into `.claude/skills/`,
-and then **verifies** rather than asserting: it asks the new credential what it can actually
-see. Restart the harness afterwards — MCP servers are read at startup.
+`setup` mints a project-scoped credential, writes the `graphban` and `gbfleet` MCP entries
+into every parent harness that would actually read them, installs the supervisor if it is
+missing, drops the delegation skill into `.claude/skills/`, and then **verifies** rather than
+asserting: it asks the new credential what it can actually see. Restart the session that will
+call `delegate`/`spawn` afterwards — MCP servers are read at startup.
 
 Three properties worth knowing, each of which is a bug this command exists to not have:
 
 - **The credential does not expire.** `gban keys mint` produces a *wave* key, which lasts a
   day (`FLEET_KEY_DAYS`); that is right for a wave and wrong for a project. Only seats expire.
-- **It writes where the harness will actually read.** `~/.claude.json`'s per-project
-  `mcpServers` outranks a repository `.mcp.json`, so writing the repository file under a
-  stale entry leaves the agent on the old key — which surfaces as a JSON parse error, because
-  the harness is parsing a 401 body. `--scope user` is the default for that reason, and
-  because a credential outside the repository cannot be committed.
+- **It writes where the harness will actually read.** There is more than one. Claude Code
+  reads `~/.claude.json`'s per-project `mcpServers` (JSON), which outranks a repository
+  `.mcp.json` — writing the repository file under a stale entry leaves the agent on the old
+  key, and surfaces as a JSON parse error because the harness is parsing a 401 body. Grok
+  reads `~/.grok/config.toml`'s `mcp_servers` (TOML, snake_case; `mcpServers` parses and
+  loads nothing). Writing only Claude's file while Grok holds a different key reports
+  success and leaves `delegate` unadvertised (GRPH-825). Grok's `gbfleet` MCP also
+  gets `--workspace ~/.grok/gbfleet-wt/<repo>`: the sibling default is a path Grok's
+  sandbox cannot write, and spawn then dies as `git worktree add` 128 (GRPH-826).
+  Claude keeps the sibling default. `--scope user` is the default because a credential
+  outside the repository cannot be committed. Re-running a working setup still
+  *repairs* a missing `gbfleet` entry and a missing `--workspace`; reuse skips a mint,
+  never a write.
 - **`--auto` matches, and says so.** A project carries no repository link — no remote, no
   path — so `--auto` compares your project ids and names against this directory, what is in
   it, and its siblings. One level, never a recursive walk. Two directories answering to one
   project, or one directory answering to two, are **refused rather than guessed**: a
   credential minted into the wrong repository is not a mistake anybody notices quickly.
 - **It refuses to write a key into a file git tracks.** `--scope project` on a tracked
-  `.mcp.json` is refused rather than warned about, because a warning attached to committing a
-  credential still commits it.
+  `.mcp.json` or `.grok/config.toml` is refused rather than warned about, because a warning
+  attached to committing a credential still commits it.
 
 ## Wiring a checkout to Swamp
 

{graphban_cli-0.3.0 → graphban_cli-0.4.0}/README.md

@@ -112,28 +112,37 @@ is named in the refusal when it exists — logging in once inside one project mu
 mint a credential for it while you are standing in another repository, and a key in the wrong
 project is not a mistake anybody notices quickly.
 
-`setup` mints a project-scoped credential, writes the `graphban` and `gbfleet` MCP entries,
-installs the supervisor if it is missing, drops the delegation skill into `.claude/skills/`,
-and then **verifies** rather than asserting: it asks the new credential what it can actually
-see. Restart the harness afterwards — MCP servers are read at startup.
+`setup` mints a project-scoped credential, writes the `graphban` and `gbfleet` MCP entries
+into every parent harness that would actually read them, installs the supervisor if it is
+missing, drops the delegation skill into `.claude/skills/`, and then **verifies** rather than
+asserting: it asks the new credential what it can actually see. Restart the session that will
+call `delegate`/`spawn` afterwards — MCP servers are read at startup.
 
 Three properties worth knowing, each of which is a bug this command exists to not have:
 
 - **The credential does not expire.** `gban keys mint` produces a *wave* key, which lasts a
   day (`FLEET_KEY_DAYS`); that is right for a wave and wrong for a project. Only seats expire.
-- **It writes where the harness will actually read.** `~/.claude.json`'s per-project
-  `mcpServers` outranks a repository `.mcp.json`, so writing the repository file under a
-  stale entry leaves the agent on the old key — which surfaces as a JSON parse error, because
-  the harness is parsing a 401 body. `--scope user` is the default for that reason, and
-  because a credential outside the repository cannot be committed.
+- **It writes where the harness will actually read.** There is more than one. Claude Code
+  reads `~/.claude.json`'s per-project `mcpServers` (JSON), which outranks a repository
+  `.mcp.json` — writing the repository file under a stale entry leaves the agent on the old
+  key, and surfaces as a JSON parse error because the harness is parsing a 401 body. Grok
+  reads `~/.grok/config.toml`'s `mcp_servers` (TOML, snake_case; `mcpServers` parses and
+  loads nothing). Writing only Claude's file while Grok holds a different key reports
+  success and leaves `delegate` unadvertised (GRPH-825). Grok's `gbfleet` MCP also
+  gets `--workspace ~/.grok/gbfleet-wt/<repo>`: the sibling default is a path Grok's
+  sandbox cannot write, and spawn then dies as `git worktree add` 128 (GRPH-826).
+  Claude keeps the sibling default. `--scope user` is the default because a credential
+  outside the repository cannot be committed. Re-running a working setup still
+  *repairs* a missing `gbfleet` entry and a missing `--workspace`; reuse skips a mint,
+  never a write.
 - **`--auto` matches, and says so.** A project carries no repository link — no remote, no
   path — so `--auto` compares your project ids and names against this directory, what is in
   it, and its siblings. One level, never a recursive walk. Two directories answering to one
   project, or one directory answering to two, are **refused rather than guessed**: a
   credential minted into the wrong repository is not a mistake anybody notices quickly.
 - **It refuses to write a key into a file git tracks.** `--scope project` on a tracked
-  `.mcp.json` is refused rather than warned about, because a warning attached to committing a
-  credential still commits it.
+  `.mcp.json` or `.grok/config.toml` is refused rather than warned about, because a warning
+  attached to committing a credential still commits it.
 
 ## Wiring a checkout to Swamp
 

{graphban_cli-0.3.0 → graphban_cli-0.4.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "graphban-cli"
-version = "0.3.0"
+version = "0.4.0"
 description = "gban — a Graphban client for the human at a terminal"
 readme = "README.md"
 requires-python = ">=3.12"

{graphban_cli-0.3.0 → graphban_cli-0.4.0}/src/gban/cli.py

@@ -56,14 +56,17 @@ def _parser() -> argparse.ArgumentParser:
     setup_cmd = sub.add_parser(
         "setup", help="enable delegation on a project",
         description=("Mints a project-scoped credential that does NOT expire, writes the "
-                     "graphban and gbfleet MCP entries where the harness will actually read "
-                     "them, and installs the supervisor. Only seats expire; a credential that "
-                     "died overnight would make 'delegation is set up' quietly stop being "
-                     "true. Re-running is safe: a working configuration is left alone."))
+                     "graphban and gbfleet MCP entries into Claude Code (~/.claude.json) and "
+                     "Grok (~/.grok/config.toml, TOML mcp_servers) — every file a parent "
+                     "harness will actually read — and installs the supervisor. Only seats "
+                     "expire; a credential that died overnight would make 'delegation is set "
+                     "up' quietly stop being true. Re-running is safe: a working key is "
+                     "reused, a missing gbfleet entry is still repaired."))
     setup_cmd.add_argument(
         "--scope", choices=["user", "project"], default="user",
-        help="user (default) writes ~/.claude.json, which OUTRANKS a repo .mcp.json and "
-             "cannot be committed; project writes .mcp.json beside the repo")
+        help="user (default) writes ~/.claude.json and, when it exists, ~/.grok/config.toml; "
+             "project writes .mcp.json and .grok/config.toml beside the repo. A user file "
+             "outranks the repo copy and cannot be committed")
     setup_cmd.add_argument(
         "--auto", action="store_true",
         help="every project with a repository here: matches this directory, what is in it and "
@@ -310,7 +313,8 @@ def cmd_setup(args) -> int:
     if code == 0:
         human.append(f"\n     delegation is enabled on {project}. An agent can now "
                      f"`delegate(id=…, lane=…, tier=…, seat=true)` then `spawn`.")
-        human.append(f"     restart the harness so it reads the new config.")
+        human.append("     restart Claude Code and/or Grok — whichever session will call "
+                     "`delegate`/`spawn` — so it reads the new config.")
     _out({"lines": lines, "ok": code == 0, "project": project, **made},
          "\n".join(human), args.as_json)
     return code
@@ -340,7 +344,8 @@ def _setup_auto(args, url: str, client) -> int:
         done[pid], worst = {"repo": str(repo), "ok": code == 0, **made}, max(worst, code)
     human = [doctor_mod.render(lines),
              f"\n     {sum(1 for d in done.values() if d['ok'])} of {len(done)} enabled. "
-             f"Restart the harness so it reads the new config."]
+             "Restart Claude Code and/or Grok — whichever session will call "
+             "`delegate`/`spawn` — so it reads the new config."]
     _out({"lines": lines, "ok": worst == 0, "projects": done}, "\n".join(human), args.as_json)
     return worst
 

{graphban_cli-0.3.0 → graphban_cli-0.4.0}/src/gban/setup.py

@@ -1,4 +1,4 @@
-"""Enable delegation on a project (GRPH-792).
+"""Enable delegation on a project (GRPH-792, GRPH-825).
 
 Between "logged in" and "an agent can hand an item to a child" sit three mechanical acts: mint
 a credential, put it where the harness will read it, and install the supervisor. None of the
@@ -13,18 +13,26 @@ a wave, and a credential that dies overnight turns "delegation is set up" into a
 silently stops being true. The seat is the object with a TTL — thirty minutes, single use — and
 that is where expiry belongs.
 
-**Where the entry is written is a correctness question, not a preference.** Claude Code reads
-`~/.claude.json`'s per-project `mcpServers` in preference to a repository's `.mcp.json`, so
-writing the repository file while a stale entry shadows it leaves the agent authenticating with
-the old key. That failure does not present as a permission problem: the harness reports a JSON
-parse error, because it is parsing a 401 body. So the default target is the user file — which
-also happens to be the one a credential cannot be committed from.
+**Where the entry is written is a correctness question, not a preference.** There is more than
+one parent harness. Claude Code reads `~/.claude.json`'s per-project `mcpServers` (JSON) in
+preference to a repository's `.mcp.json`. Grok reads `~/.grok/config.toml`'s `mcp_servers`
+(TOML, snake_case — `mcpServers` parses and loads nothing, GRPH-575). Writing only Claude's
+file while a Grok session holds a different key reports success and leaves `delegate`
+unadvertised, which the agent reads as the tool not existing (GRPH-825). So setup writes
+every file that would actually be read, and verifies a key from those files — not only the
+Claude one.
+
+A working credential that is missing `gbfleet` is not left alone. Reuse skips a *mint*, never
+a write: a PASS report with no supervisor server is a lie.
 """
 from __future__ import annotations
 
 import json
 import os
+import re
 import subprocess
+import tomllib
+from dataclasses import dataclass
 from pathlib import Path
 
 from gban import config, doctor as doctor_mod
@@ -48,6 +56,46 @@ def claude_home() -> Path:
     return Path(os.environ.get("CLAUDE_CONFIG_PATH") or (Path.home() / ".claude.json"))
 
 
+def grok_home() -> Path:
+    """Grok's user MCP file. `GROK_CONFIG_PATH` is the test seam, matching `CLAUDE_CONFIG_PATH`.
+
+    Grok itself has no such env; the default path is what it actually reads.
+    """
+    return Path(os.environ.get("GROK_CONFIG_PATH") or (Path.home() / ".grok" / "config.toml"))
+
+
+def grok_workspace(repo: Path, grok_config: Path | None = None) -> Path:
+    """Where Grok's gbfleet MCP cuts worktrees (GRPH-826).
+
+    Grok's `workspace` sandbox can write `~/.grok/` and the repository, and cannot write a
+    sibling of the repo. gbfleet's default (`<repo>-gbfleet`) is that sibling — right for
+    Claude, unusable here. This path sits next to Grok's config, outside git.
+    """
+    return (grok_config or grok_home()).resolve().parent / "gbfleet-wt" / repo.name
+
+
+def workspace_writable(path: Path) -> tuple[bool, str]:
+    """The same probe `gbfleet doctor` uses. Setup must not PASS a dest doctor would FAIL."""
+    try:
+        path.mkdir(parents=True, exist_ok=True)
+        probe = path / ".gbfleet-setup"
+        probe.write_text("x", encoding="utf-8")
+        probe.unlink()
+        return True, ""
+    except OSError as exc:
+        return False, str(exc)
+
+
+@dataclass(frozen=True)
+class Dest:
+    """One file a parent harness will actually read."""
+
+    harness: str
+    scope: str
+    path: Path
+    dialect: str  # "json" | "toml"
+
+
 def shadowing_entry(repo: Path, home: Path | None = None) -> bool:
     """Does the user file already declare our server for this repository?
 
@@ -92,18 +140,61 @@ def target(repo: Path, scope: str, home: Path | None = None) -> tuple[str, Path,
     return "user", user, ""
 
 
+def destinations(repo: Path, scope: str, home: Path, grok: Path) -> tuple[list[Dest], list[dict]]:
+    """Every parent-harness file that would actually be read, plus findings about the ones
+    that will not.
+
+    Claude is always a destination (created if missing) — that is the original setup. Grok's
+    user file is a destination only when it already exists: creating `~/.grok/config.toml` for
+    a machine that has never run Grok would be inventing a harness. `--scope project` also
+    writes `repo/.grok/config.toml` unless git tracks it, the same refusal as `.mcp.json`.
+    """
+    lines: list[dict] = []
+    dests: list[Dest] = []
+
+    claude_scope, claude_path, why = target(repo, scope, home)
+    if why:
+        lines.append(_line("config", UNKNOWN, "scope", why))
+    if claude_scope == "project" and tracked_by_git(claude_path):
+        lines.append(_line("config", FAIL, "target",
+                           f"git tracks {claude_path} — writing a key there would commit it. "
+                           "Re-run with --scope user, which writes outside the repository"))
+    else:
+        dests.append(Dest("claude", claude_scope, claude_path, "json"))
+
+    if grok.exists():
+        dests.append(Dest("grok", "user", grok, "toml"))
+
+    if scope == "project":
+        grok_proj = repo / ".grok" / "config.toml"
+        if tracked_by_git(grok_proj):
+            lines.append(_line("config", FAIL, "target",
+                               f"git tracks {grok_proj} — writing a key there would commit it. "
+                               "Re-run with --scope user, which writes ~/.grok/config.toml"))
+        elif not any(d.path == grok_proj for d in dests):
+            dests.append(Dest("grok", "project", grok_proj, "toml"))
+    return dests, lines
+
+
 # ---- the entries ----------------------------------------------------------------------------
 
-def entries(url: str, project: str, key: str, repo: Path) -> dict:
+def entries(url: str, project: str, key: str, repo: Path,
+            workspace: Path | None = None) -> dict:
     """The two servers a delegating planner holds: the ledger over HTTP, which arbitrates, and
     the supervisor over stdio, which does not. The supervisor takes the credential through its
-    environment rather than its arguments, because `ps` is world-readable."""
+    environment rather than its arguments, because `ps` is world-readable.
+
+    `workspace` is Grok-only (GRPH-826). Claude can write gbfleet's sibling default; Grok's
+    sandbox cannot. Passing it for Claude would move Claude's worktrees for no reason.
+    """
+    args = ["mcp", "--repo", str(repo), "--server", url.rstrip("/"), "--project", project]
+    if workspace is not None:
+        args += ["--workspace", str(workspace)]
     return {
         LEDGER_SERVER: {"type": "http", "url": url.rstrip("/") + "/api/mcp",
                         "headers": {"X-API-Key": key}},
         FLEET_SERVER: {"command": "gbfleet",
-                       "args": ["mcp", "--repo", str(repo), "--server", url.rstrip("/"),
-                                "--project", project],
+                       "args": args,
                        "env": {doctor_mod.SUPERVISOR_KEY_ENV: key}},
     }
 
@@ -127,6 +218,130 @@ def write_entries(path: Path, scope: str, repo: Path, servers: dict) -> None:
     path.write_text(json.dumps(blob, indent=2, sort_keys=True) + "\n", encoding="utf-8")
 
 
+_TABLE_HEADER = re.compile(r"^\[([^\[\]]+)\]\s*$")
+_BARE_TOML_KEY = re.compile(r"^[A-Za-z0-9_-]+$")
+
+
+def _toml_string(value: str) -> str:
+    """A TOML basic string. The api key and url arrive from the server; a `"` in either
+    would emit a file Grok fails to parse, which reads as having no tools."""
+    out = ['"']
+    for ch in value:
+        if ch == '"':
+            out.append('\\"')
+        elif ch == "\\":
+            out.append("\\\\")
+        elif ch == "\n":
+            out.append("\\n")
+        elif ch < " " or ch == "\x7f":
+            out.append(f"\\u{ord(ch):04X}")
+        else:
+            out.append(ch)
+    out.append('"')
+    return "".join(out)
+
+
+def _drop_grok_servers(text: str, names: set[str]) -> str:
+    """Strip `[mcp_servers.<name>]` and nested subtables, leaving every other table.
+
+    Split on lines that *start* a table. `args = ["mcp", ...]` contains `[` and is not a
+    header — walking until the next `[` would stop in the middle of the array and leave garbage.
+    """
+    out: list[str] = []
+    skipping = False
+    for line in text.splitlines(keepends=True):
+        matched = _TABLE_HEADER.match(line)
+        if matched:
+            parts = matched.group(1).split(".")
+            skipping = (len(parts) >= 2 and parts[0] == "mcp_servers" and parts[1] in names)
+        if not skipping:
+            out.append(line)
+    return "".join(out)
+
+
+def _render_grok_server(name: str, spec: dict) -> str:
+    table = f"mcp_servers.{name}"
+    if spec.get("url"):
+        lines = [f"[{table}]", f"url = {_toml_string(str(spec['url']))}", "enabled = true"]
+        headers = spec.get("headers") or {}
+        if headers:
+            lines.append("")
+            lines.append(f"[{table}.headers]")
+            for header, value in headers.items():
+                key = header if _BARE_TOML_KEY.match(header) else _toml_string(header)
+                lines.append(f"{key} = {_toml_string(str(value))}")
+        return "\n".join(lines)
+    lines = [f"[{table}]"]
+    if spec.get("command"):
+        lines.append(f"command = {_toml_string(str(spec['command']))}")
+    args = spec.get("args") or []
+    if args:
+        lines.append("args = [" + ", ".join(_toml_string(str(a)) for a in args) + "]")
+    env = spec.get("env") or {}
+    if env:
+        inner = ", ".join(f"{k} = {_toml_string(str(v))}" for k, v in env.items())
+        lines.append(f"env = {{ {inner} }}")
+    lines.append("enabled = true")
+    return "\n".join(lines)
+
+
+def write_grok_toml(path: Path, servers: dict) -> None:
+    """Merge our two servers into Grok's user/project config without rewriting the rest.
+
+    The file holds UI, hooks, sandbox, and other people's servers. `json.dumps` of a parsed
+    blob would drop comments and turn `mcp_servers` into the wrong shape. Replace only the
+    tables we own.
+    """
+    try:
+        text = path.read_text(encoding="utf-8")
+    except OSError:
+        text = ""
+    text = _drop_grok_servers(text, set(servers)).rstrip()
+    blocks = [_render_grok_server(name, spec) for name, spec in servers.items()]
+    body = ("\n\n".join(blocks) + "\n") if not text else (text + "\n\n" + "\n\n".join(blocks) + "\n")
+    path.parent.mkdir(parents=True, exist_ok=True)
+    path.write_text(body, encoding="utf-8")
+    os.chmod(path, 0o600)
+
+
+def write_dest(dest: Dest, repo: Path, servers: dict) -> None:
+    if dest.dialect == "toml":
+        write_grok_toml(dest.path, servers)
+        return
+    write_entries(dest.path, dest.scope, repo, servers)
+
+
+def grok_key(path: Path) -> str:
+    try:
+        blob = tomllib.loads(path.read_text(encoding="utf-8"))
+    except (OSError, ValueError, tomllib.TOMLDecodeError):
+        return ""
+    server = ((blob.get("mcp_servers") or {}).get(LEDGER_SERVER) or {})
+    return str(((server.get("headers") or {}).get("X-API-Key")) or "")
+
+
+def grok_sandbox_profile(path: Path) -> str:
+    """Grok's `[sandbox] profile`, or "" when unset or `off` (GRPH-838).
+
+    Read for what it does to CHILDREN: the profile is applied to the Grok process, `gbfleet
+    mcp` is its child, and every vendor spawned from there inherits it. Setup cannot fix that
+    — it is the operator's sandbox — but a setup that reports PASS and leaves the first wave
+    to die at exit 1 with four different vendor errors is the silence this line replaces.
+    """
+    try:
+        blob = tomllib.loads(path.read_text(encoding="utf-8"))
+    except (OSError, ValueError, tomllib.TOMLDecodeError):
+        return ""
+    profile = str(((blob.get("sandbox") or {}).get("profile")) or "")
+    return "" if profile == "off" else profile
+
+
+def dest_key(dest: Dest, repo: Path) -> str:
+    if dest.dialect == "toml":
+        return grok_key(dest.path)
+    return existing_key(dest.path, dest.scope, repo)
+
+
 # ---- the ledger side -------------------------------------------------------------------------
 
 def mint(client: Client, project: str, label: str = "") -> dict:
@@ -165,8 +380,7 @@ def verify(url: str, key: str, project: str) -> list[dict]:
                      f"{project} is writable" if project in writable else
                      f"the key cannot write {project} — you can read it but not write it, so "
                      "an agent on this key can claim nothing"))
-    missing = {t.get("name") if isinstance(t, dict) else t
-               for t in (ctx.get("missing_tiers") or [])}
+    missing = {_tier_id(t) for t in (ctx.get("missing_tiers") or [])}
     out.append(_line("ledger", PASS if "fleet" not in missing else FAIL, "fleet tools",
                      "delegate and mint_enrolment are in the manifest" if "fleet" not in missing
                      else "the fleet tier is missing, so `delegate` is not advertised — an "
@@ -174,6 +388,14 @@ def verify(url: str, key: str, project: str) -> list[dict]:
     return out
 
 
+def _tier_id(t) -> str:
+    """Live `get_context` spells it `tier`. A mock that used `name` made verify PASS against
+    a key that could not see `delegate` — the Grok case, wearing test clothes (GRPH-825)."""
+    if isinstance(t, dict):
+        return str(t.get("tier") or t.get("name") or "")
+    return str(t)
+
+
 def existing_key(path: Path, scope: str, repo: Path) -> str:
     """The key already configured here, if any. Idempotence rests on this: a second run that
     re-minted would leave a live orphan credential behind on every invocation."""
@@ -189,7 +411,8 @@ def existing_key(path: Path, scope: str, repo: Path) -> str:
 # ---- the act ---------------------------------------------------------------------------------
 
 def run(client: Client, url: str, project: str, repo: Path, *, scope: str = "user",
-        install: bool = True, home: Path | None = None) -> tuple[list[dict], int, dict]:
+        install: bool = True, home: Path | None = None,
+        grok: Path | None = None) -> tuple[list[dict], int, dict]:
     """Enable delegation, and report what is now true rather than what was attempted."""
     lines: list[dict] = []
     if not is_repo(repo):
@@ -201,58 +424,95 @@ def run(client: Client, url: str, project: str, repo: Path, *, scope: str = "use
         lines.append(_line("config", UNKNOWN, "repository",
                            f"{repo} is not a git repository — the ledger half is fine, but "
                            "gbfleet cuts a worktree per child and will refuse here"))
-    scope, path, why = target(repo, scope, home)
-    if why:
-        lines.append(_line("config", UNKNOWN, "scope", why))
-
-    if scope == "project" and tracked_by_git(path):
-        # REFUSED, not warned. This command's whole job is to put a credential in a file; a
-        # version-controlled target turns that into "commit a key", and doing it with a
-        # warning attached still does it.
-        lines.append(_line("config", FAIL, "target",
-                           f"git tracks {path} — writing a key there would commit it. "
-                           "Re-run with --scope user, which writes outside the repository"))
+    dests, dest_lines = destinations(repo, scope, home or claude_home(), grok or grok_home())
+    lines += dest_lines
+    if not dests:
         return lines, 1, {}
 
-    key = existing_key(path, scope, repo)
-    reused = bool(key)
-    if reused:
-        checks = verify(url, key, project)
+    seen: list[str] = []
+    for dest in dests:
+        found = dest_key(dest, repo)
+        if found and found not in seen:
+            seen.append(found)
+
+    key, reused, minted_id = "", False, None
+    for candidate in seen:
+        checks = verify(url, candidate, project)
         if all(c["status"] == PASS for c in checks):
-            lines.append(_line("config", PASS, "credential",
-                               f"already configured in {path} and it works"))
-            lines += checks
-            lines += skill(repo)
-            lines += supervisor(install)
-            worst = max((doctor_mod.SEVERITY[l["status"]] for l in lines), default=0)
-            return lines, (1 if worst == doctor_mod.SEVERITY[FAIL] else 0), {"reused": True}
+            key, reused = candidate, True
+            break
+    if seen and not reused:
         # A key that cannot do the job is replaced, never patched: `tool_tiers` are fixed at
         # mint and there is no route that changes them.
         lines.append(_line("config", UNKNOWN, "credential",
                            "the configured key cannot delegate, so a new one is being minted; "
                            "the old one is still live — remove it in Settings → API keys"))
-
-    try:
-        minted = mint(client, project)
-    except Refused as exc:
-        lines.append(_line("ledger", FAIL, "mint", str(exc)))
-        return lines, 1, {}
-    key = minted.get("plaintext") or ""
     if not key:
-        lines.append(_line("ledger", FAIL, "mint", "the server returned no key"))
-        return lines, 1, {}
-
-    write_entries(path, scope, repo, entries(url, project, key, repo))
-    lines.append(_line("config", PASS, "written",
-                       f"{LEDGER_SERVER} and {FLEET_SERVER} in {path} ({scope} scope)"))
-    if scope == "project":
-        lines.append(_line("config", UNKNOWN, "secret",
-                           f"{path} now holds a credential. Make sure it is gitignored"))
+        try:
+            minted = mint(client, project)
+        except Refused as exc:
+            lines.append(_line("ledger", FAIL, "mint", str(exc)))
+            return lines, 1, {}
+        key = minted.get("plaintext") or ""
+        minted_id = minted.get("id")
+        if not key:
+            lines.append(_line("ledger", FAIL, "mint", "the server returned no key"))
+            return lines, 1, {}
+
+    for dest in dests:
+        workspace = None
+        if dest.harness == "grok":
+            workspace = grok_workspace(repo, grok or grok_home())
+            if tracked_by_git(workspace):
+                lines.append(_line("config", FAIL, "target",
+                                   f"git tracks {workspace} — worktrees there would be "
+                                   "committed. Re-run with --scope user"))
+                continue
+            ok, why = workspace_writable(workspace)
+            if not ok:
+                lines.append(_line("config", FAIL, dest.harness,
+                                   f"workspace {workspace} is not writable ({why}). "
+                                   "spawn would fail as git worktree add; pass --workspace "
+                                   "at a path this harness can write (Grok's sandbox allows "
+                                   "~/.grok/ and the repository, not a sibling)"))
+                continue
+            profile = grok_sandbox_profile(grok or grok_home())
+            if profile:
+                home = Path.home()
+                lines.append(_line("config", UNKNOWN, "sandbox",
+                                   f"Grok's [sandbox] profile = {profile!r} is inherited by "
+                                   "gbfleet and every child it spawns: a claude child reads "
+                                   "'Not logged in' (the Keychain is unreachable from inside), "
+                                   "qwen-code and cursor-agent die writing ~/.qwen and "
+                                   "~/.cursor unless a custom profile grants them (extends = "
+                                   f'"workspace", read_write = ["{home / ".qwen"}", '
+                                   f'"{home / ".cursor"}"]), and a grok child runs --sandbox '
+                                   "off inside this one. `gbfleet doctor --adapter <vendor>` "
+                                   "gives the verdict per vendor (GRPH-838)"))
+        servers = entries(url, project, key, repo, workspace=workspace)
+        try:
+            write_dest(dest, repo, servers)
+        except OSError as exc:
+            lines.append(_line("config", FAIL, dest.harness,
+                               f"could not write {dest.path}: {exc}"))
+            continue
+        extra = f" workspace {workspace}" if workspace else ""
+        lines.append(_line("config", PASS, "written",
+                           f"{LEDGER_SERVER} and {FLEET_SERVER} in {dest.path} "
+                           f"({dest.harness} {dest.scope}){extra}"))
+        if dest.scope == "project":
+            lines.append(_line("config", UNKNOWN, "secret",
+                               f"{dest.path} now holds a credential. Make sure it is gitignored"))
+    if reused:
+        paths = ", ".join(str(d.path) for d in dests)
+        lines.append(_line("config", PASS, "credential",
+                           f"already configured in {paths} and it works"))
     lines += verify(url, key, project)
     lines += skill(repo)
     lines += supervisor(install)
     worst = max((doctor_mod.SEVERITY[l["status"]] for l in lines), default=0)
-    return lines, (1 if worst == doctor_mod.SEVERITY[FAIL] else 0), {"minted": minted.get("id")}
+    extra = {"reused": True} if reused else {"minted": minted_id}
+    return lines, (1 if worst == doctor_mod.SEVERITY[FAIL] else 0), extra
 
 
 def supervisor(install: bool) -> list[dict]:

{graphban_cli-0.3.0 → graphban_cli-0.4.0}/src/gban/skills/graphban-delegation/SKILL.md

@@ -46,9 +46,14 @@ not pass the stored default just because the error mentions it — the error men
 explain why it was refused.
 
 That mints a project-scoped credential that does not expire, writes the `graphban` and
-`gbfleet` MCP entries where the harness will actually read them, installs the delegation
-skill, and verifies the result. Read its output: every line is `PASS`, `FAIL` or `UNKNOWN`,
-and `UNKNOWN` means a check could not run, not that it passed.
+`gbfleet` MCP entries into every parent harness that would actually read them — Claude Code
+(`~/.claude.json`, JSON `mcpServers`) and Grok (`~/.grok/config.toml`, TOML `mcp_servers`,
+with `--workspace` under `~/.grok/gbfleet-wt/` so spawn can write worktrees inside Grok's
+sandbox) — installs the delegation skill, and verifies the result against a key those files
+hold, not against a different harness's key. Read its output: every line is `PASS`, `FAIL`
+or `UNKNOWN`, and `UNKNOWN` means a check could not run, not that it passed. A working key
+with no `gbfleet` server, or a Grok gbfleet missing `--workspace`, is repaired, not left
+alone.
 
 **If it reports no session**, that is the one thing you cannot do. Give the person the command
 to run, in exactly this form, and stop:
@@ -81,7 +86,8 @@ it, and its siblings against their project names. A project carries no repositor
 that is a match and not a lookup — it refuses every ambiguity rather than guessing, and names
 each project it could not place. Read those lines out; they are the ones needing a decision.
 
-**When setup passes, ask for a restart and stop.** MCP servers are read at startup, so the
+**When setup passes, ask for a restart of the session that will call `delegate`/`spawn` and
+stop.** That is Claude Code, or Grok, or both — MCP servers are read at startup, so the
 tools cannot appear in the session that configured them, however correct the config is. Say
 that plainly — do not call `get_context` again hoping it changed, and do not retry `gban
 setup`. It succeeded.
@@ -122,6 +128,12 @@ and a spawn without them exits before registering. That presents as a delegation
 with nothing claimed, not as an error on the spawn, so check these first when a child never
 appears.
 
+If a child exits 1 before registering and the spawn's stderr tail shows `EPERM` on a path under
+the home directory (`~/.qwen`, `~/.cursor`), `sandbox initialization failed`, or `Not logged in`
+from a machine that is logged in, the parent harness is sandboxed and the child inherited it
+(Grok's `[sandbox] profile`). `gbfleet doctor --adapter <vendor>` names it and the remedy;
+`docs/fleet-adapters.md` "A sandboxed parent is every child's sandbox" has the measurements.
+
 ## 5. Read the outcome from the ledger
 
 Nothing is pushed back to you. Read the item, or `fleet_status`. `spawn` returns an agent id at

{graphban_cli-0.3.0 → graphban_cli-0.4.0}/tests/test_setup.py

@@ -1,6 +1,6 @@
-"""`gban setup` — everything between a session and a delegating agent (GRPH-792).
+"""`gban setup` — everything between a session and a delegating agent (GRPH-792, GRPH-825).
 
-Three of these tests exist because the failure they describe is invisible when it happens.
+These tests exist because the failure they describe is invisible when it happens.
 
 - **The shadowed write.** Claude Code reads `~/.claude.json`'s per-project `mcpServers` in
   preference to a repository `.mcp.json`. A setup that wrote the repository file while a stale
@@ -10,11 +10,14 @@ Three of these tests exist because the failure they describe is invisible when i
   tracked file that becomes "commit a key", and a warning attached to it still does it.
 - **The tier that is not a permission.** A manifest missing `fleet` does not refuse `delegate`;
   it does not advertise it. The symptom is an agent reporting that the tool does not exist.
+- **The other harness.** Grok reads `~/.grok/config.toml` (`mcp_servers`, TOML). Writing only
+  Claude's file while Grok holds a different key reports success and leaves `delegate`
+  unadvertised (GRPH-825). Reuse that skips the write leaves `gbfleet` missing even on Claude.
 """
 from __future__ import annotations
 
 import json
-import subprocess
+import tomllib
 from pathlib import Path
 
 import pytest
@@ -34,11 +37,23 @@ def no_supervisor(monkeypatch):
     monkeypatch.setattr(doctor_mod, "offer_to_install", lambda *a, **k: False)
 
 
+@pytest.fixture(autouse=True)
+def no_grok_config(tmp_path_factory, monkeypatch):
+    """A test that does not create this file is a Claude-only setup, which is still the
+    common case. Tests that cover Grok write the file first. Pointed at the real
+    `~/.grok/config.toml`, every test here would rewrite the developer's harness."""
+    path = tmp_path_factory.mktemp("grokhome") / "config.toml"
+    monkeypatch.setattr(setup_mod, "grok_home", lambda: path)
+    return path
+
+
 class Server:
     """Mints, and answers `get_context` as the deployed one does."""
 
-    def __init__(self, *, writable=("core",), missing=(), refuse=None, issued=()):
+    def __init__(self, *, writable=("core",), missing=(), refuse=None, issued=(),
+                 missing_for=None):
         self.writable, self.missing, self.refuse = list(writable), list(missing), refuse
+        self.missing_for = dict(missing_for or {})
         self.minted = []
         #: Every key this deployment knows. Anything else 401s, as a real one does.
         self.issued = set(issued)
@@ -60,12 +75,16 @@ def _context(server):
     A mock that answered every key identically would make the stale-credential case
     untestable, which is the case this command exists for: the key in the config is not
     invalid in some abstract way, it is a credential the server does not know.
+
+    Live `missing_tiers` objects use `tier`, not `name` (`mcp_server.py`). Spelling it
+    `name` here made verify PASS against a key that could not see `delegate`.
     """
     def call(self, method, path, body=None):
         if self.api_key not in server.issued:
             raise Refused(401, "invalid api key", "")
+        missing = server.missing_for.get(self.api_key, server.missing)
         ctx = {"project_id": "core", "writable_projects": server.writable,
-               "missing_tiers": [{"name": t} for t in server.missing]}
+               "missing_tiers": [{"tier": t} for t in missing]}
         return {"result": {"content": [{"text": json.dumps(ctx)}]}}
     return call
 
@@ -224,6 +243,29 @@ def test_a_second_run_reuses_the_working_credential(tmp_path, wired):
     assert len(server.minted) == 1, "minted a second key for an already-working setup"
     assert made.get("reused") is True
     assert any("already configured" in l["detail"] for l in lines)
+    servers = json.loads(home.read_text())["projects"][str(repo.resolve())]["mcpServers"]
+    assert set(servers) == {"graphban", "gbfleet"}
+
+
+def test_reuse_still_writes_a_missing_gbfleet_entry(tmp_path, wired):
+    """THE SECOND DEFECT. Reuse skipped write_entries, so a Claude file that only had
+    `graphban` stayed that way while setup reported PASS (GRPH-825)."""
+    repo, home = tmp_path / "repo", tmp_path / ".claude.json"
+    repo.mkdir()
+    home.write_text(json.dumps({"projects": {str(repo.resolve()): {
+        "mcpServers": {"graphban": {"type": "http",
+                                    "url": URL + "/api/mcp",
+                                    "headers": {"X-API-Key": "gb_sk_ok"}}}}}}))
+
+    server = Server(issued={"gb_sk_ok"})
+    lines, code, made = _run(server, repo, home, wired=wired)
+
+    assert code == 0, lines
+    assert made.get("reused") is True
+    assert server.minted == [], "repaired by writing, which is not a reason to mint"
+    servers = json.loads(home.read_text())["projects"][str(repo.resolve())]["mcpServers"]
+    assert "gbfleet" in servers
+    assert doctor_mod.SUPERVISOR_KEY_ENV in servers["gbfleet"]["env"]
 
 
 def test_a_configured_key_that_cannot_delegate_is_replaced_and_the_old_one_named(tmp_path, wired):
@@ -261,6 +303,156 @@ def test_other_servers_in_the_file_survive(tmp_path, wired):
     assert "context7" in servers and "graphban" in servers
 
 
+# ---- Grok (GRPH-825) ---------------------------------------------------------------------------
+
+def test_setup_writes_grok_toml_mcp_servers_when_the_file_exists(
+        tmp_path, wired, no_grok_config):
+    """THE MEASURED ONE. Grok reads `mcp_servers` in TOML. `mcpServers` parses and loads
+    nothing; JSON in a `.toml` path is the same silence (GRPH-575, now for the parent)."""
+    repo, home = tmp_path / "repo", tmp_path / ".claude.json"
+    repo.mkdir()
+    no_grok_config.write_text("# keep me\n[ui]\nmax_thoughts_width = 120\n")
+
+    lines, code, _ = _run(Server(), repo, home, wired=wired)
+
+    assert code == 0, lines
+    text = no_grok_config.read_text()
+    assert "# keep me" in text
+    parsed = tomllib.loads(text)
+    assert "mcp_servers" in parsed
+    assert "mcpServers" not in parsed
+    gb = parsed["mcp_servers"]["graphban"]
+    assert gb["url"].endswith("/api/mcp")
+    assert gb["headers"]["X-API-Key"].startswith("gb_sk_")
+    fleet = parsed["mcp_servers"]["gbfleet"]
+    assert fleet["command"] == "gbfleet"
+    assert "--project" in fleet["args"]
+    assert "--workspace" in fleet["args"]
+    ws = Path(fleet["args"][fleet["args"].index("--workspace") + 1])
+    assert ws == no_grok_config.parent / "gbfleet-wt" / repo.name, (
+        "Grok worktrees must sit next to Grok's config, not as a sibling of the repo "
+        "(GRPH-826)"
+    )
+    assert doctor_mod.SUPERVISOR_KEY_ENV in fleet["env"]
+    assert parsed["ui"]["max_thoughts_width"] == 120
+    claude = json.loads(home.read_text())["projects"][str(repo.resolve())]["mcpServers"]
+    assert claude["graphban"]["headers"]["X-API-Key"] == gb["headers"]["X-API-Key"]
+    assert "--workspace" not in claude["gbfleet"]["args"], (
+        "Claude can write the sibling default; moving it would be fixing the wrong harness"
+    )
+
+
+def test_a_working_claude_key_is_copied_onto_a_grok_key_that_cannot_delegate(
+        tmp_path, wired, no_grok_config):
+    """Claude's key can see `fleet`. Grok's cannot. Verifying only Claude PASSed and left
+    Grok on the weak key — which is how this session opened."""
+    repo, home = tmp_path / "repo", tmp_path / ".claude.json"
+    repo.mkdir()
+    home.write_text(json.dumps({"projects": {str(repo.resolve()): {
+        "mcpServers": {"graphban": {"headers": {"X-API-Key": "gb_sk_good"}},
+                       "gbfleet": {"command": "gbfleet"}}}}}))
+    no_grok_config.write_text(
+        '[mcp_servers.graphban]\nurl = "http://gb.invalid/api/mcp"\nenabled = true\n\n'
+        '[mcp_servers.graphban.headers]\nX-API-Key = "gb_sk_weak"\n'
+    )
+    server = Server(issued={"gb_sk_good", "gb_sk_weak"},
+                    missing_for={"gb_sk_weak": ("fleet",)})
+
+    lines, code, made = _run(server, repo, home, wired=wired)
+
+    assert code == 0, lines
+    assert made.get("reused") is True
+    assert server.minted == [], "the working Claude key is the one to write, not a third"
+    grok = tomllib.loads(no_grok_config.read_text())
+    assert grok["mcp_servers"]["graphban"]["headers"]["X-API-Key"] == "gb_sk_good"
+    assert "gbfleet" in grok["mcp_servers"]
+
+
+def test_setup_does_not_invent_a_grok_config_when_grok_has_never_run(
+        tmp_path, wired, no_grok_config):
+    repo, home = tmp_path / "repo", tmp_path / ".claude.json"
+    repo.mkdir()
+    _run(Server(), repo, home, wired=wired)
+    assert not no_grok_config.exists()
+
+
+def test_a_git_tracked_grok_project_file_is_refused(tmp_path, wired, monkeypatch):
+    repo, home = tmp_path / "repo", tmp_path / ".claude.json"
+    repo.mkdir()
+    grok_proj = repo / ".grok" / "config.toml"
+    grok_proj.parent.mkdir()
+    grok_proj.write_text("[ui]\n")
+    monkeypatch.setattr(setup_mod, "tracked_by_git",
+                        lambda path: path == grok_proj)
+
+    server = Server()
+    lines, code, _ = _run(server, repo, home, scope="project", wired=wired)
+
+    assert any("git tracks" in l["detail"] and ".grok/config.toml" in l["detail"]
+               for l in lines)
+    # Claude's project file is not tracked, so it is still written. The grok FAIL is
+    # a real finding and so the exit is 1 — a PASS report would hide the refusal.
+    assert code == 1
+    assert (repo / ".mcp.json").exists()
+    assert tomllib.loads(grok_proj.read_text()) == {"ui": {}}
+
+
+def test_reuse_repairs_a_gbfleet_entry_missing_workspace(tmp_path, wired, no_grok_config):
+    """THE FOLLOW-ON. A Grok gbfleet written before GRPH-826 has no --workspace. Reuse
+    that skipped the write would leave spawn dying as git 128."""
+    repo, home = tmp_path / "repo", tmp_path / ".claude.json"
+    repo.mkdir()
+    home.write_text(json.dumps({"projects": {str(repo.resolve()): {
+        "mcpServers": {"graphban": {"headers": {"X-API-Key": "gb_sk_ok"}}}}}}))
+    no_grok_config.write_text(
+        '[mcp_servers.graphban]\nurl = "http://gb.invalid/api/mcp"\nenabled = true\n\n'
+        '[mcp_servers.graphban.headers]\nX-API-Key = "gb_sk_ok"\n\n'
+        '[mcp_servers.gbfleet]\ncommand = "gbfleet"\n'
+        'args = ["mcp", "--repo", "/old", "--server", "http://gb.invalid", '
+        '"--project", "core"]\n'
+        'env = { GBFLEET_API_KEY = "gb_sk_ok" }\nenabled = true\n'
+    )
+    server = Server(issued={"gb_sk_ok"})
+    _, code, made = _run(server, repo, home, wired=wired)
+
+    assert code == 0
+    assert made.get("reused") is True
+    assert server.minted == []
+    args = tomllib.loads(no_grok_config.read_text())["mcp_servers"]["gbfleet"]["args"]
+    assert "--workspace" in args
+
+
+def test_an_unwritable_grok_workspace_is_not_a_pass(tmp_path, wired, no_grok_config, monkeypatch):
+    """gbfleet doctor already FAILs this. Setup reporting PASS is how spawn looked like git."""
+    repo, home = tmp_path / "repo", tmp_path / ".claude.json"
+    repo.mkdir()
+    no_grok_config.write_text("[ui]\n")
+    monkeypatch.setattr(setup_mod, "workspace_writable",
+                        lambda path: (False, "Operation not permitted"))
+
+    lines, code, _ = _run(Server(), repo, home, wired=wired)
+
+    assert code == 1
+    assert any("not writable" in l["detail"] for l in lines)
+    assert "mcp_servers" not in tomllib.loads(no_grok_config.read_text())
+
+
+def test_args_arrays_are_not_mistaken_for_table_headers(tmp_path, wired, no_grok_config):
+    """`args = ["mcp", ...]` contains `[`. Walking until the next `[` stops there and
+    leaves garbage that Grok cannot parse."""
+    repo, home = tmp_path / "repo", tmp_path / ".claude.json"
+    repo.mkdir()
+    no_grok_config.write_text(
+        '[mcp_servers.gbfleet]\ncommand = "gbfleet"\n'
+        'args = ["mcp", "--repo", "/old"]\n'
+        'env = { GBFLEET_API_KEY = "gb_sk_old" }\nenabled = true\n'
+    )
+    _run(Server(), repo, home, wired=wired)
+    parsed = tomllib.loads(no_grok_config.read_text())
+    assert parsed["mcp_servers"]["gbfleet"]["args"][0] == "mcp"
+    assert "--project" in parsed["mcp_servers"]["gbfleet"]["args"]
+
+
 def test_every_route_setup_calls_is_documented(tmp_path, wired, monkeypatch):
     """The check `test_acts.py` makes for the verbs it drives, made here for the one it
     cannot: a verb pointed at an invented path is a verb that 404s in front of somebody
@@ -331,6 +523,11 @@ def test_the_skill_tells_the_agent_the_two_things_it_cannot_work_out(tmp_path):
     # It drives the CLI rather than restating the setup, which is what keeps it from becoming
     # a fourth copy of the procedure that drifts from the other three.
     assert "gban setup" in body
+    # Two parent harnesses. Naming only one is how GRPH-825 shipped.
+    assert "claude.json" in body
+    assert "config.toml" in body
+    assert "mcp_servers" in body
+    assert "gbfleet-wt" in body
 
 
 def test_the_skill_hands_the_person_a_runnable_line_and_carries_the_rest(tmp_path):
@@ -746,3 +943,40 @@ def test_a_real_repository_says_nothing_about_it(tmp_path, wired):
     lines, _, _ = _run(Server(), repo, home, wired=wired)
 
     assert not any(l["name"] == "repository" for l in lines)
+
+
+# ---- a sandboxed Grok is a sandboxed fleet (GRPH-838) --------------------------------------------
+
+def test_setup_names_a_grok_sandbox_that_every_child_will_inherit(tmp_path, wired, no_grok_config):
+    """Measured 2026-09-10: `[sandbox] profile = "workspace"` reached gbfleet and every vendor
+    it spawned, and four children died at exit 1 before registering, each with its own
+    vendor's error. Setup cannot change the operator's sandbox, but a PASS report that leaves
+    the first wave to find this out is the silence this line replaces."""
+    repo, home = tmp_path / "repo", tmp_path / ".claude.json"
+    repo.mkdir()
+    no_grok_config.write_text('[sandbox]\nprofile = "workspace"\n')
+
+    lines, code, _ = _run(Server(), repo, home, wired=wired)
+
+    assert code == 0, "a finding, not a refusal — grok children still spawn"
+    line = next(l for l in lines if l["name"] == "sandbox")
+    assert line["status"] == "UNKNOWN"
+    assert "Not logged in" in line["detail"], "the claude symptom, so it is recognised later"
+    assert ".qwen" in line["detail"] and ".cursor" in line["detail"]
+    assert "--sandbox off" in line["detail"]
+    grok = tomllib.loads(no_grok_config.read_text())
+    assert "gbfleet" in grok["mcp_servers"], "the entry is still written"
+
+
+@pytest.mark.parametrize("body", ["[ui]\n", '[sandbox]\nprofile = "off"\n'])
+def test_a_grok_config_without_a_live_sandbox_says_nothing_about_one(
+        tmp_path, wired, no_grok_config, body):
+    """The control. Off and unset are the same fact, and a line that fires for both would be
+    noise on every machine — which is how the real one gets scrolled past."""
+    repo, home = tmp_path / "repo", tmp_path / ".claude.json"
+    repo.mkdir()
+    no_grok_config.write_text(body)
+
+    lines, _, _ = _run(Server(), repo, home, wired=wired)
+
+    assert not any(l["name"] == "sandbox" for l in lines)